Embed videos that wait for a click.

What an embed loads

YouTube’s embed code is an iframe that points to youtube.com. The browser fetches it as soon as the page loads, with the player’s scripts, styles and images, before anyone presses play. Every request carries the visitor’s IP address, and YouTube requires the embedding page to send the site’s address along as the referrer.

What the player stores on the device after that is up to Google. The cookie rule in the ePrivacy Directive covers storing information on a visitor’s device and reading it from there, with cookies or any other technique. It needs consent unless the storage is strictly necessary for a service the visitor explicitly asked for, and a video nobody has pressed play on is hard to call explicitly requested.

Vimeo and Google Maps embeds work the same way: an iframe from another company that loads with the page.

What privacy-enhanced mode does

You turn on privacy-enhanced mode by changing the domain. YouTube’s help page says to change www.youtube.com in the embed address to www.youtube-nocookie.com. The rest of the embed code stays the same.

Google describes the mode in terms of personalisation. A view in privacy-enhanced mode “will not be used to personalize the YouTube browsing experience”, in your embed or later on YouTube. Ads on the video are non-personalised, and the view isn’t used to personalise ads the visitor sees outside your site.

The same page notes that if a viewer clicks out of the embed to another site or app, that site or app may track them under its own policies.

Why the domain alone may not be enough

Google’s help page doesn’t say the player stores nothing on the device, and the name of a domain is no promise. The player still loads from Google’s servers the moment the page does, so the visitor’s IP address and the address of your site reach Google before anyone has chosen anything.

That’s the question a Munich court looked at for Google Fonts in 2022: a visitor’s IP address sent to Google without their consent.

Vimeo has a similar switch. Add dnt=1 to the player address and, according to Vimeo’s help page, the player stops collecting session data and analytics. The same page says some essential cookies stay active.

A privacy mode reduces what happens after a view. To keep the page from contacting Google or Vimeo on load, the player has to wait for a click.

Load the player on a click

A click-to-load placeholder takes the embed’s place. It shows a still image served from your own site, a play button and one line that says which company the video comes from. Nothing loads from YouTube until someone clicks. Then a few lines of script swap the placeholder for the iframe.

Load the iframe from youtube-nocookie.com and add autoplay=1, so one click usually starts the video. YouTube’s help page notes that autoplayed embeds don’t count as views, so leave autoplay off if your view count matters.

Leave the referrer alone. YouTube asks embedders to send it and recommends the strict-origin-when-cross-origin policy, which many browsers use by default. Without a referrer, playback is blocked with an error.

Make the placeholder a real button with a clear name, so it works with a keyboard and a screen reader.

Vimeo and Google Maps

The same placeholder works for Vimeo. Load the player from player.vimeo.com on the click, add dnt=1 if you don’t need Vimeo’s statistics, and name Vimeo in the line on the placeholder.

For a map, the address as text with a link that opens Google Maps is often all a contact page needs. If you want the interactive map on the page, put it behind a placeholder too, with a line saying it loads from Google.

On a site with a cookie banner, link the two: a setting for videos and maps in the banner saves people who want them from clicking every placeholder. Gatelamp’s click-to-load covers YouTube, Vimeo and Google Maps with a placeholder in your site’s style. YouTube loads from youtube-nocookie.com only after the click, and someone who accepts video once doesn’t have to click every placeholder again.

Whether a click on a placeholder counts as consent for what the player does next is a legal question, and this guide is general information, not legal advice. What a placeholder does settle is that nothing loads from another company before a visitor asks.

Check that the page stays quiet

Open the page in a private window with the Network tab open, reload, and filter on youtube, vimeo and google. Before the click there should be no requests to them and no iframe on the page.

Look at storage too. In Chrome, the Application tab lists cookies per site, and before the click there should be none from YouTube, Google or Vimeo. After the click the player loads, and what it stores is up to the company behind it.