---
title: "Video embed privacy"
description: "Rewrite YouTube, Vimeo and Wistia embeds to their privacy-preserving forms."
url: "https://cookiebeam.com/docs/integrations/video-embeds"
lang: "en"
---

# Video embed privacy

Rewrite YouTube, Vimeo and Wistia embeds to their privacy-preserving forms.

Video embeds set cookies as soon as they load, before anyone presses play. Blocking them until consent works, but it leaves a hole where the video should be. Rewriting the embed URL is the other option: the video still plays, and the vendor collects less.

This isn't a consent bridge. Nothing is sent to the vendor. The embed URL is changed before the browser requests it.

## What each rewrite does

| Vendor | Rewrite | Effect |
| --- | --- | --- |
| YouTube | host becomes `www.youtube-nocookie.com` | No cookies until playback starts |
| Vimeo | adds `dnt=1` | Vimeo skips its own tracking and third-party analytics |
| Wistia | adds `doNotTrack=true` | Wistia stops attributing the view to a person |

Only the exact hosts are matched. YouTube covers `www.youtube.com`, `youtube.com` and `m.youtube.com`, and only on `/embed/` paths. Vimeo matches `player.vimeo.com`. Wistia matches `fast.wistia.net` and `fast.wistia.com`.

The rewrites are idempotent. An embed you already wrote as `youtube-nocookie` or already carrying `dnt=1` is left alone, so hand-tuned markup doesn't get double-processed. Protocol-relative URLs keep their form.

**Consent category.** None, and this is the point of the feature. The rewrite applies to every visitor regardless of what they chose, because it's a reduction in what the vendor collects rather than a consent decision. If you'd rather block embeds entirely until consent, that's [blocking](https://cookiebeam.com/docs/configure/blocking) instead, and the two can be combined.

## Setup

Off by default, per vendor, in the banner theme's `customFeatures`:

```json
{
  "embedPrivacy": {
    "youtube": true,
    "vimeo": true,
    "wistia": true
  }
}
```

There's no dashboard control yet, so this needs a theme update through the API.

Enabling a vendor here adds its host to the published boot manifest. A vendor you leave off isn't in the manifest, and nothing is rewritten for it.

## How it works at runtime

Two paths cover the two ways an embed reaches the page. Embeds present in the initial HTML are rewritten when the blocking engine revives them. Embeds inserted later go through the same rewrite when their `src` is set.

Both use the same rules, and the rules are shared with a server-side implementation used when the page is rendered ahead of time, so an embed doesn't get different treatment depending on how it arrived.

## Testing

Look at the network tab and confirm the request host. For YouTube it should be `www.youtube-nocookie.com`, not `www.youtube.com`. For Vimeo and Wistia, check the query string on the player request for `dnt=1` and `doNotTrack=true`.

Then check cookies. A privacy-enhanced YouTube embed shouldn't set anything on `youtube.com` until the visitor presses play.