Who needs to implement Cookie Consent for embedded content?
<p>Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <code>&lt;iframe&gt;</code> element. (Youtube is used here as an example only. This question is about combining content from multiple different hosts in general.)</p>
<p>It seems that commonly <em>believed</em> solution is to require Cookie Consent on the host page. <strong>Why?</strong> The cookie is not set by the host document server. Its value cannot ever be seen by the server providing the host document for the <code>&lt;iframe&gt;</code> element even if the server administrator wanted to monitor their users.</p>
<p>To me, the obvious solution to the problem is that if <em>the embedded document</em> wants to save non-necessary cookies, <em>it</em> should provide the cookie consent before storing such cookies.</p>
<p><strong>Are there any prior decisions in some jurisdiction that specify that <em>host document</em> should request the cookie consent instead?</strong> And if so, how the host document is supposed to transfer information about this consent to embedded content hosting server? It doesn't sound reasonable to me that if your document is embbedded in a <code>&lt;iframe&gt;</code> element, you don't ever need the consent to set non-necessary cookies.</p>

<p>The <strong>data controller</strong> is responsible for GDPR compliance. For embedded content, case law such as the Fashion ID case indicates a <strong>joint controllership</strong> where both the controller of the embedding page and the controller of the embedded content are controllers. However, one can only be controller for processing activities where one has influence on the means and purposes of processing. So the controller of the embedding page is a controller with respect to the act of embedding (with purposes like <em>showing a video</em>), but they wouldn't be a controller for subsequent processing by that embedded content (with purposes like <em>tracking people across the web</em>).</p>
<p>For determining who is a controller, it is not too helpful to look at which servers sent which HTTP headers. Instead, look at which processing activities occur, for what purposes that processing is carried out, and who had input to determining these purposes. Those (natural or legal) persons are data controllers and are therefore responsible for compliance.</p>
<p>What does this mean for the example of embedding a Youtube video, Tweet, or Like button?</p>
<p>The <strong>controller of the embedding page</strong> needs a legal basis for sharing visitor's personal data with the embed provider. Such a sharing is inevitable due to the embedding, regardless of whether cookies are involved. Typically, the legal basis used here would be consent: in place of the embed, a placeholder is shown that lets visitors opt in to loading the content. In some cases, a legitimate interest argument might also work.</p>
<p>Whether the embedded content ends up using cookies is outside of the embedding page's control. Thus, I would think the <strong>controller of the embedded content</strong> would be the sole controller with respect to these cookies. Of course, no consent is required for the use of cookies when this use is strictly necessary to provide the service requested by the user, e.g. to add a video to a logged-in user's Youtube history.</p>
<p>The <strong>joint controllers</strong> can divide up compliance obligations among themselves. For example, the provider of the embed content could likely require embedders to collect necessary consents prior to embedding (Twitter has similar terms). However, this would be risky for the controller because controllers shall be able to demonstrate that valid consent was actually given.</p>
<p>So in <strong>conclusion</strong>, I largely agree with your analysis that the provider of the embedded content should consider cookie consent. With two caveats: the controllers might have an agreement that moves this responsibility to the embedder, and the embedding data controller might need consent to embed the content in the first place.</p>

gdpr consent multiple-jurisdiction