LfDI Baden-Würt­tem­berg: Inte­gra­ti­on of vide­os into own websites

The Sta­te Com­mis­sio­ner for Data Pro­tec­tion and Free­dom of Infor­ma­ti­on of Baden-Würt­tem­berg (LfDI Baden-Würt­tem­berg) has issued a Gui­de for inte­gra­ting vide­os into your own web pages published.

Unsur­pri­sin­gly, the LfDI initi­al­ly recom­mends data-saving vari­ants, i.e. in the case of own vide­os own hosting – as is also pos­si­ble for fonts – or an alter­na­ti­ve such as Peer­Tu­be. Other­wi­se, the LfDI sees a fun­da­men­tal requi­re­ment for con­sent for own vide­os, among other things also against the back­ground of, among other things, the Fashion ID judgment. For this pur­po­se, the LfDI recom­mends the fol­lo­wing solution:

With the help of a so-cal­led two-click solu­ti­on, it is in prin­ci­ple pos­si­ble for the web­site ope­ra­tor, as the joint­ly respon­si­ble par­ty with the video plat­form ope­ra­tor, to obtain con­sent from the visi­torsinsi­de. First, a pre­view of the exter­nal con­tent is dis­play­ed – wit­hout trans­mit­ting the IP address, brow­ser infor­ma­ti­on or other per­so­nal infor­ma­ti­on to third par­ties. Only when visi­torsinsi­de actively click on the pre­view, for exam­p­le, to watch a video, their data is transmitted.

At for­eign vide­os a con­sent requi­re­ment also applies:

If web­site ope­ra­tors embed third-par­ty vide­os from com­mer­cial video plat­forms or third-par­ty web­sites wit­hout joint respon­si­bi­li­ty pur­su­ant to Art. 26 of the GDPR, refe­rence must be made to the Two-click solu­ti­on in the fol­lo­wing vari­ant: First, a pre­view should be dis­play­ed with a hint to the exter­nal con­tent that fol­lows. This hint should inform the visi­torThe user must make it clear that when the embedded video is play­ed, for exam­p­le, the plat­form ope­ra­tor recei­ves the infor­ma­ti­on about who has just cal­led up which web page, and that it is pos­si­ble to link this infor­ma­ti­on to exi­sting data.
Only when visi­torsinsi­de actively click on the pre­view, for exam­p­le, to watch a video, the video plat­form ope­ra­tor or third par­ties may recei­ve the IP address, brow­ser infor­ma­ti­on or other per­so­nal information.

The LfDI other­wi­se refers to the Ger­man TTDSG as well as data pro­tec­tion requi­re­ments in con­nec­tion with the con­tent of videos.