Video embed privacy

Video embeds set cookies as soon as they load, before anyone presses play. Blocking them until consent works, but it leaves a hole where the video should be. Rewriting the embed URL is the other option: the video still plays, and the vendor collects less.

This isn't a consent bridge. Nothing is sent to the vendor. The embed URL is changed before the browser requests it.

What each rewrite does

Only the exact hosts are matched. YouTube covers www.youtube.com, youtube.com and m.youtube.com, and only on /embed/ paths. Vimeo matches player.vimeo.com. Wistia matches fast.wistia.net and fast.wistia.com.

The rewrites are idempotent. An embed you already wrote as youtube-nocookie or already carrying dnt=1 is left alone, so hand-tuned markup doesn't get double-processed. Protocol-relative URLs keep their form.

Consent category. None, and this is the point of the feature. The rewrite applies to every visitor regardless of what they chose, because it's a reduction in what the vendor collects rather than a consent decision. If you'd rather block embeds entirely until consent, that's blocking instead, and the two can be combined.

Setup

Off by default, per vendor, in the banner theme's customFeatures:

{
  "embedPrivacy": {
    "youtube": true,
    "vimeo": true,
    "wistia": true
  }
}

There's no dashboard control yet, so this needs a theme update through the API.

Enabling a vendor here adds its host to the published boot manifest. A vendor you leave off isn't in the manifest, and nothing is rewritten for it.

How it works at runtime

Two paths cover the two ways an embed reaches the page. Embeds present in the initial HTML are rewritten when the blocking engine revives them. Embeds inserted later go through the same rewrite when their src is set.

Both use the same rules, and the rules are shared with a server-side implementation used when the page is rendered ahead of time, so an embed doesn't get different treatment depending on how it arrived.

Testing

Look at the network tab and confirm the request host. For YouTube it should be www.youtube-nocookie.com, not www.youtube.com. For Vimeo and Wistia, check the query string on the player request for dnt=1 and doNotTrack=true.

Then check cookies. A privacy-enhanced YouTube embed shouldn't set anything on youtube.com until the visitor presses play.