Embedded YouTube video probably not GDPR compliant

Bug description

I embedded a YouTube video on a website using the following code:

{{< video https://www.youtube.com/embed/bRFHyI6hnNk >}}

I also set the cookie-consent policy in _quarto.yml to the most restrictive level:

website:
    cookie-consent:
        type: express

What I then discovered was that it was possible to interact with the YouTube video even if I had not consented to non-essential cookies. As I understand the situation, YouTube will process my personal data as soon as I interact with the embedded video (see for example https://axbom.com/embed-youtube-videos-without-cookies/). If the cookie-consent type is set to "express" I don't think that this should be possible, unless I have explicitly given the consent.

Steps to reproduce

See the bug description above.

Expected behavior

If the cookie consent-type for the website is set to "express", the user should not be able to interact directly with the embedded YouTube video, unless first accepting YouTube's terms and conditions.

Actual behavior

A user can interact with the embedded YouTube video even if all cookie types except "strictly necessary cookies" are set to "Inactive".

Your environment

• MacOS Sonoma 14.2
• Safari 17.2.1

Quarto check output

[✓] Checking versions of quarto binary dependencies...
      Pandoc version 3.1.1: OK
      Dart Sass version 1.55.0: OK
[✓] Checking versions of quarto dependencies......OK
[✓] Checking Quarto installation......OK
      Version: 1.3.450
      Path: /Applications/quarto/bin

[✓] Checking basic markdown render....OK

[✓] Checking Python 3 installation....OK
      Version: 3.10.12 (Conda)
      Path: /opt/homebrew/Caskroom/miniforge/base/bin/python
      Jupyter: (None)

      Jupyter is not available in this Python installation.
      Install with conda install jupyter

[✓] Checking R installation...........OK
      Version: 4.3.2
      Path: /Library/Frameworks/R.framework/Resources
      LibPaths:
        - /Library/Frameworks/R.framework/Versions/4.3-arm64/Resources/library
      knitr: 1.45
      rmarkdown: 2.25

[✓] Checking Knitr engine render......OK

Start by reproducing the embedded video from the issue using the shortcode and the cookie-consent setting in _quarto.yml, with non-essential cookies inactive. Check whether the video remains interactive before consent. Done means an express-consent site prevents direct YouTube interaction until the user accepts the relevant terms.