YouTube Privacy-Enhanced Mode: What It Blocks and What It Does Not

Privacy-enhanced mode is an official YouTube feature, enabled by ticking a box when you copy the embed code. The embed URL changes from youtube.com to youtube-nocookie.com, and Google documents two benefits: views from privacy-enhanced embeds do not personalise the viewer's YouTube experience, and the ads served are non-personalised rather than targeted. The HTTP cookie that a standard embed sets on page load is not set, and that much of the promise is real.

The promise is narrow, and the narrowness is the whole story. Privacy-enhanced mode changes what the player stores as a cookie on load. It does not change what the player stores elsewhere, what it contacts, or what it does when the visitor presses play. A site that ticks the box and calls the embed compliant has mistaken a cookie setting for consent.

The promise is real but narrow

The nocookie player writes a device identifier, yt-remote-device-id, to the browser's localStorage, and it does so without consent and without the visitor clicking anything. In testing, the player also initialised IndexedDB storage and sent a logging request to Google before Play. LocalStorage has no expiry date: the identifier persists after the browser closes, and it is available the next day, the next week, and the next year.

GDPR is not only about cookies. Article 5(3) of the ePrivacy Directive covers storing or accessing information on a visitor's device, and localStorage is storage. A player that stores an identifier in localStorage before consent is doing the thing the cookie law forbids, under a different name. The cookie is gone. The tracking is not.

LocalStorage is the part nobody mentions

The moment the visitor presses play, a YouTube cookie is set, whether or not consent was given. Privacy-enhanced mode delays the cookie until Play, and then it sets it anyway. A visitor who watches a video on your site has a YouTube cookie on their device, and the consent banner never had a say in it.

The delay is the trap. It makes the embed look clean in a cookie audit, because the audit loads the page and checks for cookies, and there are none. The audit does not press play, and the visitor does. A compliance check that never presses play is a check that never sees the cookie, and the cookie is the point.

Play sets the cookie anyway

The honest fix is a click-to-load facade: a thumbnail image of the video, with a play button, that loads the real player only after the visitor clicks. The click is the consent moment, and the player loads only after it. The visitor still watches the video, and the cookies and the localStorage identifier wait for the click that authorises them.

Keep reading: Pre-Ticked Boxes Are Not Consent: Planet49 Said So in 2019, Global Privacy Control: Does Your Site Actually Honour the Signal?.

The facade is the honest fix

Wire the facade to the consent categories as well, so a visitor who already accepted marketing cookies sees the player load immediately, and a visitor who rejected them sees the thumbnail until they choose. Test it with DevTools open: load the page, confirm no YouTube storage appears, press play, and watch it appear. That is the test, and it takes two minutes.

Frequently asked questions

Does YouTube privacy-enhanced mode stop tracking?

No, not fully. It stops the HTTP cookie on load, but the player still stores an identifier in localStorage and contacts Google before Play.

What is youtube-nocookie.com?

YouTube's official embed domain for privacy-enhanced mode. It serves the player without setting a cookie on load, until the visitor presses play.

Does pressing play on a nocookie embed set a cookie?

Yes. A YouTube cookie is set when the visitor presses play, whether or not consent was given.

What should I use instead of a YouTube embed?

A click-to-load facade: a thumbnail that loads the player only after the visitor clicks and consents.