GDPR iFrame for TYPO3

Embedding YouTube videos or Google Maps without consent violates the GDPR and exposes you to claims

Every iframe embed of an external service sends the visitor’s IP address to the service provider before the visitor has interacted with anything. A YouTube video on the home page sends the IP address to Google as soon as the page loads, a Google Maps map sends it to Google, a Facebook widget sends it to Meta. Without the visitor’s prior consent, the legal basis under Art. 6(1)(a) GDPR is missing, and the transfer violates the GDPR. For the cookies these services set, the legal position has been clear since the CJEU’s Planet49 ruling (2019), and in Germany also since the Federal Court of Justice’s 2020 ruling on cookie consent: anything that is not technically necessary requires active, informed consent. (UK: Post-Brexit, the UK GDPR and the PECR cookie rules set comparable requirements.) (US: No federal law requires prior consent; state laws such as California’s CCPA/CPRA rely mainly on notice and opt-out.)

udg_gdpr_iframe implements the two-click (click-to-load) solution for TYPO3: iframes load only after the visitor explicitly clicks. A placeholder shows which service will be loaded and which data will be transferred.

YouTube, Google Maps and social media embeds are the usual suspects

The most common scenario is YouTube videos on corporate websites. A company shows a recruiting video on its careers page. Without a consent solution, the page sends every visitor’s IP address to Google on each visit. With udg_gdpr_iframe, the visitor sees a placeholder instead of the video: a preview image, the notice “This video is provided by YouTube. Playing it transfers data to Google.” and a “Load video” button. Only after the click does the iframe load and the video play.

A second scenario is the Google Maps map on the contact page. The directions map is a standard element, but also a data protection risk. udg_gdpr_iframe shows a static map image (a screenshot) as a placeholder instead. Visitors who need the interactive map click “Load map” and thereby accept the data transfer to Google.

Third scenario: social media embeds. A blog post quotes a tweet or an Instagram post. These embeds also load external resources and transfer user data. udg_gdpr_iframe blocks the embed and shows a placeholder that names the service and displays a preview text.

Technically, placeholders and a JavaScript loader replace the iframes

The extension registers a content element or modifies existing TYPO3 content elements that contain iframes. In the HTML, the iframe’s src attribute is replaced with a data-src attribute. The browser does not load the iframe, because the src attribute is missing. Instead, a placeholder div shows the service name, the privacy notice and an activation button.

When the button is clicked, a JavaScript snippet copies data-src into the src attribute, and the browser loads the iframe. Optionally, the visitor can tick an “Always load” checkbox that stores the decision in LocalStorage. On later visits, the iframe then loads without further interaction.

The placeholder is configurable via a Fluid template: preview image (for example the YouTube thumbnail), text, button label and a link to the privacy policy. For YouTube videos, the extension can fetch the thumbnail automatically from the YouTube API. That is only privacy-compliant if TYPO3 downloads the image on the server and serves it itself: if the browser loads it directly from YouTube, the IP address goes to Google as well.

Integration with existing consent management platforms (Cookiebot, OneTrust) is possible through the JavaScript API: if the visitor has consented to the “Marketing” category in the cookie banner, all marketing iframes load automatically, without the two-click step.

The typical problems are catching every iframe and integrating the CMP

The biggest problem is detecting every single iframe on the website. Editors embed iframes not only through content elements but also directly in the RTE (rich text editor), in Fluid templates and in TypoScript. The extension has to cover all these sources. A common mistake: the content elements are protected, but a YouTube iframe in the footer template keeps loading without consent. The fix: after installation, crawl the entire website and identify every iframe source.

Second problem: integration with consent management. If the website already uses Cookiebot or OneTrust, conflicts can arise: the CMP blocks the iframe with its own mechanism, and udg_gdpr_iframe blocks it a second time. The result: duplicate placeholders, or an iframe that still does not load after consent was given in the CMP. The fix: use either udg_gdpr_iframe or the CMP to block iframes, never both.

Third issue: accessibility. The placeholder has to work with screen readers: the button needs an aria-label, the privacy notice has to be real text (not an image), and keyboard navigation has to work.

TYPO3 v12 is supported, and the extension stays relevant as long as iframes exist

udg_gdpr_iframe solves a problem that becomes more relevant with every new interpretation of the GDPR. The extension runs stably under TYPO3 v12. For v13, the content element registration and the JavaScript loader need an update. Because the core functionality (replacing the iframe src with data-src) is technically trivial, the extension can be ported to any TYPO3 version with little effort if needed. In data protection audits, Gosign checks that every iframe is covered and recommends the solution that fits the website’s existing consent management.