Yes, and it is one of the easiest things to get wrong. You paste a video into a page, it looks fine, and you assume the cookie banner takes care of the rest. It does not. The video starts talking to Google the second the page opens, before anyone has agreed to anything and before they have clicked play.
This post covers what actually happens, why the privacy-friendly YouTube URL does not solve it, and the two ways to fix it properly.
Does an embedded YouTube video set cookies before anyone clicks play?
Yes. A standard YouTube embed contacts Google's servers as soon as the page loads and sets tracking cookies straight away, whether or not the visitor ever watches the video. The Norwegian Data Protection Authority states this plainly: cookies are set by YouTube regardless of whether the videos are watched.
This catches people out because nothing looks wrong. The page loads, the video sits there, and the cookie banner appears on top of it. But the tracking already happened underneath.
Datatilsynet's guidance on tracking lists embedded content in an iframe as a clear example of something that needs handling before it loads, not after.
What cookies does a YouTube embed actually set?
A standard embed typically sets VISITOR_INFO1_LIVE, YSC, PREF and related identifiers. Some last for months. They tie the visit to a Google profile, which is why they count as tracking rather than something strictly necessary for the page to work.
There is also browser storage, which people forget about. YouTube writes keys like yt-remote-device-id to local storage. The rules do not only cover cookies. Article 5(3) of the ePrivacy Directive covers storing or reading anything on someone's device, which is why local storage needs consent too.
Does youtube-nocookie make the video GDPR compliant?
No. Swapping the embed to youtube-nocookie.com reduces what is set on page load, but it does not remove the requirement. The domain still writes a device identifier to local storage without consent, and real cookies appear the moment someone presses play.
It is a genuine improvement and worth using. It is just not the finish line. Analysis of the nocookie domain found storage written before any consent was given, and guidance on embedding YouTube under GDPR reaches the same conclusion.
If you take one thing from this post: nocookie plus consent is fine. Nocookie instead of consent is not.
The two ways to fix it
There are only two honest options, and one of them is free.
Option one: do not embed the video
Link to YouTube instead, or host the file yourself. No third party, no consent needed. This is genuinely the simplest answer for a single video on an about page, and it is underrated.
Option two: hold the video back until someone agrees
Keep the embed, but stop it loading until the visitor has accepted marketing cookies. The technical name is iframe blocking. The browser never requests anything from Google until consent exists, so there is nothing to disclose after the fact.
This is what a consent management platform (CMP) should be doing for you automatically. If yours makes you paste a special element in place of your video, that is a workaround, not a feature.
What does a blocked video look like to a visitor?
A small box where the video would be, saying which service is hidden and why, with a button that opens your cookie settings. The visitor accepts, the real video appears in the same spot. Nobody is left staring at an empty gap wondering if the page is broken.
The detail that matters is what the box says. "Content blocked" tells nobody anything. Naming the service, so the person can decide whether they trust YouTube specifically, is both more useful and easier to defend. With automatic embed blocking the box also picks up your banner's colours, so it looks like part of the site rather than an error.
How do you keep your cookie declaration honest?
Your cookie declaration has to list what your site actually uses. The hard part is not writing it once. It is keeping it right after someone adds a video to a page next spring and forgets to tell anyone.
Most tools solve this by crawling your website every month, which means your declaration is only as current as the last crawl. There is another way. Consentify notices the embed the first time a real visitor opens the page and adds it to the declaration, cookies and all, without ever crawling your site.
Worth knowing which way round the risk runs. Listing a service you no longer use is untidy and costs you a few consents. Using one you never listed means the consent you collected was not informed, and that is the part that fails an audit. Our guide to GDPR compliance goes deeper on that distinction.
What about maps, booking widgets and the rest?
YouTube is the one people notice, but it is not alone. Google Maps, Calendly, Vimeo, Spotify, an embedded Instagram post: all of them phone home on page load. If you have any of these, you have the same problem in a different shape.
One thing worth getting right is which consent category each one waits for. A map and a booking widget are functional, not marketing. Putting them behind marketing consent means a visitor who declines ads cannot find your office or book a meeting, and you have lost a customer to a checkbox.
Not sure what your site loads? A free GDPR scan lists every tracker and embed that fires before consent, in a few seconds, with nothing to install.
Setting it up
With Consentify there is nothing to configure for embeds. Add the script tag to your site:
<script src="https://consentify.app/api/gateway?token=YOUR_TOKEN"></script>
Then paste in YouTube's own embed code, exactly as YouTube gives it to you. No special elements, no snippets to copy out of a dashboard. The setup documentation covers the rest, including where the script tag has to sit for blocking to work.
Everything you configure through us goes further than blocking. Those trackers are never written into your page at all until consent exists, which is a stronger position than stopping code that is already there. We wrote about how gated consent works separately.
Why does the blocking have to happen before the page loads?
Because a browser fetches an iframe the instant it reads the tag. If your cookie tool waits until the page has finished loading, the request to Google already went out. Blocking has to intercept the element while the page is still being parsed, or it is not blocking, it is tidying up afterwards.
This is the part that separates tools that work from tools that look like they work. A banner can appear, log a refusal, and store the choice perfectly, while the video underneath it quietly loaded a second earlier. Nothing on screen tells you that happened. You have to open the network tab and look for the request.
Two practical consequences. Your consent script has to be synchronous and in the <head>, not added with async or dropped at the bottom of the body. And it should be the first thing on the page, ahead of anything else that might load third party content.
If you want to check your own site: open developer tools, go to the network tab, filter on youtube.com, and reload without accepting anything. An empty list is the result you want. Anything else means the video loaded before consent, whatever your banner says.
What happens if someone changes their mind?
Consent is not permanent, and withdrawal has to be as easy as agreeing. If a visitor accepts, watches a video, then later withdraws, the embed should go back behind its placeholder. Many setups get the first half right and forget the second.
It matters more than it sounds. Under GDPR a person can withdraw at any time, and the practical test is whether your site actually respects it or just stops asking. An embed that stays loaded after withdrawal is still setting cookies, and the consent record you are holding no longer matches what your site is doing.
A short checklist for your own site
Worth ten minutes if you have any embedded content:
- Reload a page with a video, refusing all cookies, and check the network tab for requests to
youtube.comorplayer.vimeo.com - Confirm your consent script sits in the
<head>withoutasync - Check that your cookie declaration lists every embedded service, not just your analytics
- Make sure maps and booking widgets are not stuck behind marketing consent
- Accept, then withdraw, and confirm the embed disappears again
Want to see what your site loads before anyone agrees? Try Consentify free, one domain, no watermark, no time limit.