Written in December 2025. The UK Data Bill this article refers to is now law as the Data (Use and Access) Act 2025.
Plug-ins and embeds (YouTube videos, Instagram posts, maps, chat widgets, ad tags) are convenient. They're also one of the easiest ways to breach UK privacy rules by accident, because many of them connect the visitor's device to a third party the moment the page loads.
That's why a "privacy wall", a short message that loads the embed only after the visitor chooses to, is more than good practice. After the UK's 2025 data reforms it's still the most defensible way to stay compliant.
This article covers embeds specifically. For GA4 and consent more widely, the main guide from GA4 specialist Marc Alexander is GA4 and UK GDPR.
It's not only GDPR, it's PECR.
In the UK, cookies and similar tracking technologies sit mainly under PECR (the Privacy and Electronic Communications Regulations), with UK GDPR covering the personal data processing that usually follows.
The ICO's guidance says consent must be freely given, specific and informed, and must involve a positive action, not a note hidden in a privacy policy.
Plug-ins often do exactly what PECR is concerned with: storing or reading information on the device (cookies, local storage, identifiers), or letting third parties do so. The ICO calls these "storage and access technologies", and that includes third-party technologies loaded from domains other than the one the visitor is on.
What the 2025 reforms changed, and what they didn't.
What most people call the "UK Data Bill 2025" is now law as the Data (Use and Access) Act 2025 (DUAA). Government and ICO summaries say it updates parts of the UK's data protection and e-privacy framework, phased in between June 2025 and June 2026.
The cookie changes have applied since 5 February 2026, and the ICO's final guidance followed on 29 April 2026.
PECR now has narrow, named exceptions where some low-risk storage and access may not need consent. The ICO's updated guidance is clear that consent is still the default for anything not exempt, and that the exceptions are specific and conditional. They're not a licence to load third-party plug-ins by default.
Some commentary says the reforms "made cookies easier". Even where that's true for certain low-risk cookies, embeds rarely qualify. They're usually third-party, they may involve profiling, ad tracking or cross-site identifiers, and their behaviour changes when the vendor updates them. Treat them as exempt and you're betting your compliance on code you don't control.
Why embeds are a hotspot.
Most embedded services are more than content. When they load, they may:
- call the third party's servers, which then receive the visitor's IP address and browser and device details;
- place or read identifiers on the device;
- enable cross-site tracking or profiling, depending on the vendor and settings.
Even if you only meant to show a video, the plug-in can trigger storage and access that PECR regulates and processing that UK GDPR regulates. And once it has fired on page load, proving compliance after the fact is much harder.
Why ask before loading.
- Nothing loads until the visitor chooses. No cookies or similar technology are set early, and no third-party connection is made by default.
- Consent people understand. The visitor sees a clear message, gets a real choice and takes an unambiguous action ("Load content", "Always allow"), which is what the ICO expects from a consent mechanism.
- Better evidence. When content loads only after a click, you can log the choice, honour preferences and show that the site behaved correctly.
- Fewer accidents as the site changes. Teams add embeds all the time. A permission-first pattern makes it much less likely that a new one quietly opens a tracking route.
What good looks like.
- A short, clear explanation: "This content is hosted by X. Loading it may allow X to collect data about your activity."
- A genuine choice: "Load once", "Always allow", and an option to view it on the platform instead.
- Remembered preferences (optional, but helpful).
- A way to change your mind later, through consent settings or by clearing site storage.
Measuring the embeds, too.
Compliance is half the job. You also want to know whether anyone uses the embeds. Marc builds permission-before-load components for YouTube, Instagram and other plug-ins that keep third-party scripts from firing until the visitor chooses, then push clean dataLayer events once they do, for example:
- embed shown;
- "Load once" chosen versus "Always allow";
- "View on [platform]" clicked;
- embed loaded, or failed to load.
For video, tracking can go further after consent where appropriate: play, pause, progress milestones and completion. That gives you real reporting on content without undermining privacy. It can be added to an expert GA4 setup.