Learning Watch

Learning Watch on a filtered school network

For district IT: what to allow, why it is safe, and a narrower rule if your filter can do one. A student can run the network check on a school device to see what is blocked.

Learning Watch is a free site where teachers approve YouTube channels and videos and students watch only those, in YouTube’s embedded player. There are no student accounts and it collects no student data (privacy). YouTube’s terms require its own embedded player, so the videos must come from YouTube’s servers; Learning Watch cannot host or proxy them.

Hosts to allow

Host	Needed?	What it is
`learningwatch.org`	Yes	The site: class pages and the approved video lists.
`www.youtube-nocookie.com`	Yes	YouTube’s privacy-enhanced embed player (the player page, its scripts and its API calls).
`*.googlevideo.com`	Yes	The video data. Hostnames look like `rr3---sn-abc123.googlevideo.com` and change, so this has to be a wildcard.
`i.ytimg.com`	For thumbnails	Thumbnail images in the video lists. Videos still play without it.
`www.gstatic.com`, `fonts.gstatic.com`	Optional	Player icons and fonts.
`yt3.ggpht.com`	Optional	The channel’s small picture in the player.
`www.google.com`, `jnn-pa.googleapis.com`	Optional	YouTube’s checks against automated abuse.

Not needed, and can stay blocked: www.youtube.com, m.youtube.com, s.ytimg.com.

“Optional” means the player loads them, but in our test (Chrome, 2026-10-17) a video played for 90 seconds with all of them and www.youtube.com blocked. Most districts already allow the Google ones. YouTube changes its player, so if videos stop playing later, run the check again.

Why this is OK

YouTube itself stays blocked. Allowing the embed hosts does not open youtube.com: no YouTube search, home feed, recommendations, Shorts, comments or channel browsing. Links in the player that go to youtube.com (the title, the YouTube logo) hit your existing block.
www.youtube-nocookie.com is YouTube’s privacy-enhanced embed mode. Google says views in it are not used to personalize the viewer’s YouTube experience, and ads on those videos are not personalized (Google’s help page). Despite the name, the player can still use cookies or device storage under Google’s policies.
*.googlevideo.com only serves video data, through signed links that expire, issued to a player. There are no pages on it to browse or search.
i.ytimg.com serves thumbnails and other static images.
It’s the same plumbing your other tools use. YouTube videos embedded in Google Classroom, Google Slides, Edpuzzle and Nearpod play from the same googlevideo.com and ytimg.com servers; youtube-nocookie.com is the privacy-enhanced version of the same embed player. Many districts already allow most of this.
Restricted Mode still applies if you enforce it by DNS: Google’s list of hostnames to map to restrict.youtube.com includes www.youtube-nocookie.com.
On Learning Watch, students only find and play videos a teacher approved. Search on a class page searches only the teacher’s approved list, never YouTube. When a video ends, YouTube’s player can suggest more videos from the same channel (Learning Watch sets rel=0, so not from other channels).

The caveat. With hostname-only filtering, a student who types www.youtube-nocookie.com/embed/ plus a video ID into the address bar can play any video that allows embedding, as long as they already know its ID. There is still no search, feed or recommendations. The narrow rule below closes this.

The narrow rule (preferred)

Allow youtube-nocookie.com/embed/* only as a frame inside a Learning Watch page, and block every other /embed/ load. Leave the supporting hosts (*.googlevideo.com, i.ytimg.com and the optional ones) allowed for everyone: they serve nothing a student can navigate to.

Chrome extension filters

declarativeNetRequest, or a filter product whose extension supports initiator and resource-type conditions:

[
  { "id": 1, "priority": 2, "action": { "type": "allow" },
    "condition": { "urlFilter": "||youtube-nocookie.com/embed/", "initiatorDomains": ["learningwatch.org"],
                   "resourceTypes": ["sub_frame"] } },
  { "id": 2, "priority": 1, "action": { "type": "block" },
    "condition": { "urlFilter": "||youtube-nocookie.com/embed/", "resourceTypes": ["main_frame", "sub_frame"] } }
]

HTTPS-inspecting proxies

Allow a request to https://www.youtube-nocookie.com/embed/... only when its Referer is https://learningwatch.org/ (Learning Watch sends exactly its origin). If the Referer is missing or anything else, block it (fail closed). Other paths on www.youtube-nocookie.com are the player’s own scripts and API calls; their Referer is youtube-nocookie.com, so leave them allowed.

DNS and firewall (hostname-only) filters

These see only the hostname, not the path, the Referer or which page opened it, so they can only allow or block a whole host. They can do the host list above, with the caveat. If you also have a Chrome extension filter, put the narrow rule there.

Turn off DevTools for students

Chrome policy DeveloperToolsAvailability = 2 (in the Google Admin console, the student users’ Developer tools setting: “Never allow use of built-in developer tools”). On a Learning Watch page, a student with DevTools could edit the player’s video ID, and the request would still come from learningwatch.org. Many districts already set this.

Checking it

On a student device on school Wi-Fi, open learningwatch.org/check. It tests each host above from the browser, then plays a short muted video in the same player class pages use and reports whether it actually started. It sends nothing to Learning Watch: the results stay on the screen, and the student copies or screenshots them.

Questions: [email protected]. The same page is in the source code as docs/NETWORK.md.