Make Youtube Embeds GDPR compliant

[julieg18]

Currently, we use Youtube embeds for videos on the site. But Youtube is using cookies to track user's info. If we don't want to have to ask a user's permission to play Youtube videos, we'll need to find an alternative to youtube. Youtube does offer youtube-nocookie.com, but that just places tracking info in local storage and adds cookies once the user presses play.

cc @shcheklein @rogermparent

[rogermparent]

Vimeo immediately comes to mind, as their business model is based on paid memberships for the video hosting itself as oppose to collecting user data, and they have an embedded player parameter called dnt which "will block the player from tracking any session data, including all cookies and analytics."

The free Basic plan's primary limit to us is an upload space limit of 500mb per week and 5GB total. The cheapest paid plan, Plus, bumps that up to 5GB per week and 250GB per year (and assumedly unlimited total aside from that).

[rogermparent]

Dailymotion is another alternative that claims to be GDPR compliant, and they have a more generous free plan than Vimeo.

[julieg18]

We could definitely use a different video platform, but we would be forced to copy over any youtube videos we want to post on our website over to that platform. And we would less traffic on our youtube channel 🤔

Maybe we should consider turning our youtube embeds into links to youtube? We could use the youtube API and CSS to make it look like a video (allowing us to not have to update our website layouts), but when you click on it opens a new tab to youtube. @iterative/websites, what do you think?

[rogermparent]

We could definitely use a different video platform, but we would be forced to copy over any youtube videos we want to post on our website over to that platform. And we would less traffic on our youtube channel thinking

Agreed, would be a rough time to port all videos we want to embed as well as trying to enforce no youtube embeds throughout the site.

Maybe we should consider turning our youtube embeds into links to youtube? We could use the youtube API and CSS to make it look like a video (allowing us to not have to update our website layouts), but when you click on it opens a new tab to youtube.

I don't think this is quite what we'd want, I get the impression most people like to have the embeds within the site instead of bringing the user to another site which makes it more likely they'll bounce after.

Maybe we could re-tune our youtube-embeds such that the iframe src is not loaded until the user clicks a button? I found some inspiration from this article and threw together a little demo:

youtube-delayed-load-demo.mp4

We'll have to provide our own background image if we want one, but this method of loading ensures that the child iframe can't even load if we don't want it to, ensuring that no user info can be stored and we stay GDPR compliant while keeping videos embedded in the website.

PR created at #3136

[julieg18]

Maybe we could re-tune our youtube-embeds such that the iframe src is not loaded until the user clicks a button?

That would definitely be an improvement but I believe to be GDPR compliant, we would need to notify the user that clicking on the button sets trackers. If we want to keep youtube embeds on the site, maybe we could notify the user by showing a tooltip so the user wouldn't need to make extra clicks 🤔

[shcheklein]

Tooltip when I hover the play button?

One option to consider - open it the new window on the youtube domain?

[julieg18]

Tooltip when I hover the play button?

Yes! If we want to keep youtube embeds on our site, we would need to notify the user that clicking on the youtube video would add trackers to their browser. One way that came to mind was adding a tooltip when you hover over the play button, letting the user know that clicking play would add trackers, keeping things GDPR compliant.

One option to consider - open it the new window on the youtube domain?

Yes, I mentioned this option earlier! We can have the site open a link to youtube when a user clicks on the video. It keeps our site tracker free and we won't have to notify the user of anything :)

[shcheklein]

I think tooltip like that works. We would need to take care of the blog and docs for the embedded videos I think.