By John Cookie · Published 4 October 2026
A page can have a well-designed banner while a video, map or widget loads through a separate route. Test the embed itself, not just the banner.
Download the worksheet
A blank, editable text template for recording your test conditions, evidence, findings and retest actions. Open it in your text editor or paste it into your project notes. No sign-up required.
Download embedded content testing worksheet (TXT)Version 4 October 2026. Blank fields are not a pass; record what was tested and what remains unknown.
List the embeds and their entry points
Choose a page containing each type of embed: video, map, social feed, booking tool, chat widget or third-party form. Record the provider, installation method and trigger. Does it load on page view, when scrolled into view, after a button click or only after a category is accepted?
Include external thumbnails, scripts and helper libraries. A locally displayed placeholder can still request an image from the provider. A “privacy-enhanced” or “lazy-load” setting describes one configuration choice; it does not replace observation of the complete page.
Run the same five journeys
- Fresh visit: open Developer Tools before loading. Leave the banner untouched and note provider requests and browser storage.
- Reject: use a clean independent run, reject optional categories and scroll to the embed. Record whether scrolling causes loading.
- Activate: inspect the explanation and action offered by the placeholder. Record what changes when the visitor chooses to load the content.
- Accept: in a separate run, accept the relevant category and compare functionality, requests and storage.
- Withdraw: change a previous choice, then navigate or reload. Record whether future provider loads follow the updated choice.
Do not enter real booking, payment or customer information while testing. Record consent category choices separately from clicks needed simply to operate the media. Where a click requests a service, the website team should assess the relevant purpose and any applicable exemption rather than assuming the same answer for every embed.
Use an embed evidence sheet
| Field | What to enter |
|---|---|
| Page and embed | Exact URL, provider, widget type and installation owner |
| Browser state | Date, browser, stored-choice reset, region and extensions |
| Before choice | Requests, cookies or other storage observed, and loading trigger |
| After rejection | Whether the placeholder, scrolling or another action contacts the provider |
| After activation | Button wording, information shown and subsequent behaviour |
| After withdrawal | Later loads, saved preference and functions still available |
| Outcome | Observed, needs investigation or not tested, with evidence references |
Patterns worth investigating
A map in the footer may appear on every page even when only the contact page was intended to use it. A video helper script may load before a placeholder is activated. A plugin may rebuild an iframe after navigation. These are test hypotheses, not findings about a particular provider or website.
If a placeholder is the intended control, check that its wording explains the provider and consequence, that keyboard users can activate it, and that the user can continue without loading it. Provide a useful alternative where appropriate, such as an address or an external video link. Retest on mobile because responsive templates can use different embed code.
Interpret purpose and behaviour separately
The ICO’s storage and access technologies guidance addresses more than cookies. Your assessment should consider the actual purpose and technology. A network request is evidence of contact with an endpoint; it does not alone prove a cookie was written or settle all data-protection questions.
For YouTube, consult the official embedded-player documentation when checking configuration. Autoplay is especially worth including in the test because playback may begin on page load. Do not substitute a setting name for evidence of the requests and storage actually observed.
See the WordPress checklist and tracking-before-consent guide for broader checks. For help tracing an embed outside your banner controls, discuss a cookie banner audit.
Practical website guidance. Tests are limited to the conditions recorded; this is not legal advice or formal compliance certification.