Free whiteglove setup from a ConsentStack Concierge
YouTube

YouTube

YouTube is Google's video platform, widely used to embed video content on external websites. The YouTube iframe player loads JavaScript that communicates with Google's servers for video playback, quality control, and ad serving. Embedded players may set cookies tied to the viewer's Google account to track watch history and personalize recommendations.

Google
Part of Google
Back to Vendor Library

Overview

YouTube is Google's video platform, used by billions of users worldwide. On third-party websites, YouTube appears primarily through the embedded iframe player (youtube.com/embed/{videoId}), which loads JavaScript that communicates with Google's servers for video playback, recommendations, and advertising. Google uses YouTube embeds on third-party sites as a touchpoint for collecting behavioral data and matching it to Google Account profiles for advertising purposes.

What This Script Does

YouTube Iframe API

When the YouTube iframe player is embedded, it loads the YouTube IFrame Player API from www.youtube.com/iframe_api. This JavaScript library enables programmatic control of the player (play, pause, seek) and fires events (onReady, onStateChange) that host pages can subscribe to. Even without the IFrame API, the standard <iframe> embed triggers multiple network requests to YouTube and Google domains.

Privacy-Enhanced Mode

YouTube offers a privacy-enhanced embed domain (youtube-nocookie.com). This variant does not set cookies until the user actively interacts with the video. It is the recommended embed method for GDPR-compliant deployments where consent has not yet been obtained. Note: YouTube still makes network requests to Google's infrastructure even in privacy-enhanced mode.

Cookies Set

Standard YouTube embed (youtube.com):

  • VISITOR_INFO1_LIVE — Third-party persistent cookie on youtube.com. Stores a visitor identifier used to estimate audience size and track video interactions. Duration: 6 months.
  • YSC — Third-party session cookie on youtube.com. Tracks YouTube video interactions within a session. Duration: session.
  • PREF — Third-party persistent cookie on youtube.com. Stores preferences including video quality and playback speed. Duration: 2 years.
  • GPS — Third-party session cookie on youtube.com. Mobile device location-based recommendation data. Duration: 30 minutes.

Privacy-enhanced embed (youtube-nocookie.com): No cookies set until user interaction.

Domains Contacted

  • www.youtube.com / youtube-nocookie.com — Serves the player iframe and IFrame API.
  • i.ytimg.com — Thumbnail and image CDN.
  • yt3.ggpht.com — Channel artwork CDN.
  • googlevideo.com — Video stream delivery via adaptive bitrate.
  • doubleclick.net — Ad serving for monetized YouTube videos embedded on third-party sites.
  • google.com / google-analytics.com — Google's analytics infrastructure triggered by the embed.

Data Collected Per Interaction

  • Video ID watched and duration of watch time
  • Play, pause, seek, and completion events
  • Page URL where the video is embedded
  • Browser user-agent, screen resolution, and network type
  • IP address for geolocation
  • Google Account identity when the visitor is signed into a Google service
  • Ad impressions and ad interactions on monetized videos
  • Search and recommendation interaction if the player's suggested video feature is enabled

Consent & Compliance

GDPR / ePrivacy: Standard YouTube embeds set third-party cookies and transmit data to Google's advertising infrastructure (DoubleClick). Multiple EU DPAs have ruled that standard YouTube embeds require prior consent under the ePrivacy Directive. The German Conference of Independent Data Protection Authorities (DSK) published guidance that YouTube embeds constitute third-party tracking. Using the youtube-nocookie.com domain for embeds mitigates the cookie issue but does not fully eliminate network requests to Google. For full compliance, load YouTube iframes only after consent, or use a facade/poster that activates the embed on user click.

CCPA / CPRA: Google/YouTube's data collection across third-party sites through the player constitutes sharing of personal information for advertising. Operators must disclose YouTube in their CCPA privacy notice.

EU-US Data Privacy Framework: Google is certified under the EU-US DPF. Standard Contractual Clauses are also available via Google's DPA.

Consent Category: Functional (for video playback) / Marketing (for advertising tracking via DoubleClick when embedded on third-party sites).

Should You Block This Without Consent?

Conditional. Use youtube-nocookie.com for all embeds to minimize tracking before user interaction. Standard youtube.com embeds must be blocked until consent is obtained due to the third-party cookies set on page load. Even with the nocookie domain, a best practice is to show a video facade (thumbnail image with play button) and only load the actual iframe when the user clicks play, eliminating any pre-consent network requests to Google.

Is YouTube GDPR compliant?

YouTube typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So YouTube can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads YouTube, not on YouTube itself.

Visit website

Consent Categories

Functional

Also Known As

YouTube embedYouTube iframeYouTube cookie GDPRgoogle.com/recaptchaYouTube advertising cookieyoutube-nocookie.comYSC cookie

Industries

Computers Electronics and Technology

Tracked Domains (3)

YouTube's trackers are common, seen on about 6% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

youtube.comFunctional

youtube.com is a functional domain operated by YouTube, used to run site features like chat, video, embeds, and preferences. Seen on about 6% of scanned sites.

youtube-nocookie.comFunctional

youtube-nocookie.com is a functional domain operated by YouTube, used to run site features like chat, video, embeds, and preferences. Seen on under 1% of scanned sites.

youtu.beFunctional

youtu.be is a functional domain operated by YouTube, used to run site features like chat, video, embeds, and preferences.

Frequently Asked Questions

Other Google Products

Firebase
Firebase
Firebase is Google's mobile and web application development platform offering authentication, real-time database, cloud functions, and analytics. Web SDK scripts initialize Firebase services and may track app events via Firebase Analytics, which is powered by Google Analytics 4. Widely used in single-page apps and PWAs for backend infrastructure and usage tracking.
Google Ads
Google Ads
Google Ads is Google's advertising platform for search, display, and remarketing campaigns. Conversion tracking scripts fire on advertiser landing pages to measure actions taken after ad clicks. The remarketing tag builds audience lists for retargeting users across Google's ad network.
Google Analytics
Google Analytics
Google Analytics is the world's most widely deployed web analytics platform. Scripts track page views, sessions, user demographics, traffic sources, and conversion events. Drops cookies to identify returning visitors and attribute user journeys across sessions.
Google Fonts
Google Fonts
Google Fonts is a free font hosting service that serves hundreds of typeface families via a global CDN. Stylesheets and font files load from fonts.googleapis.com and fonts.gstatic.com to deliver web fonts to visitors. No advertising or tracking functionality is included.
Google Maps
Google Maps
Google Maps is the dominant web mapping service used for embedded maps and location features on websites. Scripts load interactive map tiles, geocoding, and Places API functionality through the Maps JavaScript API. May set cookies to remember map preferences and manage API quota.
Google Tag Manager
Google Tag Manager
Google Tag Manager is a tag management system that lets marketers deploy and update analytics and marketing scripts without code changes. The GTM container script loads synchronously in the page head and injects configured tags, triggers, and variables on behalf of other vendors. No data collection of its own — acts as a loader for other scripts.
reCAPTCHA
reCAPTCHA
Google reCAPTCHA is a bot detection and spam prevention service protecting web forms, login pages, and checkout flows. Scripts analyze user behavior, mouse movements, and browser fingerprints to distinguish humans from bots. The invisible reCAPTCHA v3 scores interactions without requiring user challenges.
Google Search
Google Search
Google Search appears on websites through the Programmable Search Engine, enabling custom site-specific search functionality. Scripts load the search widget from Google's servers to render search bars and display results within the host website. Sends search queries to Google's index and may set cookies for search personalization and query history.
Sign in with Google
Sign in with Google
Sign in with Google is an OAuth-based authentication service that enables users to log into websites using their Google account credentials. Scripts load the Google Identity Services library, display sign-in buttons, and handle token exchange for secure authentication. Stores session tokens and authentication cookies to maintain login state across page visits.
YouTube Player
YouTube Player
YouTube Player embeds YouTube videos on external websites via iframe. Scripts load from Google's servers and set cookies for video playback preferences, watch history, and ad targeting. Cookies are dropped even when visitors only view the embed without interacting with the player.

Related Vendors

Brightcom
Brightcom
Israeli digital advertising network providing programmatic display and video advertising across global publisher inventory. Brightcom scripts participate in header bidding auctions and serve targeted ad creatives.
Centro
Centro
Centro (now Basis Technologies) is an enterprise digital advertising platform for agencies and media buyers. Scripts may appear as part of campaign tracking infrastructure firing attribution pixels on advertiser confirmation pages.
Airbrake
Airbrake
Airbrake is an error monitoring and performance tracking platform. Its scripts capture JavaScript errors, stack traces, and performance metrics from visitor browsers, sending diagnostic data to Airbrake servers for analysis. This processing helps developers identify and resolve issues affecting site reliability.
Fonticons
Fonticons
Font hosting and typography services platform. Font Awesome scripts load icon font libraries from CDN. The Fonticons CDN operates primarily as an asset delivery mechanism with no behavioral tracking, though CDN access logs may record visitor IP addresses.
Disqus
Disqus
Embeddable comment platform used by blogs and content sites to add community discussion. Loading Disqus injects a heavyweight script that fetches comment threads and sets multiple tracking cookies, including for Disqus's own ad network. Disqus serves targeted ads within the comment widget and logs user engagement data.
StatusPage
StatusPage
StatusPage is Atlassian's hosted status page service for communicating uptime and incidents. Its embeddable widgets display real-time service status on websites by fetching data from StatusPage's API. The widgets do not set cookies or collect visitor information.

Manage consent for YouTube

ConsentStack automatically detects and manages YouTube trackers so your site stays compliant with global privacy regulations.

Get started free