Consent for WooCommerce Product Videos: The Embed That Phones Home on the Product Page

A shopper lands on a product page, and a video sits in the gallery, ready to play. They have not clicked it, they have not consented to anything, and the video has already phoned home. The embed loaded when the page loaded, and the request went to YouTube, with the shopper's IP address, before the shopper made any choice. The video is the consent leak, and it is on every product page that embeds one.

A standard YouTube embed loads the player when the page loads, and the player makes a request to YouTube, which sets cookies and collects data. Privacy-enhanced mode, the youtube-nocookie.com domain, changes that: the embed does not set cookies until the user plays the video, and it does not send data to YouTube before the click. It is not a complete block, because the request still goes to YouTube when the video loads, but it is a significant reduction, and it is the minimum for a product page that embeds video.

The embed phones home on load

The problem is the load, not the play. A shopper who never clicks play has still been tracked, because the embed loaded, and the load is the data collection. The consent banner should gate the embed, not the play button, which means the video should not load until the shopper consents to marketing or media cookies. A facade, a thumbnail image with a play button that loads the embed only when clicked, is the pattern that works, because the thumbnail is an image, not a request to YouTube, and the embed loads only after the click.

WordPress makes this harder, because the block editor will embed a YouTube video from a URL automatically, and the embed it creates is the standard one, not the privacy-enhanced one. The site owner has to change the embed to the nocookie domain, or use a plugin that does it, and then gate the embed behind consent. The WooCommerce product video, which is often added through a plugin or a custom field, is the same problem in a different place, and it needs the same fix.

What to do, in order

First, switch every YouTube embed to the privacy-enhanced domain, youtube-nocookie.com, so the embed does not set cookies before the click. Second, put a facade in front of the embed, a thumbnail with a play button, so the embed does not load at all until the shopper clicks. Third, gate the facade behind consent, so the video does not load until the shopper consents to media cookies. Fourth, test the product page with a fresh browser, and confirm that no request goes to YouTube before consent.

The WooCommerce checkout is a separate surface, and it has its own consent problem: pixels that fire at the checkout, payment data that is shared, and order bumps that load third-party scripts. The product video is the one on the product page, and it is the one most site owners never notice, because the video is content, not tracking, and content does not feel like a consent problem. It is, because the embed is a request, and the request is data collection.

The test

Open a product page with a fresh browser, and look at the network requests before you click anything. If a request goes to YouTube, the embed is leaking, and the fix is the facade and the nocookie domain. If no request goes to YouTube until you click play, the embed is gated, and the product page is compliant. The test takes two minutes, and it is the only test that matters, because a consent banner that covers the video is not a consent mechanism for the video, and a video that loads before consent is a leak.

The video is content, and the embed is a request. Gate the request, and the content can stay.

Keep reading: YouTube Privacy-Enhanced Mode: What It Blocks and What It Does Not, Consent at the WooCommerce Checkout: Pixels, Payment, and the Order Bump Problem, Embedded social feeds and consent: the timeline that phones home before the click.

Frequently asked questions

Does a YouTube embed track visitors before they click play?

Yes, with a standard embed. The player loads when the page loads and makes a request to YouTube, setting cookies and collecting data before the shopper makes any choice.

What is YouTube privacy-enhanced mode?

The youtube-nocookie.com domain. The embed does not set cookies until the user plays the video. It is not a complete block, but it is a significant reduction and the minimum for a product page.

What is a video facade, and why does it help consent?

A thumbnail image with a play button that loads the embed only when clicked. The thumbnail is an image, not a request to YouTube, so no data is sent until the shopper clicks.

How do I test whether a product video leaks data?

Open the product page with a fresh browser and look at the network requests before clicking anything. If a request goes to YouTube, the embed is leaking.