The YouTube Embed That Tracks Before Anyone Presses Play
Paste a video into a page and it looks fine. The banner is up, the video sits quietly in its frame, and nobody has pressed play. The reasonable assumption is that nothing has happened yet. It has. A standard YouTube embed contacts Google's servers as soon as the page loads and sets tracking cookies straight away, whether or not the visitor ever watches the video.
The Norwegian Data Protection Authority states this plainly: cookies are set by YouTube regardless of whether the videos are watched. The banner does not take care of it, because the embed fires before the banner's choice has any effect on it.
What the embed actually sets
A standard embed typically sets VISITOR_INFO1_LIVE, which lasts about six months, YSC for the session, GPS for about 30 minutes, and IDE on doubleclick.net, a 13-month ad cookie used for cross-site targeting and conversion attribution. YouTube also writes keys like yt-remote-device-id to local storage. The rules cover more than cookies: Article 5(3) of the ePrivacy Directive covers storing or reading anything on someone's device, which is why the local storage write needs consent too.
None of this waits for a click. The video starts talking to Google the second the page opens. A visitor who never presses play has still been tracked, and a visitor who declined marketing cookies has still had marketing cookies set. That is the gap a regulator finds in about thirty seconds with a clean browser.
Why youtube-nocookie does not fix it
The privacy-enhanced embed is the fix most teams reach for, and it is only half a fix. Swapping to youtube-nocookie.com reduces what is set on page load, but it does not remove the requirement. The domain still writes a device identifier to local storage without consent, and real cookies appear the moment someone presses play.
The honest summary from the guides that have tested it: nocookie plus consent is fine. Nocookie instead of consent is not. The German guidance quoted in the same coverage is blunt about it: without additional measures to obtain consent, embedding YouTube videos is not GDPR-compliant, and a click on Play does not constitute consent.
The two honest fixes
The first is a click-to-load facade: show a thumbnail with a play button, and load nothing from Google until the visitor accepts marketing cookies. The browser never requests anything from Google until consent exists, so there is nothing to disclose after the fact. This is the free option, and it is also the one that survives an audit.
The second is to stop embedding YouTube at all and host the video on a European service that sets no cookies. That costs money and loses YouTube's reach, which is why most sites pick the facade. Either way, the test is simple: load the page in a clean browser with marketing cookies declined, and confirm that no request goes to Google or doubleclick.net before the visitor chooses. If a request goes out, the embed is still live.
Keep reading: The AI Chatbot on Your Site: The Widget That Tracks Before It Asks, The Banner That Loads in the Footer: Consent After the Page Already Tracked, Cookie Banner Copy: The Sentence That Decides the Accept Rate cover the nearby cases in this series.
Frequently asked questions
Does an embedded YouTube video need cookie consent?
Yes. A standard embed sets tracking cookies on page load, before anyone presses play, and the Norwegian Data Protection Authority confirms cookies are set regardless of whether the video is watched. Non-essential cookies need consent before they are set.
Does youtube-nocookie make the embed compliant?
No, not on its own. It reduces what is set on page load, but it still writes a device identifier to local storage without consent, and cookies appear when someone presses play. Use it together with a consent gate, not instead of one.
What is a click-to-load facade?
A thumbnail with a play button that loads nothing from Google until the visitor accepts marketing cookies. The browser makes no request to YouTube or doubleclick.net before consent, which is what makes it compliant.
Can I just put the video behind the banner's accept button?
Only if the banner actually blocks the embed until the choice is made. Most banners do not block iframes by default, so the embed fires while the banner is still on screen. Test it in a clean browser with marketing cookies declined and watch the network tab.