3

I'm using Youtube embedded iframes on my website and am currently going through making the site GDPR compliant. From what I understand, Youtube iframes automatically store cookies when a user goes to the website.

I have changed this so the user must first agree to the cookies before storing a cookie on their computer. However, somewhere in my privacy policy I need to say what cookies are being stored and why.

Why does Youtube store a cookie? Is there a reason for this? I've searched their privacy service terms and no where can I find a statement about this that I can reference in my privacy policy.

Improve this question

2 Answers 2

Reset to default
1

Youtube stores a cookie through its iframe player for many reasons. Youtube is tracking which user is watching which video through your iframe to improve its own data collection. This helps youtube recommend better videos for that user. Yes, Youtube is tracking the user. But that is reasonable considering that they are displaying the content and want to improve their analytics. The cookie also probably helps youtube know what time to continue playing the video in the event of a page reload and can therefore help improve the user experience.

There's a good chance that you're not accountable for that cookie as it is being sent from a website that is not your own, through the iframe of another site. It's also unlikely for you would get sued by the government for simply embedding a youtube video which is a standard on the web. However, as I'm from the USA and not from Europe, I'm not entirely familiar with strict GDPR policy.

Improve this answer
1

Google has a site explaining which cookies are used how at https://policies.google.com/technologies/types.

TLDR: It uses cookies to save preferences (eg which quality has been selected and whether the user has enabled restricted mode), for security reasons and session state (logins, how far the user has watched the video), for ad purposes and for analytical purposes.

Note that the list on that page is incomplete as far as YouTube is concerned (for example, YouTube uses a PREF cookie to store preferences and doesn't use NID at all). I would ask Google about the rest of them, but their Data privacy officer contact information isn't available yet - at best, they have a coming soon page.

Also, note that YouTube offers a privacy-enhanced-embed via youtube-nocookie.com. What that does is not set any cookie at all, unless the user is actually watching the video

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.