I’m trying to serve HTML content that contains <iframe> element to embed content from YouTube. I would like to prevent YouTube from tracking my users on my site so I would want YouTube to be emdedded without cookies (practically anonymous) even if the visitor had already logged in to YouTube in another window.

I tried to use following HTTP header for my HTML document (also known as COEP header):

 Cross-Origin-Embedder-Policy: credentialless

but then Google Chrome version 129 refuses to load the YouTube into the iframe with following error in developer tools:

Status: blocked
To embed this frame in your document, the response needs to enable the cross-origin embedder policy by specifying the following response header:
Cross-Origin-Embedder-Policy: require-corp

I obviously cannot change YouTube to send this missing header. Is there some other way to configure my document to declare that the iframe content should be loaded as anonymous?

(The current COEP implementation seems like a chicken and egg problem for me; content that wants to embed cross-domain content cannot start to use Cross-Origin-Embedder-Policy: credentialless because domains do not send the require-corp value. And domains hosting content to be emdedded cannot start to emit Cross-Origin-Embedder-Policy: require-corp because that would break all sites that do not emit COEP header. It seems to me that the only way to start to use these headers would be a synchronous release which is not ever going to happen worldwide. I would assume that this wasn’t the original intention with these headers so I must have misunderstood something.)

I also see warning “Chrome is moving towards a new experience that lets people make an informed choice with respect to third-party cookies.” in the JavaScript console, but I guess this is related to 3rd party cookie handling in general, not this embedding problem.