[wp-trac] [WordPress Trac] #44610: Allow Youtube-Player to use youtube-nocookie.com URLS to avoid setting cookies.

[WordPress Trac]

#44610: Allow Youtube-Player to use youtube-nocookie.com URLS to avoid setting
cookies.
-------------------------------------+-----------------------------
 Reporter:  jepperask                |       Owner:  williampatton
     Type:  enhancement              |      Status:  assigned
 Priority:  normal                   |   Milestone:  Future Release
Component:  Embeds                   |     Version:  4.9.7
 Severity:  normal                   |  Resolution:
 Keywords:  needs-testing has-patch  |     Focuses:  privacy
-------------------------------------+-----------------------------

Comment (by BjornW):

 Replying to [comment:20 RogierLankhorst]:
 > @paapst is correct: the no-cookie solution is called the "delayed cookie
 option" by Google, it's not a "no cookie" solution. Because the user does
 not explicitly consent to cookies when the video is started, this is not
 GDPR compliant.

 I've been testing youtube-nocookie using Firefox in Incognito mode (see
 the attached screenshots). So far it did not add cookies.

 However it did add data to local storage
 ([https://core.trac.wordpress.org/attachment/ticket/44610/screenshot-2020-09-08_20-38-19
 -YouTube-nocookie-adds-data-to-localstorage-before-playing.png
 screenshot]) and to session storage
 ([https://core.trac.wordpress.org/attachment/ticket/44610/screenshot-2020-09-08_20-38-34
 -YouTube-nocookie-adds-data-to-session-storage-before-playing.png
 screenshot]) before playing the movie.

 After pressing play on the movie it added more data to local storage
 ([https://core.trac.wordpress.org/attachment/ticket/44610/screenshot-2020-09-08_20-40-30
 -YouTube-nocookie-adds-more-data-to-localstorage-after-pressing-play.png
 screenshot]).

 Is local storage considered a cookie by (GDPR or any related) law?
 Technically there are differences between them, but in practice I'd
 consider them more or less the same.

 Based on my results I have a few questions:
 - youtube-nocookie does not add cookies, should this be used by default
 instead of youtube with cookies?
 - Is local storage considered a cookie by (GDPR or any related) law?
 - What is Google storing in local storage data?
 - Should we consider the data stored in local storage as potentially
 privacy invasive (and is this relevant for WordPress Core)?

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/44610#comment:22>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform