Better privacy for youtube videos

Thanks for #35 :-)

Just FYI if you switch to the nocookie domain cookies get still loaded, external fonts.
Even if you link the hir-es image from youtube directly cookies are set.
The only solutions seems to be to load and use the thumb oembed itself stores in the oembed folder in /files

I also decided (again) to go with a custom solution .. using data-src, the oembed thumbnail and the no-cookie domain.
(Not using a consent banner, so the cookies module seemed to heavy for me, although I did not tried)

But still I would welcome the no-cookie domain and the vimeo setting toggle (aka more privacy) for core's external video media type!

I applied the hook that Berdir shared in the first comment but I had to complement the solution by passing the entity id to the iframe controller, that way I was able to load the media entity data. In my case I added a custom field to my Remote Video media type to determine whether to replace youtube.com by youtube-nocookie.com or not.

use Drupal\media\IFrameMarkup;

/**
 * Implements hook_preprocess_media_oembed_iframe().
 */
function mymodule_updates_preprocess_media_oembed_iframe(array &$variables) {
  if (strpos((string) $variables['media'], 'youtube.com') !== FALSE) {
    $entity_id = $variables['entity_id'];
    $remote_video = \Drupal::entityTypeManager()->getStorage('media')->load($entity_id);
    $no_cookies = $remote_video->get('field_nocookies')->value;
    if ($no_cookies) {
      $variables['media'] = IFrameMarkup::create(str_replace('youtube.com/', 'youtube-nocookie.com/', $variables['media']));
    }
  }
}

Dear Community, It's a bit of a shame that we're not pursuing this issue further. We now have Klaro! and can provide decent privacy notices, but our videos are still being loaded from youtube.com. Could we perhaps address this issue in Zewitnah and simply offer Youtube Nocookie as a third alternative Oembed provider for Drupal Core?

That would be so nice and simple. The easiest solution for users would be if they could simply paste normal URLs from YouTube Studio and the Oembed provider would have a checkbox in the formatter options to choose whether to use the normal YouTube version or no-cookie. I mean, if we're implementing data protection in Drupal, we might as well do it right, right?