I found this topic after concerns have been raised by our users. Discourse loads content from Youtube (the image of the video) without the users consenting… Also we cannot show any information to the user what it means when he/she clicks on the video. So I doubt, this is a valid consent to transmit information to Youtube as Discourse will load more scripts etc. from Youtube.
Is there any solution to make Discourse GDPR compliant other than deactivating OneBoxing?
Strictly speaking, also embedding images from third party URLs is problematic. Can this even be disabled?