Is YouTube (no-cookie embed) GDPR compliant?

What does YouTube (no-cookie embed) do?

YouTube's privacy-enhanced embed. It sets no cookies until playback starts, which removes the storage question, though the request itself still reaches Google and should be named in your privacy policy.

Does YouTube (no-cookie embed) need consent?

No consent is needed for YouTube (no-cookie embed) on its own, because it does not store or read anything on the device beyond what is strictly necessary. That is not a free pass: it must still be named in your privacy policy, and the request itself still reveals the visitor's IP address to the provider.

GDPR Art. 13(1)(e)

Does YouTube (no-cookie embed) send data outside the EEA?

Yes. YouTube (no-cookie embed) processes data outside the European Economic Area, so you need a transfer mechanism under Chapter V and you have to say so in your privacy policy. In practice this means standard contractual clauses, or a provider certified under the EU-US Data Privacy Framework.

GDPR Art. 44 · GDPR Art. 46

How do we detect YouTube (no-cookie embed)?

We load your page in a real browser as a first-time visitor who clicks nothing, then look at what it contacted. YouTube (no-cookie embed) is recognised by requests to youtube-nocookie.com, and we report whether it merely loaded or actually sent data, and whether it set a cookie before any choice was made.