GDPR Proxy

[basti]

Hello,

we have a website with some embedded content to YT. So the idea is to 
setup a GDPR Proxy.

Setup:

User Client -> example.com (embedded content media.example.com) -> YT

So YT only can see the IP of media.example.com.

What's about cookies?
Can YT track the 'User Client'?

Something like that should be enough, I think:

location /media/(.*)$ {
    proxy_pass https://media.example.com;
    proxy_redirect off;
    proxy_cache off;
    proxy_hide_header X-Real-IP;
    proxy_hide_header X-Forwarded-For;
}

Did I miss something?
Sometimes I see
proxy_set_header Host $upstream_host;

But I have not found any info what $upstream_host stands for.

Best regards,