YouTube & Data Privacy: Is the Video Platform GDPR Compliant?
- YouTube stores personal data such as name, date of birth, email address, and phone number.
- Cookies allow YouTube to track user activity across devices and display personalized advertisements.
- Embedded YouTube videos set cookies even if the video is not played.
- Users can improve their privacy via Google account settings, for example by pausing their search history.
- YouTube requires informed consent for data collection, except in cases of contract fulfillment or legitimate interest.
Whether it's a music video, vlog, or explainer video, all YouTube users should know what happens to their data when they post, stream, follow channels, or share content. Unfortunately, this isn't entirely clear, even at second glance.
What data does YouTube store, and how does it handle personal information?
YouTube does not have its own privacy policy, as the company has been part of Google LLC since 2006 and therefore refers to their privacy terms. The data initially required and stored to register a user account is still understandable:
- Name
- Date of birth
- Email address
- Phone number.
Much more critical, however, is the storage of IP addresses or location data, which occurs when using Google services and, by extension, YouTube.
So, what is the situation regarding data protection for YouTube videos that you watch on various devices? Here, your activities can be clearly linked to your Google account and the specific device, such as a smartphone or tablet, through the use of cookies. This allows YouTube to show its users personalized advertising or tailor their search queries using an algorithm adapted to their behavior influence.
However, data can also be stored when using YouTube indirectly. If you embed a YouTube video on your own website using a so-called framing link , YouTube will set cookies as soon as the website is accessed, even if the video itself has not yet been clicked. At the same time, the Google-owned advertising network DoubleClick is activated, which also collects data in a way that is not transparent to users.
How can users protect their data on YouTube?
A first step is to check the settings of your Google account, which also apply to your use of YouTube. Under the Activity controls section, you will find advanced options for privacy on YouTube. Here, you can pause your video search history and turn off your video watch history. You can also improve the privacy of your own YouTube videos. You have the option to set them to private instead of public.
It gets more complex with embedded videos, i.e., when you want to integrate a YouTube video into your website's code. To protect yourself and your website visitors from unnecessary data disclosure, you should use the privacy-enhanced mode available on YouTube. This setting ensures that YouTube cookies are only used once users actually click on the video itself—and not just upon visiting the website. Unfortunately, this does not apply to the setting of cookies by DoubleClick.
To generate a link for embedding your YouTube video in privacy-enhanced mode, follow these steps:
- Click the Share button below your video
- In the window that opens, select the Embed option
- Do not copy the generated link; instead, click Show more
- In the window that opens, check the box for Enable privacy-enhanced mode.
After that, the link with the URL www.youtube-nocookie.com should be displayed in accordance with the GDPR.
What permissions does YouTube have to share data?
Since the GDPR came into effect, YouTube and Google must obtain informed consent from users before collecting any data and must provide information regarding the purpose of its use. Unfortunately, there are two exceptions here: if data is stored for the purpose of fulfilling a contract or due to a legitimate interest, this consent does not need to be obtained.
Data required for contract fulfillment might include an address or clothing size if you are ordering something from an online shop. The term "legitimate interest," on the other hand, can be interpreted freely by companies and justified, for example, by product improvements.
What do companies need to consider when using YouTube?
Using YouTube in compliance with the GDPR is essential, especially in a professional context. If you, as a website operator, embed such external content, it is your duty to inform visitors about the potential storage and processing of their data by third parties. Failure to do so can have legal consequences. Unfortunately, neither YouTube nor Google provides transparent information about what data is collected and for what purpose through the use of cookies and Google's DoubleClick system. This makes it difficult for you as a business owner to adequately inform your customers about how their data is being used.
In any case, you are obligated to inform users about the potential nature of data usage by you and third-party providers as soon as they enter your website. Since this is not entirely possible due to the opaque practices of these internet corporations, you as a merchant remain at a certain risk of receiving a formal warning if you do not obtain consent.
All in all, it is not entirely clear to what extent the streaming platform YouTube is committed to complying with the General Data Protection Regulation. Given the business model of its parent company, Google, a healthy dose of skepticism and vigilance is appropriate when using these services.
Do you have further questions on this topic? Our experts will be happy to advise you free of charge.
