Do I need to disclose YouTube Embeds in my privacy policy?

Yes, YouTube Embeds must be disclosed in your privacy policy because it involves third-party data collection and processing by Google. Even when using the privacy-enhanced youtube-nocookie.com domain, disclosure is legally required under GDPR Article 13/14 and CCPA Section 1798.100. Failure to disclose constitutes a violation of transparency obligations.

What data does YouTube Embeds collect?

YouTube Embeds collects video viewing data (play, pause, seek actions), user IP addresses, and device identifiers. Standard YouTube embeds also set marketing and session cookies: YSC (session tracking) and VISITOR_INFO1_LIVE (6-month bandwidth estimation cookie). The youtube-nocookie.com version reduces cookie exposure but still collects IP addresses and basic viewing interactions.

Does YouTube Embeds require cookie consent?

Yes, standard YouTube Embeds requires explicit consent before loading because it sets non-essential cookies (YSC and VISITOR_INFO1_LIVE) for marketing and analytics purposes. The youtube-nocookie.com alternative minimizes cookies but still requires consent disclosure. GDPR and CCPA both mandate prior consent for non-essential tracking cookies.

Who processes my data from YouTube Embeds and where?

Google LLC, headquartered in the United States, is the data processor for YouTube Embeds. Data is transferred to and processed in the US under Google's standard contractual clauses (SCCs). Users should be informed that their data transfers internationally and that US privacy protections differ from European GDPR standards.

Media

Privacy policy clauses for YouTube Embeds

YouTube Embeds is Google's embedded video player that websites integrate to display YouTube videos directly on their pages. Websites use it to provide video content without redirecting users to YouTube, improving user experience and engagement while maintaining viewership analytics.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data YouTube Embeds collects

Your privacy policy must disclose each of the following data types when you use YouTube Embeds.

Video viewing data

IP address

Google cookies (unless using nocookie domain)

When does YouTube Embeds trigger privacy obligations?

Data Flow Trigger

YouTube Embeds immediately begins collecting data the moment a visitor loads a page containing the embed. Google LLC (a US entity) receives:

–Video viewing data: watch time, play/pause events, video ID
–IP address: for every request to youtube.com or youtube-nocookie.com
–Google cookies: YSC (session-based) and VISITOR_INFO1_LIVE (6-month persistence) unless you explicitly use the nocookie domain

This happens *before* any user consent is obtained.

Cookie	Duration	Category	Purpose
YSC	session	marketing	Video session
VISITOR_INFO1_LIVE	6 months	marketing	Bandwidth estimation

Privacy policy clauses for YouTube Embeds

What data YouTube Embeds collects

When does YouTube Embeds trigger privacy obligations?

Data Flow Trigger

Regulatory Triggers

First Concrete Step

Where data goes

Cookies set by YouTube Embeds

Common compliance pitfalls

Pitfall 1: Assuming youtube-nocookie.com Eliminates Privacy Obligations

Legal note

Sample privacy policy clause

What regulators look for

Enforcement Focus Areas

Frequently asked questions

Do I need to disclose YouTube Embeds in my privacy policy?

What data does YouTube Embeds collect?

Does YouTube Embeds require cookie consent?

Who processes my data from YouTube Embeds and where?

Don't ship without Bandit.