Allow YouTube’s privacy-enhanced player for partner video

Context and Problem Statement

ADR-0034 lets a page load images and video only from the site, Brand and the company’s own video service (Cloudflare Stream), and its media-host rule fails any other source. After Vaisala’s industry and application content was published in the CMS, the live check of akribis.info against the real CMS (600 pages, 2026-10-07) found 73 media-host violations, all of one kind: an <iframe> from www.youtube-nocookie.com inside the partner’s text (ADR-0038), Vaisala’s own explanatory videos, which live on Vaisala’s YouTube channel and nowhere AKRIBIS could host them under the partner agreement.

The decision of 2026-10-07 (Demian Montes de Oca): «Allow youtube-nocookie». How far does the allowance reach, and what keeps everything else as strict as ADR-0034 made it?

Decision Drivers

Criteria 1 (trust: a page that loads a third party sets nothing in the visitor’s browser before they play) and 9 (generated and tested) of ADR-0009; ADR-0034 (media from AKRIBIS’s hosts, checked on every build); ADR-0038 (a partner’s text is drawn as it came, attributed).

Considered Options

• Allow exactly www.youtube-nocookie.com, for <iframe> only, and draw every YouTube address in that form
• Allow YouTube’s hosts in general (www.youtube.com, youtube-nocookie.com, googlevideo.com)
• Keep the rule and strip the partner’s players from its text

Decision Outcome

Accepted: the first option.

• One host, one element. media.frames in brand/standards.yaml lists www.youtube-nocookie.com: an <iframe> may load from exactly that host. It is not a media host: an <img>, <video>, <source> or <audio> from it still fails, and so does an <iframe> from www.youtube.com, youtube.com, googlevideo.com or any other host. The checker’s media-host rule reads it.
• Every YouTube address is drawn as nocookie. The site package turns any YouTube player into the privacy-enhanced one before it is drawn: an embed block declared youtube, a video block with a YouTube link, and an <iframe> (or Wagtail’s <embed embedtype="media">) inside an editor’s HTML, from youtube.com, youtu.be or youtube-nocookie.com (fitFrames in cms/normalise.ts, the same embedUrl as the blocks).
• The player gets the least. Lazy loading, a title (the editor’s, or «Video» in the page’s language), allow="encrypted-media; picture-in-picture; fullscreen" and referrerpolicy="strict-origin-when-cross-origin" (the origin only; YouTube’s player does not play without a referrer). Whatever else a paste carried (autoplay, clipboard, sensors, frameborder, sizes) is dropped.
• It is for a partner’s video. AKRIBIS’s own video stays on the site or on Cloudflare Stream (ADR-0034); YouTube is how a partner’s video reaches a page, not where AKRIBIS publishes.

Consequences

• Good, because Vaisala’s videos play on the pages that quote its text, and the build still fails on any other third-party media.
• Good, because the nocookie player sets no cookie until the visitor plays it, so no consent banner change is needed for a page to load.
• Bad, because playing it hands the visitor to Google; the attribution (ADR-0038) says whose video it is.
• Neutral, because another provider (Vimeo, LinkedIn, a map) needs a record of its own before it joins media.frames.