After some research, I discovered that YouTube offers a privacy-enhanced way of embedding videos. Instead of linking to youtube.com, link to youtube-nocookie.com, and no data-collecting HTTP cookie will be sent. This is Google’s way of providing GDPR-compliant YouTube videos.
Time to go update your links. This ties in with removing Google Analytics from sites that don’t benefit much from the tracking.