Tumblr is a blogging and social platform owned by Tumblr, Inc., a wholly-owned subsidiary of the private company Automattic Inc. (founder Matt Mullenweg), which also owns WordPress.com, WooCommerce, Simplenote, Jetpack, Day One and other brands. Tumblr's privacy policy discloses account, device, and IP-derived location data collection, native-action tracking (likes, reblogs, follows) used to personalize ads, and identifier-level sharing with advertising partners that it treats as a 'sale'/'share' under U.S. state law. Apple's App Store privacy label confirms Tumblr uses location, contact info, identifiers and usage data to track users across other companies' apps and websites. In February 2024, Automattic's own blog confirmed it was entering data-licensing partnerships with AI companies (reported by press as OpenAI and Midjourney) to train models on public Tumblr/WordPress.com content, with an opt-out that is honored going forward but was not opt-in by default. Tumblr publishes a government-request transparency report with concrete counts and a stated policy of only responding to valid legal process, though the most recent published edition found covers Jan-Jun 2021, and no active regulator enforcement action or breach was found in the sources checked.
TRACK RECORD
1 BREACH
[2013-02-28] · BREACH
Have I Been Pwned lists a breach record for Tumblr: "tumblr".
Approximately 65,469,298 accounts affected, per HIBP.
Tumblr's privacy policy (last modified 2026-06-03) states it may collect and store information related to a user's mobile device, including a generated or assigned unique device identifier, alongside account information (username, age, email) and IP-address-derived approximate location, and uses on-platform native actions (likes, reblogs, replies, follows) to build interest inferences used for personalized content and targeted advertising.
Automattic's About page states the company is behind WordPress.com, WooCommerce, Tumblr, Simplenote, Jetpack, Longreads, Day One and Pocket Casts, with 1,435 employees ('Automatticians') globally; the page's structured author data separately names Matt Mullenweg as co-founder of WordPress and founder of Automattic.
Tumblr's privacy policy states directly that Tumblr is a wholly-owned subsidiary of, and a member of the family of companies of, Automattic, and that Automattic and the rest of that family of companies may receive and share information with Tumblr.
Automattic's own company blog, in a February 27, 2024 post, confirmed it was 'working directly with select AI companies' and would share public content hosted on WordPress.com and Tumblr with those partners from sites that had not opted out, with opt-outs honored on a rolling basis going forward.
Engadget reported on February 27, 2024, citing 404 Media, that Tumblr and WordPress were entering deals to provide user content to AI companies OpenAI and Midjourney for model training, ahead of Automattic's own confirmation and opt-out tool rollout the same week.
Tumblr's privacy policy states that to select which ads to show, it may share some user information -- including online identifiers, device/cookie identifiers, IP address and approximate geolocation -- with advertising partners, and that this data sharing may be considered a 'sale' or 'share' under some U.S. state privacy laws.
Have I Been Pwned's breach catalog lists the "tumblr" incident (tumblr.com), breach date 2013-02-28, affecting approximately 65,469,298 accounts. Data classes exposed per HIBP: Email addresses, Passwords. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Automattic's transparency report for Tumblr states the company does not voluntarily grant government agencies access to user data for law enforcement, intelligence, or surveillance purposes and discloses information only in response to valid legal process (subpoena, search warrant, or court order); the most recently published edition (covering January-June 2021) lists 287 total government data requests and 473 specified accounts, with the large majority of subpoenas and search warrants receiving some data disclosure.
The Tumblr app's App Store privacy label, submitted by the developer Tumblr, Inc., states that location, contact info, identifiers and usage data may be used to track the user across apps and websites owned by other companies, in addition to first- and third-party analytics/advertising data collection.