YSC Cookie: What It Is, Who Sets It, and Consent Rules

What the YSC Cookie Does on Your Site

The YSC cookie is a third-party functionality cookie that the YouTube embed player sets on .youtube.com to confirm that the requests of a browsing session come from the viewer. The YSC cookie is a security cookie that helps "ensure that requests within a browsing session are made by the user", according to the Google page on how Google uses cookies. The YouTube embed player writes the YSC cookie with the first response of the player, before the visitor presses play. Your cookie scanner therefore reports the YSC cookie on every page with a YouTube video, under .youtube.com and not under your own domain.

The YSC cookie arrives together with the VISITOR_INFO1_LIVE cookie and 3 more YouTube cookies. The YSC cookie lasts for the browsing session, and the other YouTube cookies stay for 6 months (180 days).

Who Sets the YSC Cookie

The YouTube embed player sets the YSC cookie. The cookie arrives in the HTTP response of the embed URL www.youtube.com/embed/<video-id>, according to a TermsFeed check of the response headers on 17 October 2026. The same response sets the VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-YNID, and __Secure-ROLLOUT_TOKEN cookies. All 5 cookies arrived with SameSite=None, Secure, and Partitioned in that check. A cookie inside a frame on another site needs SameSite=None together with Secure. Partitioned is an optional attribute that keeps a separate copy of the cookie for each site that embeds the frame. Plugins and page builders that embed YouTube videos use the same embed URL.

YouTube sends the YSC cookie with the Partitioned attribute, so Chrome keeps a separate YSC cookie for each site that embeds YouTube. The YSC cookie on your pages therefore never matches the YSC cookie of the same visitor on youtube.com.

Read how Google LLC handles the data in the YouTube privacy policy. Both documents appear in the sources at the end of this page.

Does the YSC Cookie Need Consent?

Yes, the YSC cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up YouTube, such as the embed domain of each video.

The ePrivacy Directive requires consent before a site sets the YSC cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the YSC cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the YSC cookie. Visitors get no right to opt out of the YSC cookie while YouTube acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site.

Google places the YSC cookie among its security cookies for YouTube. The video player itself is a feature your site adds, so the TermsFeed Privacy Consent template places YouTube in the Functionality vendor category, and the consent table follows that category.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the YSC Cookie Until Visitors Accept

Block the YSC cookie by holding back the script that inserts the YouTube player until the visitor accepts functionality cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place YouTube in the functionality category. Check whether an exemption applies to your own use of YouTube in the consent rules for the YSC cookie.

The YouTube player writes no YSC cookie while the script that inserts the player waits as a tagged script. Leave an empty <div> with a short text in place of the video, so visitors who decline see why the video is missing.

<div id="youtube-1"></div>
<script type="text/plain" data-cookie-consent="functionality">
  document.getElementById('youtube-1').innerHTML =
    '<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/VIDEO_ID" ' +
    'title="YouTube video player" allowfullscreen></iframe>';
</script>

How to Verify That the YSC Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The YSC cookie must not appear in the list until you accept functionality cookies.

How Long the YSC Cookie Lasts

The YSC cookie lasts for the browser session, because the YSC cookie has no expiry date. A browser that restores the last session at start-up keeps the YSC cookie after a restart.

The YSC cookie "lasts for the duration of a user's browsing session", according to the Google page on how Google uses cookies. The response header of the embed player sets no expiry date, so the browser deletes the YSC cookie when the visitor closes the browser.

Cookies That Work Together With YSC

YouTube sets 4 other cookies next to the YSC cookie in its current setup.

Scripts and Requests of YouTube That Come With the YSC Cookie

The catalog lists 2 scripts, pixels, and data endpoints of YouTube, which a cookie scanner or the Network tab of Chrome DevTools shows next to the YSC cookie. Block the main script, and the requests in the table stop with the main script.

YSC Cookie FAQs

Is YSC a necessary cookie?

No, the YSC cookie is not a strictly necessary cookie for your site. Firstly, your pages work the same for a visitor who refuses the YouTube player, apart from the video itself. Secondly, the YSC cookie protects the sessions of YouTube, a service of Google that your site embeds. Thirdly, the strictly necessary exception covers only storage essential to a service the visitor asks for, and the YouTube player sets the YSC cookie before the visitor presses play.

Does youtube-nocookie.com stop the YSC cookie?

Yes, the embed page of www.youtube-nocookie.com set no YSC cookie in a TermsFeed check on 17 October 2026, while the same video on www.youtube.com set 5 cookies. Firstly, the privacy-enhanced player answers from a separate domain of Google. Secondly, Google describes the privacy-enhanced mode as a mode that keeps the views of embedded videos from influencing the YouTube experience of the viewer. Thirdly, Google gives no list of the cookies and local storage keys that the privacy-enhanced player writes after the visitor presses play. Keep the privacy-enhanced player behind consent as well.

What is the difference between YSC and VISITOR_INFO1_LIVE?

The YSC cookie guards a single browsing session and has no expiry date, and the VISITOR_INFO1_LIVE cookie personalises YouTube recommendations for 6 months. Google lists the YSC cookie as a security cookie and the VISITOR_INFO1_LIVE cookie as a personalisation cookie that __Secure-YNID replaces.

Why does the YSC cookie appear before the visitor plays the video?

The YouTube embed player sets the YSC cookie in the first HTTP response of the player, so the cookie appears as soon as the page loads the video frame. The visitor never needs to press play. Hold back the player until the visitor accepts to keep the YSC cookie away from visitors who decline.