Is just embedding YouTube thumbs GDPR conform?

Question

Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?

Answer 1

When you cause personal data to be disclosed to third parties, GDPR requires that you have a “legal basis” for that.

Personal data is a very broad category of data, encompassing any information that relates to an identifiable person. The IP addresses of users are their personal data, as confirmed through various court cases.

When a browser connects to a server, that necessarily discloses the user's IP address to that server. For example, embedding a thumbnail image from a YouTube server will disclose your visitor's IP address to YouTube.

There are a number of ways to load content from a third party server in a compliant manner:

• You have an Art 6 GDPR legal basis. For example, the user has freely given informed consent to connect to the third party server. Or loading this material is necessary for a legitimate interest, and you have performed a balancing test to show that this interest outweighs the user's rights and interests.

  That doesn't seem to be the case here. You are showing the thumbnail in the context of a click-through consent tool, the entire point of which is to avoid disclosing personal data to YouTube without consent. Loading the thumbnail from the YouTube server would defeat this purpose.

• The third party is not a separate data controller, but is acting as a “data processor” on your behalf. This requires an enforcible contract under Art 28 GDPR. For example, your website hosting provider is likely your data processor. Google does offer such contracts for some of their business-oriented services (Google Cloud, Analytics, Workspace, …), but not for content delivery via YouTube.

• You load the thumbnail from your own servers. This avoids data disclosure to third parties.

  However, this would raise issues around copyright infringement, since the thumbnail is likely to be a copyright-protected work. It might be preferable to only serve a very low-res version, or to show no thumbnail at all. It might be useful to consider whether your country offers relevant copyright exceptions.

Noteworthy judgements on this kind of situation:

• The CJEU Fashion ID case (2018-12-19, C-40/17) showed that website operators are responsible for the data disclosure they cause to third parties. In that case, a website had embedded Facebook's “Like” button. However, already loading this button discloses data to Facebook, even for visitors that weren't Facebook users, even for visitors that don't interact with the button. The website operator tried to argue that they weren't responsible since it was the user's browser that was making the HTTP request, but the court rejected this.

• The LG München Google Fonts case (2022-01-20, 3 O 17493/20) fined a website operator for loading webfonts from a Google server. Already the act of loading the font file discloses the user's IP address to Google. The website operator tried to argue that they were covered by a legitimate interest, but the court rejected this since it isn't necessary to load the font from a Google server.

  However, there's a notable difference to your situation in that all the fonts on Google Fonts have an Open Source license and can be self-hosted without copyright concerns, whereas YouTube thumbnails have no such licensing. This might weigh in favour of a legitimate interest argument.