1

Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?

2
  • could you explain precisely what you mean by embedding the Youtube thumbnail? On which server would that thumbnail image be hosted?
    – amon
    Mar 1, 2023 at 19:42
  • Thanks! If a website links an image from the URL img.youtube.com/vi… in context of providing an YouTube video thumbnail on an content blocker before a user have accept using YouTube. Mar 4, 2023 at 18:47

1 Answer 1

1

When you cause personal data to be disclosed to third parties, GDPR requires that you have a “legal basis” for that.

Personal data is a very broad category of data, encompassing any information that relates to an identifiable person. The IP addresses of users are their personal data, as confirmed through various court cases.

When a browser connects to a server, that necessarily discloses the user's IP address to that server. For example, embedding a thumbnail image from a YouTube server will disclose your visitor's IP address to YouTube.

There are a number of ways to load content from a third party server in a compliant manner:

  • You have an Art 6 GDPR legal basis. For example, the user has freely given informed consent to connect to the third party server. Or loading this material is necessary for a legitimate interest, and you have performed a balancing test to show that this interest outweighs the user's rights and interests.

    That doesn't seem to be the case here. You are showing the thumbnail in the context of a click-through consent tool, the entire point of which is to avoid disclosing personal data to YouTube without consent. Loading the thumbnail from the YouTube server would defeat this purpose.

  • The third party is not a separate data controller, but is acting as a “data processor” on your behalf. This requires an enforcible contract under Art 28 GDPR. For example, your website hosting provider is likely your data processor. Google does offer such contracts for some of their business-oriented services (Google Cloud, Analytics, Workspace, …), but not for content delivery via YouTube.

  • You load the thumbnail from your own servers. This avoids data disclosure to third parties.

    However, this would raise issues around copyright infringement, since the thumbnail is likely to be a copyright-protected work. It might be preferable to only serve a very low-res version, or to show no thumbnail at all. It might be useful to consider whether your country offers relevant copyright exceptions.

Noteworthy judgements on this kind of situation:

  • The CJEU Fashion ID case (2018-12-19, C-40/17) showed that website operators are responsible for the data disclosure they cause to third parties. In that case, a website had embedded Facebook's “Like” button. However, already loading this button discloses data to Facebook, even for visitors that weren't Facebook users, even for visitors that don't interact with the button. The website operator tried to argue that they weren't responsible since it was the user's browser that was making the HTTP request, but the court rejected this.

  • The LG München Google Fonts case (2022-01-20, 3 O 17493/20) fined a website operator for loading webfonts from a Google server. Already the act of loading the font file discloses the user's IP address to Google. The website operator tried to argue that they were covered by a legitimate interest, but the court rejected this since it isn't necessary to load the font from a Google server.

    However, there's a notable difference to your situation in that all the fonts on Google Fonts have an Open Source license and can be self-hosted without copyright concerns, whereas YouTube thumbnails have no such licensing. This might weigh in favour of a legitimate interest argument.

1
  • 1
    IMHO the easiest way out of this is to hide thumbnails by default, have a button to enable them, and when the user clicks the button, clearly tell them that they are about to send their data to YouTube, and ask whether they want to proceed. Then you have bona fide consent and don't need to faff about with legitimate interest balancing tests. You could even ask the user to consent once to all subsequent thumbnails (I think).
    – Kevin
    Mar 5, 2023 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .