Most consent audits scan the tag manager and the cookie list, then miss the third parties baked directly into the content: the map on the contact page, the video on the homepage, the social feed in the footer. Each one starts talking to its provider on load.
Embeds are where a tidy consent setup quietly leaks. They are also easy to fix once you can see them, which is why they make such a satisfying audit target.
What an embed actually does on load
An embedded video typically loads scripts, sets identifiers, and reports the visit to the provider before the visitor decides to watch anything. A map does the same while rendering tiles. The play button creates an impression of control that the network traffic does not share.
From a consent perspective the visit itself is the data event. If the service is non essential, and most marketing embeds are, its loading needs the same permission as any other tracker on the page.
The two click pattern
The established fix is a placeholder: a static thumbnail or styled box that loads nothing external, with a button that loads the real embed only when clicked. That click is an informed act, especially when the placeholder names the provider and notes that loading connects to it.
Where a consent platform is in place, tie the placeholder to the visitor's existing choice. Someone who already accepted the relevant category should get a smoother path, and someone who refused should not be nagged embed by embed.
Self hosting and privacy enhanced modes
Some providers offer privacy enhanced embed modes that reduce tracking until interaction. They help, but they are not invisibility cloaks, and they still contact the provider. Treat them as mitigation, not exemption, in your consent thinking.
For maps, a static image linking out to the map service removes the load time connection entirely and works well for simple find us pages. Choose per page: the contact page rarely needs an interactive map to do its job.
Auditing your embeds
Search your templates and page source for the usual provider domains and iframe sources. Marketing pages accumulate embeds over years, often added by people who have left, for campaigns nobody remembers.
Keep an embed register beside your cookie list: what it is, where it loads, what it sends, and how consent gates it. The register is what turns an annual surprise into a maintained position.
Related reading
These earlier guides go deeper on connected questions: Granular Consent Toggles Without Dark Patterns Granular choice is a legal expectation and a design minefield. How to offer category toggles that inform rather than steer, and the patterns regulators keep naming., Consent Records: What to Log, and How Long to Keep It If consent is challenged, your records are your defence. The fields a useful consent log needs, the ones that create risk, and sane retention periods., and Bottom Sheet Consent Banners on Mobile: What Works Mobile consent banners increasingly slide up as bottom sheets. When that pattern serves visitors well, when it blocks the site, and how to size and time it..
Frequently asked questions
Does a video embed set cookies before someone presses play?
In the standard embed, yes, typically. Scripts and identifiers load with the player itself. Privacy enhanced modes reduce this, and a click to load placeholder eliminates it until the visitor chooses to load the content.
Is a click on a placeholder valid consent for the embed?
A clear click on a placeholder that names the provider and explains the connection is a meaningful, specific agreement to load that service. It should also respect a prior refusal in the visitor's consent choices rather than working around it.
Are maps considered essential services?
Rarely. A map is useful, but a page can show an address and a static image without it, so interactive maps are normally treated as non essential. Gating them behind a click or consent keeps the page functional and the position defensible.
How do I find all the embeds on a large site?
Crawl page source for iframe tags and known provider domains, and check network requests on key templates with a fresh browser. Content management search for embed codes in page bodies catches the ones templates miss. Keep the findings in a register so the audit sticks.