What is the __Secure-ROLLOUT_TOKEN cookie?
Estimates a user's bandwidth and enables personalized recommendations and advertising when viewing embedded YouTube videos.
Table of Contents
About __Secure-ROLLOUT_TOKEN
| Vendor | |
|---|---|
| Cookie Domain | youtube.com |
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Social Media |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 28.3% of scanned pages |
| Expiration Type | Timestamp |
| Expiration Duration | 27 days |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | 3rd-Party |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Medium |
| Vendor Privacy Policy | https://policies.google.com/technologies/cookies |
| Vendor Website | https://about.google/ |
What is the purpose of __Secure-ROLLOUT_TOKEN?
The __Secure-ROLLOUT_TOKEN cookie is a third-party persistent cookie set by Google when YouTube videos are embedded on a webpage. It contains a randomly generated token that assigns the user to a specific test group or cohort.
Google uses this cookie to manage the staged release of new YouTube features, conduct A/B testing, and track user interactions with interface changes. Per Google's official documentation, YouTube uses it to launch new features and measure their related impact when other existing cookies and identifiers cannot be used for the same purpose. By keeping track of the user's assigned group, the cookie ensures that the user receives a consistent visual and functional experience across sessions during an ongoing test, allowing Google to measure the impact and stability of the rollout before it is deployed globally.
What are the Privacy Risks of __Secure-ROLLOUT_TOKEN?
Risk Level: Medium
This cookie contains a persistent, unique identifier used to allocate users to specific feature-testing cohorts. While its primary purpose is functional (A/B testing and feature rollout management), it is set in a third-party context across any website that embeds YouTube videos. Because this allows Google to track user behavior across multiple independent sites and potentially associate this pseudonymous data with broader behavioral profiles or an authenticated Google account, it represents a medium privacy risk.
How to Remove __Secure-ROLLOUT_TOKEN from a Website
Website administrators cannot disable this cookie independently if they wish to use standard YouTube video embeds. To remove the cookie entirely, the site operator must remove all YouTube video iframe embeds and the YouTube API script from the page. Alternatively, administrators can enable YouTube's privacy-enhanced mode by updating their iframe embed URLs to use the www.youtube-nocookie.com domain instead of www.youtube.com; this typically prevents YouTube from setting tracking and analytical cookies until the visitor actively interacts with the video player.