Skip to content
Start free Sign in

iFrame blocking until consent

Embeds load after consent.

Turn on iFrame blocking and Kukie.io holds YouTube players, maps and social posts until the visitor accepts their category. A placeholder keeps their space and loads each one in place on a yes.

Start free (opens in a new tab) Scan your website
The same embedded video with and without iFrame blocking.

Why it matters

An embed loads before anyone presses play.

A visitor opens your about page and leaves after 20 seconds, never scrolling to the YouTube player. Their browser has already fetched it from Google, and it may already have stored cookies.

The play button has nothing to do with it: an embed starts working the moment the page renders it. YouTube's privacy-enhanced mode helps, but the frame is still served by a third party the visitor never chose to contact. The same is true of an embedded map, a social post and any other window onto someone else's site.

  • Without iFrame blocking

    The banner asks, the embed does not

    • The player, the map or the feed loads with everything else on the page, before the visitor has answered anything.
    • A visitor who then selects Reject all has already been reached by the third party. The banner records a refusal the page did not honour.
    • Anyone can see it: open the page, refuse everything and look at the stored cookies. It is one of the easiest gaps to check.
  • With iFrame blocking

    Embeds wait for a yes

    • Once the banner script is running, an embed added to the page is held before it loads, so no request reaches the provider. An embed written into your HTML can start loading before the script runs: give it data-cc-src and data-cc-category in place of src to hold it reliably.
    • The visitor sees a placeholder in the same space, saying what is held back and offering to load it in one click.
    • Accept and the content appears where the placeholder was. Refuse and the page never loads it, which is the answer the visitor gave.

To see what your own pages load, the Cookie scanner reports the cookies a public page sets and the Script audit lists the third parties it reaches.

What visitors see

A placeholder that explains itself.

A placeholder stands in for a blocked embed. It says what is missing, why, and how to load it, without contacting the service it stands in for.

It names the service
"YouTube", not "blocked content". A visitor who wanted to watch a video knows at once that it is still there and still available to them. A custom service shows the name you gave it.
It names the consent category
The placeholder states which consent category the embed waits for, in the banner's language, so the visitor makes a specific decision rather than answering a vague request.
It carries its own accept button
One click allows that category and no other. Manage preferences opens the full list for anyone who wants to see everything before deciding.
It keeps the layout still
The placeholder takes the size, classes and inline style of the embed it replaced and hands the space back when the embed returns, so the article around it does not jump.
It matches your banner
Its text is translated along with the rest of the banner, and it uses the banner's colour and font so it reads as part of your site. You can restyle it in Banner Editor, under Integrations.

How it works

Four steps, no change to your pages.

You keep writing embeds the way your editor or theme writes them. Kukie.io does 4 things with each one.

  1. Step 1: It recognises the embed

    Kukie.io reads the address each embedded frame points at and compares it with the services it knows, such as YouTube, Vimeo, Google Maps and social media embeds, plus any custom services you add.

  2. Step 2: It swaps in the placeholder

    The embed is replaced by a placeholder in the same place and at the same size. The settings the embed was written with are kept aside, which matters for step 4.

  3. Step 3: It keeps watching the page

    A slider, a tab, a lazy loader or a page-builder block can add an embed seconds after the page loads. Kukie.io watches for frames that appear later and treats them the same way.

  4. Step 4: It puts the embed back

    When the category is accepted, the original embed returns to the same place with the settings it started with, so it plays, scrolls and sizes as intended. No page reload, no lost scroll position.

iFrame blocking is a switch in Banner Editor, under Integrations, and it is off on a new site until you turn it on. It applies where your site asks for consent before setting cookies, which is the opt-in model, and you can narrow it to certain services in the same place. If you run other regions under different rules, see geo-targeting.

Coverage

What iFrame blocking covers.

An embed is a piece of another website placed in a window on yours. Invisible code that measures or advertises is a different job, handled by script blocking.

Built in

Services Kukie.io recognises

Select the ones to hold under iFrame Blocking. Each waits for a fixed category: Google Maps and reCAPTCHA for Functional, the rest for Marketing.

Waits for Functional

  • Google Maps
  • reCAPTCHA

Waits for Marketing

  • YouTube
  • Vimeo
  • Dailymotion
  • Facebook
  • Instagram
  • X (Twitter)
  • TikTok
  • LinkedIn
  • Spotify
  • HubSpot
Your own

Custom services

For a widget no built-in service covers, such as a booking form, add the domain its iFrame comes from in Banner Editor > Integrations > Custom services. Kukie.io holds it until the visitor allows that service, in the category you choose, whatever the iFrame Blocking switch says.

Add up to 10 iFrame domains to each service and 20 domains across the site, on every plan. Your last scan suggests iFrame domains that nothing blocks yet.

What each kind of third-party content on a page is, and which Kukie.io feature holds it back until consent
On your page What it is How Kukie.io handles it
A video player A window served by the video host, which can store identifiers as soon as it renders, played or not Replaced with a placeholder until the visitor accepts the category the service waits for
An embedded map A window served by the map provider, often repeated in a sitewide footer or contact block Replaced with a placeholder, so a map on every page is not a tracker on every page
A social post or feed A window served by the social network, which may recognise a visitor who is signed in to it Replaced with a placeholder naming the network, so the visitor knows who is being let in
A booking or other widget A window served by a service no built-in rule knows Held once you add its domain as a custom service
An analytics or advertising tag Invisible code with nothing on the page to show for it Held back by script blocking, which needs no placeholder because there is nothing to replace
Your own cookies First-party items such as the login session, the basket or the chosen language Generally needed for the site to work and left alone, but still listed in your cookie policy

Learn more about cookie scanning

Appearance

Styled to sit in your page.

The placeholder starts from your banner's colour and font. In Banner Editor, under Integrations, you can change how it looks without touching your theme.

  • Background, text and border colours, the border width and the corner radius
  • The minimum height, for an embed that has no size of its own
  • The colours of both buttons, on hover too, and their corner radius
  • Whether to show the icon, the service name and Manage preferences

Custom CSS for the placeholder is available on the Pro, Agency and Unlimited plans.

When it matters most

Where embeds do the most work.

Any site with one embedded video benefits. These are the cases where an embed does more than its owner realises.

  • The video is above the fold

    A product tour or a welcome video at the top of the homepage is the first thing the browser fetches, so it is the first third party your visitor meets. Blocking moves that meeting to after the decision.

  • There is a map in the footer

    Restaurants, clinics, studios and shops often put a map in a template that appears on every page. A map on one contact page is a small exposure. A map on every page is a tracker on every page.

  • Your pages are built from blocks

    Page builders, sliders, accordions and tabs often insert embeds after the page has loaded. A check that looks only at page load misses them, which is why Kukie.io keeps watching. It applies to most WordPress sites.

    Learn more about Kukie.io for WordPress

  • Somebody else added the embed

    A colleague pastes a social feed into a landing page and nobody tells whoever is responsible for privacy. With iFrame blocking on, recognised embeds wait for consent whether or not anyone set each one up.

Questions about iFrame blocking

Do embedded YouTube videos need cookie consent?
In the EU and the UK, almost always yes. A standard YouTube embed contacts Google and can store identifiers on the visitor's device as soon as the player appears, whether or not anyone presses play. You chose to place the embed on your page, so that storage happens under your responsibility and needs to wait for consent in the same way an analytics tag does.
Does the privacy-enhanced YouTube embed remove the need for consent?
No. It reduces the problem without removing it. YouTube's privacy-enhanced mode limits what the player stores before someone interacts with it, but the frame is still fetched from a Google server, so the visitor's browser still contacts a third party. Kukie.io treats a privacy-enhanced embed the same way as a standard one, so your choice of embed mode does not change what your visitors are exposed to.
What does a visitor see in place of a blocked embed?
A placeholder in the space the embed would have taken. It names the service, states which consent category that service belongs to in the banner's language, and carries a button that accepts that category and no other, plus Manage preferences, which opens the full list of choices. The placeholder itself loads nothing from the embed provider.
Will blocking embeds break my page layout?
It should not. The placeholder takes the size, classes and inline style of the embed it replaced, so it fills the same space instead of collapsing it, and the embed takes that space back when the visitor accepts. The content around the embed stays where it was in both directions.
Does the page have to reload after the visitor accepts?
No. The embed loads in place as soon as consent is given, with the attributes it was originally written with, so a visitor who accepts to watch a video sees the player appear where the placeholder was without losing their place on the page.
What is the difference between blocking embeds and blocking scripts?
An embed is visible content from another site, such as a video player or a map, so blocking it leaves a space the visitor can see and act on. A script is invisible, such as an analytics or advertising tag, so blocking it means nothing runs. Both have to wait for consent, but only embeds need something for the visitor to look at in the meantime.

Hold embeds until visitors choose.

iFrame blocking and custom services come with every plan, including Free. Turn it on in Banner Editor and recognised embeds wait for a yes.

Start free (opens in a new tab) See pricing

Related features

Embeds are one part of what waits for consent. These pages cover the scripts, the banner that asks and what it all costs in page speed.

See all features

More on embeds and third-party content

Background on the services most often embedded in a page, and what they store.

See all articles

Disclaimer

Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.

Listed on

Kukie.io on Trustpilot (opens in a new tab) Kukie.io on G2 (opens in a new tab) Kukie.io on SaaSHub (opens in a new tab) Kukie.io on AlternativeTo (opens in a new tab)