[wp-trac] [WordPress Trac] #44610: Allow Youtube-Player to use youtube-nocookie.com URLS to avoid setting cookies.

[WordPress Trac]

#44610: Allow Youtube-Player to use youtube-nocookie.com URLS to avoid setting
cookies.
-------------------------------------------------+-------------------------
 Reporter:  jepperask                            |       Owner:
                                                 |  williampatton
     Type:  enhancement                          |      Status:  assigned
 Priority:  normal                               |   Milestone:  5.7
Component:  Embeds                               |     Version:  4.9.7
 Severity:  normal                               |  Resolution:
 Keywords:  needs-testing has-patch needs-dev-   |     Focuses:  privacy
  note                                           |
-------------------------------------------------+-------------------------

Comment (by adakaleh):

 Replying to [comment:39 johnbillion]:
 > To clarify, the intention of this change is to switch the domain name
 for all YouTube embeds from youtube.com to youtube-nocookie.com.

 The intention is to change the default. Users can still embed youtube.com
 iframes by editing the page's code - as they must do now in order to use
 youtube-nocookie.com.

 > The result is that no cookies are set by YouTube until the visitor
 interacts with the video, for example by playing it.

 No cookies are set even after playing it.

 > Does this have any side effects for the player? For example, are there
 preferences I can set on YouTube that carry over to embedded videos that
 will no longer be respected?

 Yes, that's kind of the point: there are no identifiers to associate the
 embed with your YT account, therefore it can't load any preferences from
 your YT account. The video won't appear in your account's history either.

 To compare youtube and youtube-nocookie embeds, just open (for example)
 these links:
 https://www.youtube.com/embed/LxLECbf0nOA
 https://www.youtube-nocookie.com/embed/LxLECbf0nOA

 > Do controls such as "watch later" still work as expected?

 "Watch later" and "Share" are replaced by "Copy link". "Watch later" is
 not available because the embed is not connected to your Google/YT
 account.

 > Does this affect the video analytics in any way?

 I suspect not, because youtube-nocookie sends a telemetry request to
 `https://www.youtube-nocookie.com/api/stats/` with a bunch of information,
 such as details about the browser.

 Even if it does affect analytics, so far this hasn't caused WordPress to
 exempt Vimeo from DoNotTrack. For consistency, this shouldn't exempt
 YouTube either.

 > This will cause breakage for sites that use a content security policy
 that allows youtube.com but aren't aware of youtube-nocookie.com.

 True. The release announcement should instruct site owners on how to
 adjust the CSP.

 > What else might break with a change of domain name here?

 Nothing else comes to mind. Feature-Policy is not affected, as youtube
 iframes have their own.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/44610#comment:41>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform