Since we have to comply with the Cookie law in EU, one of the services setting cookies is YouTube. The so called privacy-enhanced mode is acceptable by the law cause it sets cookies after the user starts playing video.
The change in embed code is very small - the src attribute must be from domain youtube-nocookie.com. All the rest is the same.
I found that the embed code is generated in video_embed_field.handlers.inc in function called video_embed_field_handle_youtube($url, $settings).
I'm not very experienced in creating patches but an extra setting and small modification in output could give this functionality. If someone is interested to help on this, I would appreciate it.