Is Cookie Consent Required for Embedded Videos?
June 11, 2026
•
4 min read
Table of contents
back
to the top
Is Cookie Consent Required for Embedded Videos?
Embedded videos (YouTube, Vimeo, TikTok, etc.) are popular content elements, but they often come with hidden tracking layers. Even if you embed the video yourself, platforms may set cookies or collect data on playback.
This blog breaks down when cookie consent is required and how to embed videos while staying GDPR-compliant.
1. Why Embedded Videos Trigger Consent Rules
Most video embeds load content from a third-party domain.
For example:
- YouTube loads content from youtube.com
- Vimeo loads from vimeo.com
- TikTok loads from tiktok.com
These third-party domains may:
- Set cookies
- Track user interactions
- Share identifiers across sites
Even before the user plays the video.
This behavior qualifies as third-party tracking requiring consent.
2. Autoplay vs Click-to-Play
- Autoplay embeds load video and scripts immediately, often dropping cookies before user interaction.
- Click-to-play embeds delay loading until the user clicks the thumbnail.
GDPR strongly favors click-to-play embeds because they delay tracking until after consent.
If the user does not click play, no non-essential cookie should be set.
3. How GDPR Views Embedded Tracking
Under GDPR, data collection must be:
- Transparent
- Purpose-specific
- Consent-based for non-essential cookies
If embedded video services set tracking cookies before consent, your site is responsible for that behavior.
4. Best Practice: Use Privacy-Enhanced Embeds
Some platforms provide "privacy-enhanced" embed modes that:
- Don't store cookies until play
- Limit tracking
- Delay script loading
Examples include:
- YouTube's "nocookie" domain
- Vimeo's privacy settings
- Custom click-to-play components
These reduce pre-consent tracking risk.
5. How CMPs Control Video Tracking
A compliant CMP should:
- Block embedded video scripts until consent
- Allow click-to-play placeholder images
- Load the actual video only after opt-in
- Log user choices for audit readiness
This ensures viewers can see videos without unwanted tracking.
Final Takeaway
Embedded videos can trigger GDPR consent requirements because third-party scripts often set cookies on load. Using privacy-optimized embeds and delaying script activation until after consent keeps your site compliant and user-friendly.
Sources
Explore further
Klaviyo, Shopify and Consent: What E-Commerce Stores Need to Check
Shopify and Klaviyo can track and contact customers in ways they never agreed to. Learn how to align cookie, email and SMS consent across checkout, forms, flows and data sync.
October 1, 2026
7 min
HubSpot Tracking Code and Cookie Consent: Common Setup Mistakes
HubSpot tracking code is easy to install and easy to get wrong. Learn how to avoid the common consent mistakes, from the wrong banner type to untested rejection flows.
October 1, 2026
7 min
LinkedIn Insight Tag and GDPR: What B2B Teams Need to Know
The LinkedIn Insight Tag is advertising tracking, even on B2B sites. Learn how GDPR applies, when the tag can run, and how to handle retargeting, GTM and landing pages.
September 24, 2026
13 min