The YouTube video plugin is not data protection friendly. It always uses cookies and analyzes the user in addition to that, without a video being played. Even with consent, it's not possible to use it lawfully, thanks to Google. Therefore, the same applies to this plugin as to all other Google plugins: whoever uses it exposes themselves to significant legal risks and doesn't really keep data protection.
Even when using the address youtube-nocookie.com, YouTube shamelessly sets a cookie (CONSENT). This cookie is completely unnecessary and therefore requires consent. Furthermore, the YouTube plugin sends a message to Google every few seconds, even if no video is being played or has been played.
Fun Fact (it would be funny if it wasn't so sad): According to Google's Data Protection Declaration and Terms of Service, the mentioned cookie is used to "store user cookie decisions". Funny enough, there is no consent query in the YouTube video plugin.
In addition, the YouTube plugin also loads Google Fonts. You have probably read or heard about the mass lawsuits against Google Fonts.
YouTube videos without the No-Cookie setting are an even worse idea, as I have already described in more detail. Read there why YouTube video plugins require consent. It's not just about cookies.
The YouTube plugin uses a cookie, although it does not want/should/needs one. This cookie is used for an opt-in request that does not exist.
Details: See article.
The ping message to Google alone is a reason for a consent requirement. Take a look at Article 6 Section 1 DSGVO. As a legal basis, apart from consent, only the legitimate interest remains. As the name suggests, your interest must be legitimate. You'd have to explain to me why it should be legitimate that Google gets my data without reason.
All these are reasons that speak in favor of either asking for permission for a YouTube video or only using a thumbnail which then links to the video platform.
By the way, I have not seen a single consent query for YouTube videos that seems to be legally compliant. See my checklist for consent queries. Even just the mandatory notice of revocation as well as the correct implementation of this revocation are often missing.
It's best not to use Google plugins at all, nor the YouTube video plugin.
Instead of that, the preview image mentioned earlier with a link to the video platform of your choice is offered. Vimeo is not better either. Therefore, I recommend that everyone who wants to embed a video on their website should embed the videofile locally.
Local means for very small videos that the video file can be located on almost any webspace. If your webspace only costs 99 cents per month, then your website apparently is so insignificant that I question the sense of a video.
For larger videos I recommend a fairly good webspace with a German provider. Fairly good means you pay 2.99 euros per month. I've tested this, together with a German provider and webspace supplier.
My video plugin works and is 100% data protection compliant. You are Master or Mistress of Your Data.
On my contribution, where I presented the video plugin, there were numerous feedbacks. I also asked for it, because as many people as possible should watch the video "simultaneously". Apparently everyone was satisfied after a few technical hiccups on my part had been cleared up.
I think that most videos embedded on websites do not add value. Before you think you need to clutter your website with all possible media and risk legal issues, it might not be so wrong to measure page views. In this context, I recommend Matomo for website statistics. Your advertising agency should also know how to count video playback attempts. If they don't, you should switch agencies or simply remove the video (you can still link to it).
If you use Google Analytics
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
