Nothing loads until your visitor clicks.
See plansA stored image and a button — and nothing else
A YouTube video, a Google Map, an Instagram post: the moment they render, they set cookies and call their servers — before any consent. Video GDPR replaces each one with a local façade. No script, cookie, CDN request or API call fires until the visitor clicks.
A standard embed starts phoning home before anyone clicks.
Most site owners never think about this — until a compliance audit, a user complaint or a cookie-scanner report flags every embedded video and map on the site.
What is happening
The moment a YouTube, Vimeo, Maps or Instagram embed renders, it loads the provider's scripts, sets cookies and sends your visitor's IP address to a third-party server — often outside the EU. No click, no consent, nothing the visitor can refuse.
The local façade
Video GDPR replaces every embed with a façade built on your own server: a stored thumbnail and a play button. No provider script, cookie, CDN request or API call happens until the visitor clicks. The click is the consent.
The real payoff
No cookie wall in front of every video. Lighter, faster pages — five videos load five local images, not five third-party players. And a clear, per-embed consent you can point to, instead of a blanket banner nobody reads.
Analytics, built in
You also get anonymous audience stats for every video — impressions, plays, play-through rate, completion — with no cookie, no IP, no visitor ID and no third-party analytics tool to add. Numbers without a second consent to ask for.
One plugin. Every feature. Just pick your scale.
No feature is ever locked behind a higher tier — every plan includes the complete Video GDPR toolkit. The only thing that changes is how many sites you run it on.
Monthly
Pay as you go, cancel anytime.
100% self-hosted — no external API, no CDN, no third-party account. Each thumbnail is fetched once, server-side, then served from your own domain — nothing external after that.
Every provider, every builder — YouTube, Vimeo, Wistia, Dailymotion, Loom, TikTok, self-hosted video, maps and social posts (X, Instagram, Facebook, Bluesky). Works with the Gutenberg block, shortcodes, and native Bricks & Elementor elements.
Anonymous analytics included — impressions, plays, play-through rate and completion for every video, broken down by page. No cookie, no IP, no visitor ID, no third-party analytics tool.
GDPR by design — nothing third-party loads before the visitor clicks, the plugin never sets a cookie, and a strict offline mode can block every outbound request.
Annual
Save on every tier, billed once a year.
100% self-hosted — no external API, no CDN, no third-party account. Each thumbnail is fetched once, server-side, then served from your own domain — nothing external after that.
Every provider, every builder — YouTube, Vimeo, Wistia, Dailymotion, Loom, TikTok, self-hosted video, maps and social posts (X, Instagram, Facebook, Bluesky). Works with the Gutenberg block, shortcodes, and native Bricks & Elementor elements.
Anonymous analytics included — impressions, plays, play-through rate and completion for every video, broken down by page. No cookie, no IP, no visitor ID, no third-party analytics tool.
GDPR by design — nothing third-party loads before the visitor clicks, the plugin never sets a cookie, and a strict offline mode can block every outbound request.
With vs. Without Video GDPR
| Without Video GDPR | With Video GDPR | |
|---|---|---|
| Before the click | Provider scripts run, cookies are set, the visitor’s IP is sent abroad | A stored thumbnail and a play button — nothing third-party loads |
| Consent | The embed loads whether the visitor agrees or not | The click is the consent — explicit, per embed, and recorded |
| Page weight | Every embed pulls a full player, its scripts and its fonts | Every embed is one local image until someone clicks |
| Cookie banner | A blocking banner needed in front of every video | The notice sits on the façade — no wall across the page |
| Audience data | A separate analytics tool, and one more consent to ask for | Anonymous stats per video, built in — no cookie, no IP |
Everything you need. Nothing you don't.
Video GDPR replaces every video, map, social post and iframe with a local façade — a stored thumbnail and a button — so no provider script, cookie or API call fires until the visitor clicks. It works with the Gutenberg block, shortcodes, native Bricks and Elementor elements and ACF / Meta Box fields, across a dozen providers. And it records impressions, plays and completion for each video — anonymously, with no cookie and no IP.
Every video provider
YouTube (via youtube-nocookie.com), Vimeo, Wistia, Dailymotion, Loom, TikTok, Twitch, and self-hosted MP4/WebM. An automatic local thumbnail for all of them except a few social networks.
Social posts, no tracker
X, Instagram, Facebook, Bluesky and TikTok show as a local card. On click, the platform's own official widget loads — never its widgets.js / embed.js tracking script.
Maps, forms, any iframe
Google Maps, OpenStreetMap, calendars, third-party widgets: the same façade. OpenStreetMap even gets a static preview stitched server-side — no API key.
Nothing loads before the click
No provider script, cookie, CDN request or API call fires until the visitor clicks. The click is an explicit, per-embed consent — and it's what the statistics count as a "play".
Thumbnails, 100% local
Fetched once from the provider, server-side, then stored and served from your own domain. A self-hosted video's first frame is captured automatically. After that, nothing external is ever requested.
Strict offline mode
One switch to never contact any provider at all. The façade uses a poster image you set, or the local placeholder. Nothing leaves your server.
Analytics, built in
Impressions, plays, play-through rate and completion (25/50/75/100%) for every video, broken down by page. No cookie, no IP, no visitor ID — and "Do Not Track" is honoured.
Fits your workflow
A Gutenberg block, the [privacy_video] / [privacy_embed] shortcodes, native Bricks and Elementor elements, ACF and Meta Box "oEmbed" fields — or just paste a URL and let auto-detection handle it.
Editorial control
Add #noembed to keep any URL a plain link. Override auto-detection per page or post. Force a custom thumbnail per video from your media library — it applies everywhere that video appears.
Consent-plugin bridges
If the visitor already accepted the marketing / social category in Complianz, Borlabs, Cookiebot or CookieYes, the façades load on their own. No add-on required.
Translation-ready
English, French and Spanish out of the box. The notice and button text ship in six languages and follow the site's language.
Works on any host
No dependency, no CDN, no key. Thumbnail fetching adapts to hosts with WP-Cron disabled or outbound requests blocked.
What the table doesn't show
"Nothing loads" is literal
Some privacy plugins still fire a deferred script, a preconnect or a DNS prefetch to the provider before the click. Video GDPR fires zero third-party requests: no script, no cookie, no CDN call, no preconnect. The thumbnail sits on your server. The only outbound call the plugin ever makes is one server-to-server fetch of that thumbnail, once — then never again.
The click is the consent
The façade shows what is about to load and links your privacy policy. The click is specific to that one embed, not a blanket "accept all" — and the statistics record it as a play. You end up with a per-video trace that consent was given, instead of one banner interaction for the whole page.
Anonymous means anonymous
The statistics are counters per video, per day. No cookie, no IP — not even hashed — no visitor identifier, no session, no referrer. A view is attributed to a post ID, which says nothing about the person. "Do Not Track" is honoured. There is no individual to re-identify, because none is ever stored.
Measured after the click
To know how far people watch, you need the provider's player API. Video GDPR loads it only after the click — when the player is loading anyway — so the measurement never costs the visitor a pre-consent request. Dailymotion and Loom don't expose progress, so those columns stay empty rather than showing a guessed number.
No AI, no external service
No AI assistant, no external API, no CDN, no account to create. A thumbnail is fetched once, server-to-server, and then it is yours. A strict offline mode blocks even that. Nothing a visitor does on your site is ever transmitted anywhere — there is no third party in the loop to transmit it to.
Works without WP-Cron
Managed hosts often disable WP-Cron or block outbound requests. Video GDPR still gets its thumbnails — on page save, at the end of a front-end request, or via one call from the visitor's browser. No admin button to press on a normal site.
Auto-detect that doesn't over-reach
Auto-detection only converts a URL whose visible text is the URL itself — the failed-embed case. A link with its own wording is left exactly as placed. And #noembed keeps any URL a plain link, invisibly.