All third-party cookies identified with provider, purpose, duration
Why it matters
GDPR Art. 13(1)(e) requires disclosure of the recipients or categories of recipients of personal data — which for cookie-based tracking means identifying the third-party providers by name, not just category. Users making a consent decision about 'analytics cookies' cannot give informed consent under GDPR Art. 4(11) without knowing that accepting means sharing behavioral data with Google LLC or Meta Platforms Inc. YouTube embeds are a common blind spot: an embedded youtube.com iframe — not youtube-nocookie.com — sets VISITOR_INFO1_LIVE and YSC cookies on page load, before any user interaction with the video.
Severity rationale
Low because the failure is one of disclosure completeness rather than the presence of unconsented tracking, but it renders consent uninformed and therefore invalid under GDPR Art. 4(11) for the undisclosed providers.
Remediation
For embedded YouTube content, switch to the privacy-enhanced URL to prevent cookie-setting on load. For all third-party cookies, ensure the registry includes provider legal name, privacy policy URL, and expiry.
// Use privacy-enhanced embed to avoid YouTube cookies on page load
<iframe
src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
title="Video description"
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
allowFullScreen
/>
For Google Fonts, self-host to eliminate the third-party request entirely — place font files in public/fonts/ and reference via CSS @font-face. For all other third-party cookies in src/lib/cookies/registry.ts, add provider: 'Google LLC' (not 'Google'), providerPrivacyUrl: 'https://policies.google.com/privacy', and expiry: '2 years'. Provider cookie inventories are published at their respective privacy policy URLs.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13(1)(e) — GDPR — recipients or categories of recipients of the personal data must be disclosed
- eprivacy · Art. 5(3) — ePrivacy Directive — clear and comprehensive information about third-party cookies
- ccpa · §1798.135 — CCPA — third-party data sharing must be disclosed
- gdpr · Art. 4(11) — Definitions — Consent
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated