YouTube

Overview

YouTube is Google's video platform, used by billions of users worldwide. On third-party websites, YouTube appears primarily through the embedded iframe player (youtube.com/embed/{videoId}), which loads JavaScript that communicates with Google's servers for video playback, recommendations, and advertising. Google uses YouTube embeds on third-party sites as a touchpoint for collecting behavioral data and matching it to Google Account profiles for advertising purposes.

What This Script Does

YouTube Iframe API

When the YouTube iframe player is embedded, it loads the YouTube IFrame Player API from www.youtube.com/iframe_api. This JavaScript library enables programmatic control of the player (play, pause, seek) and fires events (onReady, onStateChange) that host pages can subscribe to. Even without the IFrame API, the standard <iframe> embed triggers multiple network requests to YouTube and Google domains.

Privacy-Enhanced Mode

YouTube offers a privacy-enhanced embed domain (youtube-nocookie.com). This variant does not set cookies until the user actively interacts with the video. It is the recommended embed method for GDPR-compliant deployments where consent has not yet been obtained. Note: YouTube still makes network requests to Google's infrastructure even in privacy-enhanced mode.

Cookies Set

Standard YouTube embed (youtube.com):

• VISITOR_INFO1_LIVE — Third-party persistent cookie on youtube.com. Stores a visitor identifier used to estimate audience size and track video interactions. Duration: 6 months.
• YSC — Third-party session cookie on youtube.com. Tracks YouTube video interactions within a session. Duration: session.
• PREF — Third-party persistent cookie on youtube.com. Stores preferences including video quality and playback speed. Duration: 2 years.
• GPS — Third-party session cookie on youtube.com. Mobile device location-based recommendation data. Duration: 30 minutes.

Privacy-enhanced embed (youtube-nocookie.com): No cookies set until user interaction.

Domains Contacted

• www.youtube.com / youtube-nocookie.com — Serves the player iframe and IFrame API.
• i.ytimg.com — Thumbnail and image CDN.
• yt3.ggpht.com — Channel artwork CDN.
• googlevideo.com — Video stream delivery via adaptive bitrate.
• doubleclick.net — Ad serving for monetized YouTube videos embedded on third-party sites.
• google.com / google-analytics.com — Google's analytics infrastructure triggered by the embed.

Data Collected Per Interaction

• Video ID watched and duration of watch time
• Play, pause, seek, and completion events
• Page URL where the video is embedded
• Browser user-agent, screen resolution, and network type
• IP address for geolocation
• Google Account identity when the visitor is signed into a Google service
• Ad impressions and ad interactions on monetized videos
• Search and recommendation interaction if the player's suggested video feature is enabled

Consent & Compliance

GDPR / ePrivacy: Standard YouTube embeds set third-party cookies and transmit data to Google's advertising infrastructure (DoubleClick). Multiple EU DPAs have ruled that standard YouTube embeds require prior consent under the ePrivacy Directive. The German Conference of Independent Data Protection Authorities (DSK) published guidance that YouTube embeds constitute third-party tracking. Using the youtube-nocookie.com domain for embeds mitigates the cookie issue but does not fully eliminate network requests to Google. For full compliance, load YouTube iframes only after consent, or use a facade/poster that activates the embed on user click.

CCPA / CPRA: Google/YouTube's data collection across third-party sites through the player constitutes sharing of personal information for advertising. Operators must disclose YouTube in their CCPA privacy notice.

EU-US Data Privacy Framework: Google is certified under the EU-US DPF. Standard Contractual Clauses are also available via Google's DPA.

Consent Category: Functional (for video playback) / Marketing (for advertising tracking via DoubleClick when embedded on third-party sites).

Should You Block This Without Consent?

Conditional. Use youtube-nocookie.com for all embeds to minimize tracking before user interaction. Standard youtube.com embeds must be blocked until consent is obtained due to the third-party cookies set on page load. Even with the nocookie domain, a best practice is to show a video facade (thumbnail image with play button) and only load the actual iframe when the user clicks play, eliminating any pre-consent network requests to Google.