Vimeo is a video hosting and creation platform on an ad-free subscription (SaaS) model that was a NASDAQ-listed public company (VMEO) until Bending Spoons US Inc. completed its acquisition of Vimeo, Inc. on November 24, 2025, per an SEC Form 8-K, leaving Vimeo a wholly-owned private subsidiary of Italy's Bending Spoons S.p.A. Vimeo's own privacy policy discloses that it collects technical/device data and that third parties may also collect information when users use its services, and its cookie policy states that its iOS/Android apps use tracking technologies that users "cannot opt out of" short of deleting the app. The policy describes sharing data with "authorized vendors" and states Vimeo may combine user data with information from advertising partners to place relevant ads, and Apple's App Store privacy label confirms identifiers/device IDs are used for the developer's own advertising, marketing, and analytics purposes (though, unlike some ad-supported peers, the label does not declare a "track you across apps" category). In 2023 Vimeo paid a $2,250,000 settlement fund in an Illinois BIPA class action (Acaley v. Vimeo.com, Inc.) alleging it collected and stored facial biometric data from photos/videos uploaded to its Magisto app without proper notice and consent, without admitting wrongdoing.
TRACK RECORD
1 BREACH
[2026-04-28] · BREACH
Have I Been Pwned lists a breach record for Vimeo: "Vimeo".
Approximately 119,167 accounts affected, per HIBP.
Vimeo's Privacy Policy (last updated September 19, 2025) states that Vimeo collects information about users when they use its services, and separately discloses that third parties may also collect information about users when they use Vimeo's services.
Vimeo, Inc.'s Form 8-K, filed with the SEC on November 24, 2025, states that Bending Spoons US Inc. completed its acquisition of Vimeo, Inc. that day pursuant to a Merger Agreement dated September 10, 2025, with Vimeo continuing as the surviving corporation and becoming a direct wholly-owned subsidiary of Bending Spoons US (itself affiliated with the Italian company Bending Spoons S.p.A., a party to the merger agreement).
Vimeo's Privacy Policy states that beyond user-instructed disclosures and vendor sharing needed to operate the service, Vimeo may obtain data about users from third parties and combine it with data it has collected, giving the example that advertisers or advertising platforms may allow Vimeo to determine what other online services a user might use in order to place relevant ads on those services.
The court-supervised settlement website for Acaley v. Vimeo.com, Inc. (Circuit Court of Cook County, Illinois, Case No. 2019-CH-10873), archived via the Wayback Machine after the live site stopped resolving, states that the settlement resolved claims that Vimeo violated Illinois law by collecting and storing biometric data of Illinois residents who appeared in photos/videos on its Magisto app without proper notice and consent, that Vimeo denied violating any law, and that the court entered a Final Order and Judgment approving the $2,250,000 settlement fund on August 4, 2023.
Have I Been Pwned's breach catalog lists the "Vimeo" incident (vimeo.com), breach date 2026-04-28, affecting approximately 119,167 accounts. Data classes exposed per HIBP: Email addresses, Names. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The Vimeo iOS app's Apple App Store privacy label (fetched live) discloses that data linked to a user's identity — including contact info, identifiers, and a device ID — may be used for the developer's own advertising or marketing purposes as well as analytics, distinct from the App Functionality and Product Personalization categories also listed.
Vimeo's Cookie Policy (last updated June 25, 2024) states that Vimeo's mobile apps for iOS and Android do not use cookies but do use tracking technologies to authenticate users, enable app features, and understand app usage, and that users cannot opt out of these mobile tracking technologies except by deleting the app and using the web version instead.