Free whiteglove setup from a ConsentStack Concierge
YouTube Player

YouTube Player

YouTube Player embeds YouTube videos on external websites via iframe. Scripts load from Google's servers and set cookies for video playback preferences, watch history, and ad targeting. Cookies are dropped even when visitors only view the embed without interacting with the player.

Google
Part of Google
Back to Vendor Library

Overview

YouTube Player is the standard video embed mechanism for displaying YouTube-hosted videos on external websites. As a Google product, the YouTube iframe embed carries Google's full advertising and tracking infrastructure with it — setting cookies, loading ad scripts, and transmitting viewing data to Google even before the visitor clicks play. YouTube embeds are ubiquitous across the web, appearing on blogs, news sites, e-commerce product pages, documentation, and virtually any site that hosts video content.

What This Script Does

YouTube videos embed via an iframe from youtube.com or youtube-nocookie.com, loading Google's video player and associated tracking infrastructure.

Standard Embed (youtube.com)

  • Iframe loaded: youtube.com/embed/{video_id} — loads the YouTube player, video metadata, and Google's advertising and analytics scripts within a cross-origin iframe
  • Cookies set on page load (before any interaction):
    • VISITOR_INFO1_LIVE — Third-party cookie on youtube.com (6-month expiry). Estimates bandwidth and determines player interface version.
    • YSC — Third-party cookie on youtube.com (session). Unique session identifier tracking video views.
    • GPS — Third-party cookie on youtube.com (30-minute expiry). Stores geographic location for mobile tracking.
    • IDE — Third-party cookie on doubleclick.net (13-month expiry, 24 hours in EEA). Cross-site ad targeting and conversion attribution.
    • CONSENT — Third-party cookie on youtube.com. Records consent state.
  • Data collected: Video view events, watch duration, pause/resume interactions, player errors, browser user agent, IP address (for geolocation), and referring page URL. This data is transmitted to YouTube/Google's analytics and advertising systems.
  • Ad serving: If the video has ads enabled, pre-roll, mid-roll, and overlay ads are served from Google's ad infrastructure, loading additional ad tracking scripts within the iframe.

Privacy-Enhanced Embed (youtube-nocookie.com)

  • Iframe loaded: youtube-nocookie.com/embed/{video_id} — loads the YouTube player with reduced tracking
  • Cookie behavior: Cookies are not set until the visitor clicks play. No doubleclick.net cookies are set in this mode.
  • Limitation: Once the visitor clicks play, YouTube's standard cookies are set and viewing data is transmitted to Google. The privacy enhancement only delays tracking until interaction.

Consent & Compliance

YouTube Player falls under both functional and marketing consent categories.

Under GDPR and ePrivacy, standard YouTube embeds require consent because they set third-party cookies (including the IDE cookie on doubleclick.net for cross-site ad targeting) on page load — before any user interaction. This constitutes storage of non-essential information on the user's device under the ePrivacy Directive. Several EU DPAs have addressed YouTube embeds specifically, noting that they transmit personal data (IP address, viewing behavior) to Google without a valid legal basis if loaded without consent. The privacy-enhanced mode (youtube-nocookie.com) defers cookie setting until playback but does not eliminate the consent requirement, as viewing data is still transmitted to Google once the video plays.

Under CCPA/CPRA, the sharing of viewer data with Google's advertising platform through the doubleclick.net cookie and ad targeting infrastructure constitutes "sharing" of personal information for cross-context behavioral advertising. The viewer's IP address, video interactions, and derived interest data are processed by Google for ad targeting across its network.

Should You Block This Without Consent?

Conditional. Standard YouTube embeds (youtube.com) set tracking cookies on page load and should be blocked until consent is obtained. Replace them with a static thumbnail image and a play button that loads the actual embed after the user clicks (facade pattern). Using youtube-nocookie.com is a partial improvement but still requires consent for the marketing components. For a purely functional video display, consider using the privacy-enhanced embed with a click-to-load facade as the minimum acceptable implementation.

Is YouTube Player GDPR compliant?

YouTube Player typically loads functional and marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So YouTube Player can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads YouTube Player, not on YouTube Player itself.

Visit website

Consent Categories

FunctionalMarketing

Also Known As

youtube embed cookiesyoutube player trackingyoutube iframe privacyyoutube embed consentgoogle video embed cookies

Industries

Computers Electronics and Technology

Frequently Asked Questions

Other Google Products

Firebase
Firebase
Firebase is Google's mobile and web application development platform offering authentication, real-time database, cloud functions, and analytics. Web SDK scripts initialize Firebase services and may track app events via Firebase Analytics, which is powered by Google Analytics 4. Widely used in single-page apps and PWAs for backend infrastructure and usage tracking.
Google Ads
Google Ads
Google Ads is Google's advertising platform for search, display, and remarketing campaigns. Conversion tracking scripts fire on advertiser landing pages to measure actions taken after ad clicks. The remarketing tag builds audience lists for retargeting users across Google's ad network.
Google Analytics
Google Analytics
Google Analytics is the world's most widely deployed web analytics platform. Scripts track page views, sessions, user demographics, traffic sources, and conversion events. Drops cookies to identify returning visitors and attribute user journeys across sessions.
Google Fonts
Google Fonts
Google Fonts is a free font hosting service that serves hundreds of typeface families via a global CDN. Stylesheets and font files load from fonts.googleapis.com and fonts.gstatic.com to deliver web fonts to visitors. No advertising or tracking functionality is included.
Google Maps
Google Maps
Google Maps is the dominant web mapping service used for embedded maps and location features on websites. Scripts load interactive map tiles, geocoding, and Places API functionality through the Maps JavaScript API. May set cookies to remember map preferences and manage API quota.
Google Tag Manager
Google Tag Manager
Google Tag Manager is a tag management system that lets marketers deploy and update analytics and marketing scripts without code changes. The GTM container script loads synchronously in the page head and injects configured tags, triggers, and variables on behalf of other vendors. No data collection of its own — acts as a loader for other scripts.
reCAPTCHA
reCAPTCHA
Google reCAPTCHA is a bot detection and spam prevention service protecting web forms, login pages, and checkout flows. Scripts analyze user behavior, mouse movements, and browser fingerprints to distinguish humans from bots. The invisible reCAPTCHA v3 scores interactions without requiring user challenges.
YouTube
YouTube
YouTube is Google's video platform, widely used to embed video content on external websites. The YouTube iframe player loads JavaScript that communicates with Google's servers for video playback, quality control, and ad serving. Embedded players may set cookies tied to the viewer's Google account to track watch history and personalize recommendations.
Google Search
Google Search
Google Search appears on websites through the Programmable Search Engine, enabling custom site-specific search functionality. Scripts load the search widget from Google's servers to render search bars and display results within the host website. Sends search queries to Google's index and may set cookies for search personalization and query history.
Sign in with Google
Sign in with Google
Sign in with Google is an OAuth-based authentication service that enables users to log into websites using their Google account credentials. Scripts load the Google Identity Services library, display sign-in buttons, and handle token exchange for secure authentication. Stores session tokens and authentication cookies to maintain login state across page visits.

Related Vendors

Cloudflare Turnstile
Cloudflare Turnstile
Cloudflare Turnstile is a CAPTCHA alternative for bot detection and spam prevention. Scripts analyze browser behavioral signals, attributes, and interaction patterns to verify human visitors without requiring visual puzzle-solving challenges. Sets minimal functional tokens; does not build visitor profiles.
Facebook Share Button
Facebook Share Button
Facebook Share Button is a Meta social plugin that lets visitors share web content to their Facebook feed. Scripts load the Meta SDK and set cross-site tracking cookies on page load, enabling Meta to track visits and attribute browsing behavior for advertising purposes.
Cloudflare Zaraz
Cloudflare Zaraz
Cloudflare Zaraz is a third-party script manager that runs marketing and analytics tags server-side through Cloudflare's edge network. Scripts are proxied rather than loaded directly from third-party domains, reducing client-side tracking exposure and improving page load performance.
Facebook Login
Facebook Login
Facebook Login is a Meta OAuth authentication service that allows users to sign in to third-party websites using their Facebook account. Scripts load the Meta SDK, set cross-site session cookies for authentication, and may share login activity data with Meta.
Facebook Comments
Facebook Comments
Facebook Comments is a Meta social plugin that embeds a comment system on external websites. Scripts load the Meta SDK, set Facebook tracking cookies on page load, and send engagement data to Meta regardless of whether visitors interact with the widget.
Instagram Feed
Instagram Feed
Instagram Feed embeds allow websites to display Instagram posts and media galleries. Scripts load Meta's Instagram embed code, set tracking cookies, and send interaction data to Meta. Visitor browser data may be shared with Meta on page load regardless of whether visitors interact with the content.

Manage consent for YouTube Player

ConsentStack automatically detects and manages YouTube Player trackers so your site stays compliant with global privacy regulations.

Get started free