Privacy ComplianceWeb Tracking
Do Embedded Videos, Maps, and reCAPTCHA Require Consent?
Embedded videos, maps, and security checks such as reCAPTCHA operate by loading content from third-party companies inside web pages. Each one sends visitors' information to its provider. Consent banners often do not control them, so they may keep running even when visitors have opted out.
By Alex Proctor
Published October 22, 2026
Summary
Embedded content refers to third-party features such as YouTube and Vimeo videos, Google Maps, and reCAPTCHA. In Europe, embeds that set cookies generally require consent, and an Austrian court has held that reCAPTCHA is not technically necessary for websites to operate. In the U.S., no law requires consent for embeds specifically, but state privacy laws and wiretapping claims can still reach the information they send. I recommend that businesses confirm which embeds their websites load, and whether those embeds respond to visitors' privacy choices.
What Do Embeds Send to Their Providers?
Most embeds contact their providers as soon as pages load, before visitors click on anything. Google states that when websites embed video content from YouTube, visitors' browsers automatically send Google information that includes "the URL of the page you're visiting and your IP address." It adds that Google "may also set cookies on your browser or read cookies that are already there." Google describes its other embeds in similar terms, as do Vimeo's privacy policy and cookie list:
| Embed | What the Provider Says It Receives or Sets |
|---|---|
| YouTube video | Page addresses, IP addresses, and cookies |
| Vimeo video | IP addresses, device details, and visitor ID cookies |
| Google Maps | Search terms, IP addresses, and map coordinates |
| reCAPTCHA | IP addresses, device details, and a cookie it calls necessary |
Based on Google's and Vimeo's published policies and documentation, as of October 2026.
Do Providers Offer Privacy Settings?
Several providers offer settings that reduce what their embeds collect. YouTube's privacy-enhanced mode prevents views of embedded videos "from influencing the viewer's browsing experience on YouTube." Notably, Google's description addresses service personalization, not whether the embed stops sending information to Google.
Vimeo offers a setting that "blocks the player from collecting session data and analytics," although it notes that "some essential cookies will still be active." Like YouTube's mode, it reduces what the provider collects without stopping visitors' browsers from contacting it.
Google does not describe a comparable setting for embedded maps. Instead, its terms require websites that use its maps to comply with privacy laws, "including laws regarding Services that store and access Cookies on End Users' devices."
For reCAPTCHA, which Google now offers as Fraud Defense, Google changed its role in April 2026. Its FAQ now describes Google as the data processor and the website as the data controller. In practice, Google's terms limit its use of the information to running the service, and state that it "will not be used for any other purpose, such as personalized advertising by Google." The website, as the controller, becomes responsible for describing the service in its own privacy notice.
What Do Privacy Laws Require?
In Europe, the cookie rule requires consent before information is stored on or read from visitors' devices, unless that is "strictly necessary" for a service that visitors "explicitly requested." Embedded videos that set cookies as pages load are unlikely to fit that exception, because visitors have not yet asked to watch anything. In 2024, an Austrian court held that reCAPTCHA was not technically necessary for websites to operate, so its cookies required consent.
In the U.S., no law requires consent for embeds specifically. However, Google's maps terms also allow Google to use the data that its maps collect "to provide and improve Google products and services," and they treat Google and the website as separate controllers of that data. Arrangements like that are one reason state privacy laws may treat the information that embeds send as a sale or sharing of personal information.
Embeds have also begun to appear in wiretapping lawsuits. In a pending federal case in California, the plaintiff alleges that a contact form embedded from a form-building service loaded reCAPTCHA, which stored an advertising cookie "even if the user has rejected the use of third-party tracking and advertising cookies." Websites with video face a separate set of claims under the Video Privacy Protection Act, although those claims have generally involved advertising pixels on pages with video, rather than the video players themselves.
Why Do Banners Miss Embeds?
Consent banners control the tools that have been connected to them. Embeds are often added outside that process, by content editors who paste in a video, through page builders, or by third-party forms that load their own security checks. They also tend to be viewed as features rather than tracking tools, much like external fonts.
Most embeds also load in frames, which are separate pages served from the providers' own domains. Banners that only remove or block cookies on the website itself cannot reach the cookies set inside those frames. Controlling embeds generally means stopping their frames from loading.
Blocking embeds is also a blunt approach. Blocked videos and maps often leave empty spaces or blank frames on the page, which can make websites look broken. Some businesses leave embeds running for that reason.
As a result, embeds may load no matter what visitors choose, including after they opt out. Websites may then offer a privacy choice that parts of their pages do not honor.
How Can Websites Control Embeds?
Businesses can limit what embeds collect, or control when they load, in three ways:
- Use the providers' privacy settings. Where they exist, these settings limit what the embeds collect, although they do not necessarily stop the embeds from contacting their providers. Google also lets websites load reCAPTCHA from www.recaptcha.net instead of www.google.com, a domain that its FAQ says "may have other cookies set."
- Load embeds when visitors select them. Rather than leaving an empty frame, websites can show a placeholder in place of the video or map. Some consent platforms offer placeholders as a feature. Developers can also build them, using a technique that Google's developer guidance describes for page speed.
- Control embeds through the consent banner. Embeds can be gated behind consent logic derived from the banner, so that they stop loading when visitors disable tracking.
Security tools need specific consideration. Blocking reCAPTCHA can stop forms from working, so businesses often place it in a necessary category, which is the choice the Austrian court questioned. I recommend that businesses confirm which embeds their websites load, and decide deliberately which consent category each one belongs in.
Questions
Does YouTube's privacy-enhanced mode remove the need for consent?+
Not by itself. Google says that the mode prevents views of embedded videos from influencing visitors' experience on YouTube, and that related advertising is not personalized. It does not say that the embed stops sending information to Google or stops setting cookies. In Europe, cookies that the player sets before visitors press play may still require consent.
Is reCAPTCHA a strictly necessary tool?+
Not clearly. In 2024, an Austrian court held that reCAPTCHA was not technically necessary for websites to operate. Google changed its role in April 2026 to act as a data processor for the websites that use the service, which may change the analysis in some places. No U.S. rule addresses the question directly.
Do embedded videos create risk under the Video Privacy Protection Act?+
Possibly, because the Video Privacy Protection Act restricts the disclosure of what a person watched. The lawsuits brought under it have generally involved advertising pixels on pages with video, which can send viewing information along with an identifier. The embedded players have not been the focus of those lawsuits so far. The Supreme Court heard argument in October 2026 in a case on who qualifies as a consumer under the law.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.