Vrbo is a vacation-rental marketplace app operated by HomeAway.com, Inc., a subsidiary of Expedia, Inc., under the Expedia Group corporate umbrella alongside Expedia, Hotels.com and Orbitz. Its (2022-dated, still-linked) privacy statement discloses broad account and booking-related collection — including government-issued ID, precise geolocation, and images including facial photographs — and describes routine sharing of personal information with other Expedia Group companies, third-party service providers, travel suppliers and business/marketing partners for interest-tailored advertising. The App Store privacy label confirms user-content data may be used to track users across other companies' apps and websites, and separately lists precise location, financial and contact info as linked to identity. Corporate ownership is well-documented: Expedia Group's FY2025 10-K names Vrbo as one of its core consumer brands. No privacy-specific breach, FTC action, or regulator fine was found; the 10-K describes a board-overseen, NIST-aligned cybersecurity program but no independent privacy audit specific to Vrbo.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
[2022-06-03] · COLLECTION
Vrbo's Privacy Statement (Last Updated June 3, 2022, archived copy) states that when using the platform, users' personal information collected includes government-issued identification for booking or identity verification, geolocation, and images including facial photographs, alongside payment information, travel-related preferences, loyalty program information, and birth date and gender.
Vrbo's own Privacy Statement (archived copy, June 3, 2022) identifies the company operating the service as a subsidiary of Expedia, Inc., naming the corporate parent directly in its opening paragraph.
Expedia Group, Inc.'s FY2025 Form 10-K (filed with the SEC 2026-02-13) lists Vrbo as one of its portfolio of B2C consumer brands, describing it as an online marketplace for alternative accommodations, alongside Expedia, Hotels.com and other portfolio brands including Orbitz.
Vrbo's Privacy Statement (archived copy, June 3, 2022) states personal information is shared within Expedia Group companies, with third-party service providers for purposes including business analytics and to 'serve you with advertising tailored to your interests,' with travel suppliers to fulfill bookings, and with third-party business partners for co-marketed programs and offers.
Expedia Group, Inc.'s FY2025 Form 10-K (Item 1C, Cybersecurity; filed 2026-02-13) states its cybersecurity risk-management program is based on industry-standard frameworks including NIST, with the Board of Directors and Audit Committee overseeing cybersecurity risk company-wide (including Vrbo); the filing's Legal Proceedings section (Item 3) describes only occupancy-tax litigation, with no privacy-specific breach or regulator action disclosed.
The Vrbo iOS App Store listing's App Privacy section states that User Content data may be used to track the user across apps and websites owned by other companies, and separately lists Identifiers, Device ID, Usage Data, Precise Location, Financial Info and Contact Info as data linked to the user's identity for purposes including Product Personalization and App Functionality.
The Cookie Statement embedded in Vrbo's Privacy Statement (archived copy, June 3, 2022) states that Expedia Group and its third-party advertising partners may use advertising cookies to show advertisements both on and off Vrbo's sites based on user interests, and that these third parties may combine information collected via cookies on Vrbo's sites with other information they have separately collected about the user.