youtube-nocookie.com is the domain of YouTube's privacy-enhanced embed mode: swap it for youtube.com in the embed address and the player stops setting cookies when the page loads. It does not stop the player writing to the browser's local storage or contacting Google, so in the EU and the UK a YouTube no cookie embed still needs consent before it loads. A placeholder that holds the player until the visitor accepts is the only version that sends nothing to Google first.
What happens when you embed a YouTube video
A standard YouTube iframe loads resources from youtube.com the moment a visitor opens your page. Before anyone presses play, Google sets several cookies, including VISITOR_INFO1_LIVE and YSC, and receives the visitor's IP address and browser details with every request.
As of October 2026, the list is longer than most cookie policies say. A standard embed loaded in a headless Chromium browser on 16 October 2026 set 5 cookies on .youtube.com before anyone pressed play: VISITOR_INFO1_LIVE, YSC, __Secure-YNID, __Secure-ROLLOUT_TOKEN and VISITOR_PRIVACY_METADATA. Google's own cookie list now describes __Secure-YNID as the replacement for VISITOR_INFO1_LIVE, so expect to see both for a while.
Under the ePrivacy Directive, Article 5(3) requires consent before storing or accessing information on a user's device. That obligation covers HTTP cookies, local storage, session storage, and IndexedDB alike. A YouTube embed that fires on page load without prior consent breaches this rule in every EU and EEA member state.
YouTube is embedded on millions of websites. Each unguarded embed creates a compliance gap that data protection authorities have shown increasing willingness to pursue.
How privacy-enhanced mode (YouTube no cookie) works
YouTube offers a feature called privacy-enhanced mode. Turning it on changes the embed domain from youtube.com to youtube-nocookie.com. Google's help page on privacy-enhanced mode describes it in terms of personalisation, not storage:
Privacy Enhanced Mode prevents the use of views of embedded YouTube content from influencing the viewer's browsing experience on YouTube.
The same page says ads in the embed are non-personalised and that views do not personalise ads outside your site. It does not promise that the player stores nothing on the visitor's device.
To enable it, click Share on any YouTube video, select Embed, and tick the checkbox labelled "Enable privacy-enhanced mode." The generated iframe code will use https://www.youtube-nocookie.com/embed/VIDEO_ID instead of the standard domain. You can also swap the domain manually in existing embed code.
What privacy-enhanced mode actually does
The mode prevents HTTP cookies from being set on initial page load. That is a genuine improvement over the standard embed.
It does not, however, prevent YouTube from writing to local storage. In the same 16 October 2026 test, the youtube-nocookie.com player set no cookies at all, but wrote ytidb::LAST_RESULT_ENTRY_KEY and yt-icons-last-purged to local storage under its own origin as soon as the frame loaded. Local storage persists across sessions, and writing to it is storage on the visitor's device in exactly the sense Article 5(3) means.
Once a visitor presses play, the video streams from Google's servers, so the request and the visitor's IP address reach Google whichever domain the embed uses.
Why privacy-enhanced mode still needs consent
Article 5(3) of the ePrivacy Directive does not distinguish between cookies and other storage mechanisms. The European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3), adopted on 7 October 2024, name cookies, local storage and WebSQL side by side. Because privacy-enhanced mode writes to local storage on page load, it still falls short of GDPR consent requirements.
The CNIL has been particularly clear on this point. Its guidance treats any technology that reads from or writes to a user's terminal equipment as subject to consent obligations, with narrow exceptions for strictly necessary operations. A YouTube embed does not qualify as strictly necessary for the functioning of a website.
| Behaviour | Standard embed | Privacy-enhanced mode | Placeholder with consent |
|---|---|---|---|
| Cookies on page load | Yes | No | No |
| Local storage on page load | Yes | Yes | No |
| Data sent to Google on load | Yes | Yes | No |
| Requests to Google on play | Yes | Yes | Yes (after consent) |
| Requires cookie consent | Yes | Yes | Consent built in |
| Loads anything before consent | Yes | Yes | No |
When each embed reaches Google
The placeholder approach: block first, load after consent
The safest method is the two-click solution, sometimes called the placeholder approach. Instead of loading an iframe immediately, you display a static preview image of the video with an overlay explaining that clicking will load content from YouTube and set cookies.
Only after the visitor clicks does the iframe load. No data reaches Google until the visitor has given informed permission.
How to implement a placeholder
The basic pattern uses a data-src attribute instead of src on the iframe. A small script listens for the consent event from your cookie banner or from a click on the placeholder, then copies data-src to src, which triggers the iframe to load.
Here is a simplified HTML structure:
<div class="youtube-placeholder" data-video="VIDEO_ID"><img src="/images/yt-placeholder-VIDEO_ID.jpg" alt="Video thumbnail"><button>Load video (sets YouTube cookies)</button></div>
The thumbnail image should be hosted locally rather than fetched from YouTube's image servers, since requesting img.youtube.com also transmits visitor data to Google before consent. Cache the thumbnail on your own server or CDN during development.
Integrating with your cookie banner
If your site already uses a consent management platform, tie YouTube loading to the marketing or media cookie category. When a visitor accepts that category, the CMP fires a callback that activates all blocked iframes.
Kukie.io does this without a script of your own: with iFrame blocking turned on, it recognises YouTube embeds on both youtube.com and youtube-nocookie.com, shows a placeholder that names the service and its consent category, and loads the player in place once the visitor accepts. The GTM blocking approach works similarly if your embeds are managed through Google Tag Manager.
What about other video platforms?
YouTube is the most common embed, but Vimeo, Dailymotion, and other platforms raise the same questions. Vimeo offers a dnt=1 parameter that reduces tracking, though it does not eliminate all data transfers. The same placeholder logic applies to any third-party embed that sets cookies or accesses device storage.
Social media embeds from X (formerly Twitter), Instagram, and Facebook carry similar risks. Each loads third-party resources and sets tracking cookies. The principle remains consistent: block the embed, show a placeholder, and load only after consent.
Common mistakes with YouTube embeds and consent
Assuming privacy-enhanced mode is sufficient is the most frequent error. Switching to youtube-nocookie.com without additional blocking leaves local storage writes unaddressed.
Loading thumbnails directly from img.youtube.com is another oversight. Even a thumbnail request sends the visitor's IP address and user agent to Google, which constitutes personal data processing under the GDPR.
Some sites block the iframe but forget to block other YouTube-related scripts loaded through Google Tag Manager or embedded in page templates. A thorough audit with a cookie scanner will reveal any scripts that slip through.
Failing to update the cookie policy is a subtler problem. If your cookie policy does not mention YouTube cookies by name (VISITOR_INFO1_LIVE, __Secure-YNID, YSC), it lacks the specificity that regulators expect.
Regulatory enforcement and YouTube cookies
The CNIL has been active in enforcing cookie consent rules, with fines against organisations that loaded tracking technologies without prior consent. Its cookie guidelines explicitly cover scenarios where third-party content sets cookies or equivalent trackers.
German data protection authorities hold the same position. Under the DSGVO and section 25 of the TDDDG (the Telecommunications Digital Services Data Protection Act, formerly the TTDSG), storing or reading information on a visitor's device needs consent unless it is strictly necessary for a service the visitor asked for. A YouTube embed that loads before any choice does not meet that exception.
For sites serving UK visitors, the ICO's guidance under the UK GDPR and PECR applies the same logic: storage of information on a user's device requires consent unless strictly necessary for the requested service.
Quick answers on YouTube embeds and consent
Does youtube-nocookie.com set cookies?
In a test on 16 October 2026 it set no cookies on page load, but it wrote identifiers to local storage as soon as the frame loaded. Once a visitor presses play, the video streams from Google's servers. Both local storage and cookies require prior consent under the ePrivacy Directive.
Does privacy-enhanced mode remove the need for consent?
No. Privacy-enhanced mode reduces cookie exposure on page load but still writes to local storage and sends data to Google. Article 5(3) of the ePrivacy Directive asks for consent before that storage, so the iframe has to wait until the visitor grants it.
How do I embed YouTube videos without cookies?
Use a placeholder approach: display a locally hosted thumbnail image with a consent notice. Only load the YouTube iframe after the visitor clicks to accept. This prevents any data transfer to Google before consent is given.
Do I need consent for YouTube thumbnails loaded from img.youtube.com?
Yes. Requesting a thumbnail from YouTube's servers sends the visitor's IP address and user agent to Google, which constitutes personal data processing. Host thumbnails locally to avoid this.
Can I use Google Tag Manager to block YouTube embeds?
Only for embeds that Google Tag Manager inserts itself. An iframe written into your page HTML loads before any tag fires, so it needs a placeholder script or a consent tool that holds iframes until the visitor accepts the relevant cookie category.
What YouTube cookies should I list in my cookie policy?
List the cookies your own scan finds. Google's cookie list currently names VISITOR_INFO1_LIVE and its replacement __Secure-YNID, YSC, PREF and __Secure-ROLLOUT_TOKEN among YouTube's cookies. Also disclose local storage keys such as ytidb::LAST_RESULT_ENTRY_KEY under the youtube-nocookie.com domain.
Hold YouTube players until visitors choose
Turn on iFrame blocking and Kukie.io replaces each YouTube player with a placeholder until the visitor accepts its category, then keeps a record of every choice in the Consent Log.
