Is Cookie Consent Required for Embedded Videos?

Embedded videos (YouTube, Vimeo, TikTok, etc.) are popular content elements, but they often come with hidden tracking layers. Even if you embed the video yourself, platforms may set cookies or collect data on playback.

This blog breaks down when cookie consent is required and how to embed videos while staying GDPR-compliant.

---

1. Why Embedded Videos Trigger Consent Rules

Most video embeds load content from a third-party domain.

For example:

• YouTube loads content from youtube.com
• Vimeo loads from vimeo.com
• TikTok loads from tiktok.com

These third-party domains may:

• Set cookies
• Track user interactions
• Share identifiers across sites

Even before the user plays the video.

This behavior qualifies as third-party tracking requiring consent.

---

2. Autoplay vs Click-to-Play

• Autoplay embeds load video and scripts immediately, often dropping cookies before user interaction.
• Click-to-play embeds delay loading until the user clicks the thumbnail.

GDPR strongly favors click-to-play embeds because they delay tracking until after consent.

If the user does not click play, no non-essential cookie should be set.

---

3. How GDPR Views Embedded Tracking

Under GDPR, data collection must be:

• Transparent
• Purpose-specific
• Consent-based for non-essential cookies

If embedded video services set tracking cookies before consent, your site is responsible for that behavior.

---

4. Best Practice: Use Privacy-Enhanced Embeds

Some platforms provide "privacy-enhanced" embed modes that:

• Don't store cookies until play
• Limit tracking
• Delay script loading

Examples include:

• YouTube's "nocookie" domain
• Vimeo's privacy settings
• Custom click-to-play components

These reduce pre-consent tracking risk.

---

5. How CMPs Control Video Tracking

A compliant CMP should:

• Block embedded video scripts until consent
• Allow click-to-play placeholder images
• Load the actual video only after opt-in
• Log user choices for audit readiness

This ensures viewers can see videos without unwanted tracking.

---

Final Takeaway

Embedded videos can trigger GDPR consent requirements because third-party scripts often set cookies on load. Using privacy-optimized embeds and delaying script activation until after consent keeps your site compliant and user-friendly.

---

Sources

• GDPR Article 4 - Definitions
• GDPR Article 7 - Conditions for Consent
• EDPB Guidelines 05/2020 on Consent
• CNIL Guidance on Cookies and Tracking
• ICO Guidance on Cookies and Similar Technologies