{"id":1259,"date":"2026-08-05T15:39:07","date_gmt":"2026-08-05T13:39:07","guid":{"rendered":"https:\/\/www.sabatka.net\/cs\/?p=1259"},"modified":"2026-08-05T16:18:12","modified_gmt":"2026-08-05T14:18:12","slug":"youtube-nocookie-gdpr","status":"publish","type":"post","link":"https:\/\/www.sabatka.net\/en\/youtube-nocookie-gdpr\/","title":{"rendered":"youtube-nocookie GDPR compliance: why it falls short (and what to do instead)"},"content":{"rendered":"<\/p>\n\n\n

Embedding a YouTube video on your site? Then you’re dealing with GDPR, whether you’ve thought about it or not. And if you already “solved” this by switching the embed to the youtube-nocookie.com<\/a> domain, here’s the uncomfortable part: that alone doesn’t get you full youtube-nocookie GDPR compliance. It’s a step in the right direction. It’s not the finish line.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
Contact me<\/a><\/div>\n\n\n\n
Share on LinkedIN<\/a><\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

A few months back I wrote about a court in Hannover ruling that Google Tag Manager without consent violates GDPR<\/a> \u2014 simply because GTM itself can load third-party code. A YouTube embed is the same story wearing a different costume: a foreign domain, a foreign script, a foreign server that gets your visitor’s IP address before they click on anything. This article picks up where that one left off \u2014 same plot, different lead actor.<\/p>\n\n\n\n

<\/div>\n\n\n\n

A few months back I wrote about a court in Hannover ruling that Google Tag Manager without consent violates GDPR<\/a> \u2014 simply because GTM itself can load third-party code. A YouTube embed is the same story wearing a different costume: a foreign domain, a foreign script, a foreign server that gets your visitor’s IP address before they click on anything. This article picks up where that one left off \u2014 same plot, different lead actor.<\/p>\n\n\n\n

<\/div>\n\n\n\n

youtube-nocookie GDPR compliance: what Google promises and what it leaves out<\/h2>\n\n\n\n

The apparent fix has an official name \u2014 Google calls it Privacy Enhanced Mode. It promises exactly two things:<\/p>\n\n\n\n

    \n
  1. Watching a video through the nocookie domain won’t feed into personalization of the viewer’s YouTube experience.<\/li>\n\n\n\n
  2. Any ads shown alongside the video won’t be personalized either.<\/li>\n<\/ol>\n\n\n\n

    That’s the entire official promise<\/a>.<\/p>\n\n\n\n

    Notice what’s missing. Google never says that nothing gets stored about the view. It never says no data is transmitted at all. It promises non-personalization \u2014 not anonymity.<\/p>\n\n\n\n

    Reality sits exactly in between those two claims:<\/p>\n\n\n\n