Reference · 8 min
YouTube Playlist Privacy Levels Explained (Public, Unlisted, Private)
Public, unlisted, and private — what each YouTube playlist privacy level actually means, what a downloader can and can't do with them, and why 'bypass' tools are always phishing.
Public · Unlisted · Private
What each level allows a downloader to do
YouTube offers three playlist visibility levels: public, unlisted, and private. Understanding what each means — and, importantly, what each does not mean — clarifies exactly what any playlist downloader can realistically do, and what it can't do no matter what its landing page promises.
The short version: public and unlisted playlists are both accessible to a URL-based downloader, because the URL is the credential. Private playlists are only accessible to the owner, and any tool claiming to 'bypass' that is either lying or asking for your login credentials. Neither outcome is good.
Public playlists — the default open bucket
Public playlists are indexed by YouTube's search, reachable by anyone, and appear on channel pages, in the sidebar of related videos, and in the recommendations engine. Every downloader worth its name handles them without any friction — the URL is all it needs.
Almost all channel-created playlists (Best Of, Full Episodes, Season 1) are public. Most user-created playlists are too. If you can share the link on Twitter and a stranger can open it, it's public.
Private playlists — visible to the owner only
Private playlists are visible only to the account that created them and to explicitly invited Google accounts. YouTube's server-side authorisation blocks unauthorised access at the API level — no amount of clever URL parsing can get around that, because the API returns 'access denied' before any playlist metadata is exposed.
A tool that claims to 'bypass' privacy is either lying (it will silently fail) or asking for your YouTube password (in which case it's phishing your credentials to log in as you). Neither is a good sign, and both should send you closing tabs.
Red flags when a tool asks for login
Any tool that asks for your YouTube password directly is not legitimate. Full stop. Legitimate tools work through the URL, or through OAuth on Google's own login page (which is instantly recognisable). If you're being asked to type your Google password into someone else's form, close the tab.
- ■It asks for a YouTube or Google password directly (never legitimate)
- ■It asks you to install a browser extension with 'read all your data' permissions
- ■It offers to 'bypass' private videos or private playlists
- ■It stores your session tokens 'for convenience' between visits
- ■It has no privacy policy or a copy-pasted generic one
- ■It's a Chrome extension with fewer than 100 reviews and vague publisher info
How to download your own private playlist safely
The safe, honest path: sign into YouTube in the same browser session you're using to download, copy the private playlist URL from the address bar, and use it with any URL-based downloader that supports session cookies. Ownership does the authentication for you.
For CLI users, yt-dlp supports cookie-based auth via --cookies-from-browser chrome (or firefox, safari, etc.). That reuses your existing browser session without ever asking you to hand over a password. It works for your own private content and nothing else — which is exactly the right threat model.
§yt-dlp cookie recipe for private content
- Sign into YouTube in your normal browser (Chrome, Firefox, etc.)
- Confirm the private playlist loads for you when signed in
- Run: yt-dlp --cookies-from-browser chrome <private-playlist-url>
- yt-dlp reads your session cookies, passes them to YouTube, and downloads as you
- No password ever leaves your machine
What YouTube can and can't see
One privacy-adjacent question: does YouTube notify creators when videos are downloaded? No. Views are counted, but the specific act of downloading versus streaming isn't tracked or attributed at the creator level. Creators see aggregate view counts and rough traffic sources, not individual sessions.
That said, everything you do on YouTube while signed in is associated with your account for personalisation and ad targeting. Downloading from a signed-in session is normal; downloading from a signed-out session is normal; both are equally private from the creator's perspective.
Frequently asked questions
Can I download my own private playlist?+
Yes — sign into YouTube in the same browser, export the playlist URL, and any URL-based downloader that supports session cookies works. Ownership does the authentication for you. yt-dlp with --cookies-from-browser is the cleanest way to do this on the CLI.
Are unlisted playlists really private?+
No. Anyone with the URL can view them. Treat unlisted as 'obscure' not 'secret' — if the URL leaks (email forwards, screenshots), the content is fully visible to whoever finds it.
Does YouTube notify creators of downloads?+
No. Views are counted, but the specific act of downloading versus streaming isn't tracked or attributed. Creators see aggregate view counts, not individual sessions.
Can a downloader see my YouTube history if I use it?+
Only if you sign in through the tool's form (which you should never do) or install its browser extension with broad permissions. URL-only tools have no access to your account, history, or watch data.
What if a private playlist is shared with me by another account?+
You can view it when signed into the invited account. Whether you can download depends on the tool — yt-dlp with cookies works; most browser tools that don't handle auth won't. The rights side is trickier: you're viewing at the owner's invitation, not archiving at their request.