Does embedding Vimeo require cookie consent?

Conditional. Standard Vimeo embeds set the vuid cookie (2-year visitor ID) on vimeo.com. Adding ?dnt=1 to the embed URL disables the vuid cookie and analytics beacons, allowing the player to load without consent in most jurisdictions under a functional basis.

What does Vimeo track when embedded?

Vimeo loads player assets from f.vimeocdn.com and player.vimeo.com, setting vuid (2-year, vimeo.com) and player (session state). Playback events — play, pause, seek, completion percentages — are sent to fresnel.vimeo.com for video owner analytics. No advertising cookies are set.

How does ConsentStack categorize Vimeo?

ConsentStack classifies Vimeo as functional. Using ?dnt=1 in embed URLs is strongly recommended — it disables the vuid cookie and analytics beacons. ConsentStack can load Vimeo without a consent gate when ?dnt=1 is applied, or gate it on functional consent otherwise.

What tracker domains does Vimeo use?

ConsentStack has catalogued tracker domains for Vimeo including vimeo.com and vimeocdn.com. These are the network destinations Vimeo's scripts contact, which a consent platform blocks until a visitor agrees.

Vimeo (vimeocdn.com) - Video Embed Privacy & Consent Classification

Back to Vendor Library

Overview

Vimeo is a professional video hosting and streaming platform used by filmmakers, agencies, and businesses to host and embed high-quality video content. Unlike YouTube, Vimeo's standard embed does not serve behavioral advertising on third-party publisher sites, making it a more privacy-friendly choice for video embeds. Vimeo is operated by IAC and is based in New York. The platform offers tiered plans from free to enterprise, with the paid tiers removing ads entirely. Vimeo's embed API and JavaScript SDK allow developers to programmatically control playback and listen to player events.

What This Script Does

Script Files and Domains

Vimeo embeds load player assets from f.vimeocdn.com (Vimeo's CDN for player JS and CSS), player.vimeo.com (the iframe player endpoint), and fresnel.vimeo.com (analytics beacon endpoint). Video streams are delivered from skyfire.vimeo.com and Akamai CDN nodes. The Vimeo Player SDK (player.js) is loaded from player.vimeo.com/api/player.js when JavaScript API control is needed.

Iframe Embed (Standard)

The most common Vimeo integration uses an <iframe> pointing to https://player.vimeo.com/video/{video_id}. The iframe loads the player UI, buffers video segments, and operates within its own browsing context. Cookies set by the iframe are scoped to vimeo.com, not the embedding site.

Cookies Set

vuid — Vimeo's visitor unique identifier. Persistent, 2-year expiry. First-party to vimeo.com. Tracks playback activity across Vimeo-hosted content for analytics. Not used for advertising on third-party sites.
player — Session cookie storing player state (volume, quality preference). Expires on session end.
__utmz, __utma — Legacy Google Analytics cookies set by Vimeo on the vimeo.com domain only (not on the embedding site).

Playback Event Tracking

The player fires events to fresnel.vimeo.com/pixel for internal Vimeo analytics: play start, pause, resume, seek, percentage completions (25%, 50%, 75%, 100%), and embed impression. These analytics help video owners understand audience engagement. No advertising profiles are built from this data on third-party sites.

JavaScript SDK Events

When using the Player SDK, developers can subscribe to events: play, pause, ended, timeupdate, progress, seeked, volumechange, fullscreenchange. The SDK communicates via postMessage between the parent page and iframe.

Do Not Track Parameter

Adding ?dnt=1 to the embed URL instructs Vimeo not to set the vuid cookie and not to track the playback session. This is the recommended parameter for maximum privacy compliance.

Consent & Compliance

Category: Functional

Vimeo's standard embed falls under the functional category because it serves user-requested video content without advertising tracking. The vuid cookie is set on vimeo.com's domain, not on the embedding site's domain, limiting its cross-site tracking impact.

Under GDPR and the ePrivacy Directive, whether a Vimeo embed requires consent depends on interpretation. The German DSK (Datenschutzkonferenz) issued guidance treating third-party embeds that set cookies as requiring consent unless strictly necessary. Using ?dnt=1 significantly reduces the privacy footprint, as it prevents the vuid cookie and disables analytics beacons. The Belgian DPA and several German DPAs have held that embedding YouTube (which does serve advertising cookies) requires consent, but Vimeo without advertising is treated more leniently.

Under CCPA, Vimeo's analytics data collection does not constitute a sale of personal information, and playback data is used for video owner analytics rather than third-party advertising.

Vimeo is registered under the EU-US Data Privacy Framework for transatlantic data transfers.

Should You Block This Without Consent?

Conditional. Standard Vimeo embeds without advertising do not require consent under most practical interpretations, particularly when the ?dnt=1 parameter is used. However, under strict ePrivacy readings (e.g., German DSK guidance), any third-party cookie requires prior consent. Best practice: use ?dnt=1 in embed URLs and load the player without a consent gate in most jurisdictions, or implement a click-to-load facade for maximum compliance.

Is Vimeo GDPR compliant?

Vimeo typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Vimeo can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Vimeo, not on Vimeo itself.

Visit website

Consent Categories

Functional

Also Known As

Vimeo embedVimeo playerVimeo cookieVimeo GDPRvideo embed cookieVimeo APIprofessional video hosting

Industries

Computers Electronics and TechnologyProgramming and Developer Software

Tracked Domains (2)

Vimeo's trackers are occasionally seen, seen on about 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

vimeo.comEssential

vimeo.com is an essential domain operated by Vimeo, used to keep the site working, including security, load balancing, and sessions. Seen on about 1% of scanned sites.

vimeocdn.comEssential

vimeocdn.com is an essential domain operated by Vimeo, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.