A standard YouTube embed can set tracking cookies in a visitor’s browser before they have made any choice about it, which is a problem for GDPR-conscious websites. Here is exactly how to embed YouTube videos while keeping that footprint as small as possible.

Why a normal embed sets cookies

When you embed a video from the standard youtube.com domain, the iframe loads Google’s player code from Google’s own servers. As part of that, Google can set cookies used for things like advertising personalisation and usage measurement, and it can do so as soon as the iframe loads, not only once someone presses play. Under the GDPR and similar regulations, setting non-essential cookies generally requires the visitor’s prior consent, which puts a plain embed in a grey area on many sites.

Step 1: switch to the privacy-enhanced domain

YouTube provides a dedicated domain, youtube-nocookie.com, built exactly for this situation. Embeds from this domain behave identically to normal ones, but cookie-setting is deferred until a visitor actually interacts with the player rather than happening on page load. Switching is as simple as changing the domain in your embed URL:

<!-- Standard -->
https://youtube.com/watch?v=VIDEO_ID

<!-- Privacy-enhanced -->
https://www.youtube-nocookie.com/embed/VIDEO_ID

This single change is the highest-impact, lowest-effort step most sites can take, and it is why it is switched on by default in our embed code generator.

Autoplaying a video means it starts interacting with YouTube’s player before the visitor has done anything at all, which undercuts the point of deferring cookies. Leave autoplay off on embeds that load automatically with the page, and only enable it, ideally muted, on embeds a visitor has deliberately chosen to view (for example a lightbox opened by clicking a thumbnail).

Step 3: consider a click-to-load pattern for maximum control

For sites with strict cookie policies, the most thorough approach is to not load the real iframe at all until a visitor opts in. In practice this means showing a static thumbnail image (pulled from YouTube’s public thumbnail URLs, which do not require an iframe or cookies) with a play button overlay, and only inserting the actual embed once that overlay is clicked. This guarantees zero YouTube requests happen until the visitor has explicitly asked for the video.

Using the privacy-enhanced domain reduces cookie-setting; it does not eliminate every possible data point YouTube’s player might collect once someone actually watches. If your audience includes EU visitors, keep a clear, accessible cookie or privacy notice that explains embedded third-party video is present on the site, consistent with your overall privacy policy.

What the privacy-enhanced mode does not change

It is worth being precise about what switching domains does and does not do. It does not stop YouTube from ever knowing a video was viewed once playback starts, that is inherent to using YouTube’s player at all, and it does not replace a proper cookie consent banner if your site otherwise relies on one. What it does reliably do is remove cookie-setting from the passive page-load moment, which is the part most commonly flagged in privacy audits.

A common misconception

Some site owners assume that removing YouTube embeds entirely, and only linking out to videos instead, is the only fully compliant option. That is one valid approach, but it also removes the benefit of visitors watching directly on your page. For most sites, privacy-enhanced mode plus a sensible consent notice strikes a workable balance between compliance and a good on-site video experience.

Putting it together

A privacy-conscious embed, in short: use the youtube-nocookie.com domain, skip autoplay on embeds that load automatically, consider click-to-load for maximum control, and keep your cookie notice accurate. All of the technical parts (privacy-enhanced domain, autoplay off by default, responsive sizing, lazy-loading) are built into our free embed code generator, so getting a privacy-friendly embed does not require writing any of this by hand.

See the full iframe parameters reference for every playback option, and our complete YouTube embed guide for the broader picture on responsive sizing and performance.