Support GDPR-friendly cookieless YouTube embeds

[iparr]

I realise this is a bit edge-case and perhaps out of the scope of this plugin, but I believe it brings value so bare with me!

In Europe we have the GDPR which sets rules to how you can use cookies on websites. Google have reacted to this by providing 'Privacy Enhanced mode' for embeds which doesn't drop any cookies into embeds - which is brilliant.

Users of the CMS, however, just want to hit 'Share' on YouTube, get a url like this:
https://youtu.be/l1W8bQ-O5Bs
…and paste that into the oembed field. It's a bit much to ask busy, non-technical users to manipulate that into a a url like this:
https://www.youtube-nocookie.com/embed/l1W8bQ-O5Bs
… which will work.

Do you think it'd be possible for this plugin to support such an option, where the work is done for them? I can't think of a way to do it without abandoning this plugin - which I don't want to do. I think overall, that this is a better way to embed YouTube videos.

[reganlawton]

Hmm interesting 🧐 I’m familiar with GDPR and normally would use the no cookie URL but the end user might find that hard I agree. It’s possible I can add an option in the settings that transforms the URL on the fly.

I have another PR I’m reviewing and will assign time to look at this as well.

[reganlawton]

@iparrOk this shouldn't be a major ask. I'll also add the Vimeo GDPR dmt=1 tag for Vimeo. Give me till Monday to assign so time to this

[iparr]

@reganlawton Just wondering if you've been able to look at this?

If so, did you hit any obstacles and can I help in any way?

[reganlawton]

I recently started a new position so have been crazy flat out. I’m just about over a project a copy of the code sitting in a local branch I just need to make sure it’s not gonna break anyone’s code. The regex needs to be correct.

[reganlawton]

@iparr This has NOT been forgotten. Sorry for the delay on this one.

[iparr]

Has there been any progress (even in part) on this?

(Don't want to sound entitled here: just recognise the value of this enhancement)

[reganlawton]

Yes I’ve started working on it just trying to find the right way to add it. Currently looking at a REGEX option.

[iparr]

I appreciate the update, thank you.

[bhashkar007]

@reganlawton
I am also waiting for this feature to be added :) Thanks

[reganlawton]

Argh sorry guys 😅 I’ve been pulling insane hours helping my developers meet client deadlines. We are almost done. I’ll try find a moment to think this it’s setting half complete.

[reganlawton]

@iparr and @bhashkar007 I have added a new PR and you should et able to update to dev-feature/gdpr in composer and test it out.

Everything happens for now on the backend. It's actioned when the IFRAME is generated. If your using the Cache feature I recommend removing it for testing as it caches the URL results for 1hr so the GDPR effect would likewise take 1hr to take effect.

Let me know if you catch any bugs and I'll get them fixed and again thanks for be patient on this one.

[iparr]

I have tested this and it behaves as expected (i.e. 16 less YouTube cookies!). Excellent work, thank you @reganlawton

I don't really understand your caching point.

In production I'd probably wrap this whole thing (an entire article, videos and all) in a native Craft cache tag, so there would be no request to the oEmbed providers servers the iFrame or whatever would just be there.

Is the cache feature for scenarios where I am unable to do this? Would there be no impact unless I was swapping and changing videos within the same field regularly?

[reganlawton]

Great to hear! So basically I use the Craft caching system to cache to serialised embed object. If your using CraftCMS caching that’s fine but if you only cache for say 15mins etc then it just saves you a quite slow network request. The point was more to help troubleshoot if it didn’t work due to the option being enabled.

I’ll look to move this into master and give it a release version tomorrow AEST but for now that branch works.

[iparr]

I have found a problem:
On some services with GDPR on (those I think who have special rules), this works fine.

However other services (i.e. Spotify) the plugin tries to render them in YouTube. So you get an embed like this:

<iframe width="300" height="380" allowtransparency="true" frameborder="0" allow="encrypted-media" title="Spotify Embed: Hybrid Theory (Bonus Edition)" src="https://www.youtube-nocookie.com/embed/album/6hPkbAV3ZXpGZBGUvL6jVM"></iframe>

Which of course doesn't work. As soon as I switch the "Enable GDPR" switch off, then everything is fine (but of course it won't use the 'no-cookie' embeds). This happens both front and back-end (Dashboard).

For clarity, the expected behaviour is for it to use regular embeds when this feature isn't supported.

[reganlawton]

@iparr what URL did you try? I just want to test the REGEX

[iparr]

https://open.spotify.com/album/6hPkbAV3ZXpGZBGUvL6jVM
…😭, although I've had similar behaviour with other links (playlists, as well as albums).

This behaviour is consistent. Both with cache on and off (I've tested this pretty well!)

[reganlawton]

@iparr I appreciate the testing helps on a solo project like this! I'll look into this today.

[reganlawton]

@iparr The issue was once the embed/embed generated the embed link it matched the youtube regex which I've now updated to be abit more basic and Youtube focused 😅

Let me know how this latest version goes.

[iparr]

I have updated and re-tested this.

It all seems fine.

All other service load alongside the YouTube (which uses a different domain) and Vimeo (which appends dnt=1 (see: https://vimeo.zendesk.com/hc/en-us/articles/360001494447-Using-Player-Parameters) to the URL.

Good work.

[reganlawton]

@iparr thank you so much for A) your patience and B) the awesome testing.

I’ll get this released today.

[reganlawton]

Released and tagged v1.3.1

Thanks again @iparr and @bhashkar007

[iparr]

🎉 Nice one.

I work with publishers and I really don't see a better way of embedding 3rd party content in Craft CMS and privacy should be a key consideration. I wish this was made core!

[bhashkar007]

Thanks a lot @reganlawton :)

[reganlawton]

@bhashkar007 no problem and @iparr i appreciate the feedback and while Craft CMS does use / recommend my plugin in its starter blog, I believe it’s easier for them to have a third party maintaining it 😂