Vimeo

Overview

Vimeo is a professional video hosting and streaming platform used by filmmakers, agencies, and businesses to host and embed high-quality video content. Unlike YouTube, Vimeo's standard embed does not serve behavioral advertising on third-party publisher sites, making it a more privacy-friendly choice for video embeds. Vimeo is operated by IAC and is based in New York. The platform offers tiered plans from free to enterprise, with the paid tiers removing ads entirely. Vimeo's embed API and JavaScript SDK allow developers to programmatically control playback and listen to player events.

What This Script Does

Script Files and Domains

Vimeo embeds load player assets from f.vimeocdn.com (Vimeo's CDN for player JS and CSS), player.vimeo.com (the iframe player endpoint), and fresnel.vimeo.com (analytics beacon endpoint). Video streams are delivered from skyfire.vimeo.com and Akamai CDN nodes. The Vimeo Player SDK (player.js) is loaded from player.vimeo.com/api/player.js when JavaScript API control is needed.

Iframe Embed (Standard)

The most common Vimeo integration uses an <iframe> pointing to https://player.vimeo.com/video/{video_id}. The iframe loads the player UI, buffers video segments, and operates within its own browsing context. Cookies set by the iframe are scoped to vimeo.com, not the embedding site.

Cookies Set

• vuid — Vimeo's visitor unique identifier. Persistent, 2-year expiry. First-party to vimeo.com. Tracks playback activity across Vimeo-hosted content for analytics. Not used for advertising on third-party sites.
• player — Session cookie storing player state (volume, quality preference). Expires on session end.
• __utmz, __utma — Legacy Google Analytics cookies set by Vimeo on the vimeo.com domain only (not on the embedding site).

Playback Event Tracking

The player fires events to fresnel.vimeo.com/pixel for internal Vimeo analytics: play start, pause, resume, seek, percentage completions (25%, 50%, 75%, 100%), and embed impression. These analytics help video owners understand audience engagement. No advertising profiles are built from this data on third-party sites.

JavaScript SDK Events

When using the Player SDK, developers can subscribe to events: play, pause, ended, timeupdate, progress, seeked, volumechange, fullscreenchange. The SDK communicates via postMessage between the parent page and iframe.

Do Not Track Parameter

Adding ?dnt=1 to the embed URL instructs Vimeo not to set the vuid cookie and not to track the playback session. This is the recommended parameter for maximum privacy compliance.

Consent & Compliance

Category: Functional

Vimeo's standard embed falls under the functional category because it serves user-requested video content without advertising tracking. The vuid cookie is set on vimeo.com's domain, not on the embedding site's domain, limiting its cross-site tracking impact.

Under GDPR and the ePrivacy Directive, whether a Vimeo embed requires consent depends on interpretation. The German DSK (Datenschutzkonferenz) issued guidance treating third-party embeds that set cookies as requiring consent unless strictly necessary. Using ?dnt=1 significantly reduces the privacy footprint, as it prevents the vuid cookie and disables analytics beacons. The Belgian DPA and several German DPAs have held that embedding YouTube (which does serve advertising cookies) requires consent, but Vimeo without advertising is treated more leniently.

Under CCPA, Vimeo's analytics data collection does not constitute a sale of personal information, and playback data is used for video owner analytics rather than third-party advertising.

Vimeo is registered under the EU-US Data Privacy Framework for transatlantic data transfers.

Should You Block This Without Consent?

Conditional. Standard Vimeo embeds without advertising do not require consent under most practical interpretations, particularly when the ?dnt=1 parameter is used. However, under strict ePrivacy readings (e.g., German DSK guidance), any third-party cookie requires prior consent. Best practice: use ?dnt=1 in embed URLs and load the player without a consent gate in most jurisdictions, or implement a click-to-load facade for maximum compliance.