YouTube embeds and cookie consent: load the video after the click

An embedded YouTube player is a third-party iframe: the moment the page loads, the visitor's browser requests the player from Google, sending the IP address and letting Google store what it stores. Under the ePrivacy rules that is a storage and access operation that needs consent unless it is strictly necessary, and a video on a marketing page is not. The fix is to keep the iframe empty until the visitor consents to the embed's category, and to show a placeholder in the meantime. The youtube-nocookie.com domain reduces what Google does with the view; it does not remove the request to Google.

What privacy-enhanced mode does and does not do

YouTube's help page for embedding describes a privacy-enhanced mode, enabled by changing the embed domain from https://www.youtube.com to https://www.youtube-nocookie.com. Google's description is precise: the mode "prevents the use of views of embedded YouTube content from influencing the viewer's browsing experience on YouTube", and ads shown in that mode are not personalized. It is available only for embedded players on websites.

Read what it does not say. It does not say that no data is sent to Google, and the player is still loaded from Google's servers, so the IP address and the page are known to Google before any play. Treat privacy-enhanced mode as a sensible default for every embed, and still gate the load on consent for visitors in consent countries. The EDPB's cookie banner taskforce restated the baseline in its 2023 report: by default, no cookies which require consent can be set without consent, and consent must be expressed by a positive action.

Which category?

There is no official category table for embeds. Cookiequiet's provider database holds YouTube embeds under marketing because the data goes to Google's advertising ecosystem, and Vimeo players under functional. You can override the category per embed with data-cq-category. Whatever you choose, describe it the same way in the cookie policy, and remember that "functional" still requires consent; only "necessary" runs without asking.

The markup

Move the URL from src to data-cq-src. The iframe stays blank until the category is granted, then the URL is restored and the player loads:

html
<div class="video">
  <iframe data-cq-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
    data-cq-category="marketing" width="560" height="315"
    title="How the product works" allowfullscreen loading="lazy"></iframe>
  <p class="video-placeholder">
    This video is hosted by YouTube and loads after you accept marketing cookies.
    <button type="button" data-cq-show-preferences>Open cookie settings</button>
  </p>
</div>

The data-cq-show-preferences attribute opens the preferences centre when clicked; a link to #cq-preferences does the same. Once the visitor accepts the category, the player loads without a reload. To hide the placeholder when the video is active, listen for consent in a few lines of script:

js
window.addEventListener('cq:consent', function (e) {
  if (e.detail.categories.indexOf('marketing') >= 0) {
    document.querySelectorAll('.video-placeholder').forEach(function (p) { p.hidden = true; });
  }
});

The same pattern works for Google Maps, Vimeo, Spotify, SoundCloud, Calendly, Typeform and any other iframe.

What to put in the cookie policy

An embed is a third party, so it belongs in the cookie table like a script. List YouTube (Google) under the category you chose, with the purpose ("plays videos hosted by YouTube; YouTube may store identifiers and measure the view"), the country of processing and a link to Google's privacy policy. If you use privacy-enhanced mode, say so, and say what it does in Google's words rather than promising that no data is collected. The scanner detects YouTube, Vimeo and other players by their iframe URLs and adds them to the table with their provider entry, so the policy stays in step with the pages.

Alternatives that avoid the question

For a handful of short videos, hosting the files yourself and using the HTML <video> element removes the third party entirely: no consent, no placeholder, no table row. The trade-off is bandwidth and the absence of adaptive streaming, which matters for long or popular videos. A middle ground is to keep YouTube for hosting and show a first-party poster image with a play button; the player is only inserted, with consent, when the visitor clicks. Whatever you pick, the rule is the same: nothing from the third party before a positive action by the visitor.

Thumbnails and the IP address

A placeholder that shows the video's thumbnail from img.youtube.com sends the visitor's IP address to Google just as the player would. If you want a preview image, host it yourself: download the thumbnail once and serve it from your own domain, or use a neutral placeholder with the title. The point of the gate is that nothing reaches Google before the click.

Embeds created by a CMS or a plugin

WordPress, Webflow, Squarespace and most page builders insert the iframe for you, with a plain src. Two options: a plugin or setting that outputs data-cq-src instead (some platforms call this "lazy" or "consent-aware" embedding), or the auto-blocker, which intercepts iframes created by JavaScript whose URL matches a known provider, YouTube included, and holds them until consent. The auto-blocker catches iframes created after the page loads; an iframe written directly in the server-rendered HTML with a src loads before any script can act, so for those the attribute change is the only reliable fix. The platform guides say which approach each CMS needs.

Visitors outside consent countries

If geo-targeting is set to show the banner only in regulated countries, visitors elsewhere get every category granted and the embeds load immediately. Visitors in US states with an opt-out law see the opt-out notice, and embeds load unless the visitor opted out or sends a Global Privacy Control signal. Nothing changes in the markup; the gate simply opens.