Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Vimeo OTT, formerly VHX, is Vimeo over the top subscription product for selling and streaming video to your own audience. Its embeds and the Vimeo player set cookies such as vuid and sessionid that are used for analytics and logged in sessions, so prior consent is required under the GDPR and the ePrivacy Directive. Data is processed in the United States. Vimeo also offers a privacy enhanced embed and a dnt=1 player parameter that disable third party tracking cookies.
Vimeo OTT, previously known as VHX, is Vimeo over the top product for selling and streaming subscription video to your own audience, including video on demand, live events, and branded apps. Site owners embed the Vimeo player or the OTT storefront on their pages so that visitors can browse and watch content. When the player loads, the visitor browser connects to Vimeo domains, which deliver the video and may set cookies for analytics and session management.
In its standard mode the player sets cookies such as vuid, a Vimeo analytics visitor identifier that lasts about two years, player session cookies, _abexps for A/B experiments, and sessionid for logged in sessions on OTT storefronts. Alongside these cookies, Vimeo receives the visitor IP address, browser and device information, the referring page, and viewing behaviour. The vuid identifier is persistent and tied to a device, so the processing constitutes personal data under the GDPR.
Because the analytics cookies are written to and read from the visitor device for measurement rather than strictly necessary functions, Article 5(3) of the ePrivacy Directive requires prior consent in the standard configuration. The persistent vuid identifier and the IP address make the data personal under the GDPR, so a lawful basis, clear information, and an entry in your record of processing activities are required whenever tracking cookies are set.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In standard mode you must obtain prior opt in consent before the player loads. Vimeo also offers a Do Not Track mode through the privacy enhanced embed and the dnt=1 player parameter, which disables third party tracking cookies and limits analytics. If you use this mode and set no analytics cookies, consent may not be required for the cookie storage, although the connection to Vimeo and the resulting US transfer should still be disclosed. A click to load wrapper remains the most robust approach.
Vimeo processes data in the United States, so document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses. In practice, either enable the privacy enhanced embed with dnt=1 or gate the standard embed behind your consent management platform with a click to load wrapper, and list the Vimeo cookies and their durations in your cookie policy. Name Vimeo as a recipient, disclose the US processing, and review periodically because cookie names and durations can change.
Websites using Vimeo OTT must obtain user consent under GDPR regulations.
DPIA considerations
Vimeo OTT sets a persistent analytics identifier (vuid) lasting about two years, plus session and experiment cookies, and sends IP addresses and viewing behaviour to infrastructure in the United States. A DPIA should assess the scale of tracking through embedded players, the persistence of the vuid identifier, the international transfer to the US under the Data Privacy Framework, and retention. A key mitigation is the privacy enhanced embed with the dnt=1 parameter, which disables third party tracking cookies.
Sample consent text
We use Vimeo OTT to let you watch and subscribe to our videos. When you allow it, Vimeo places cookies on your device to measure usage and keep your session, and it may receive your IP address and device information. This content loads only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
vimeo.complayer.vimeo.comf.vimeocdn.com*.vhx.tvCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| vuid | analytics | 2 years | Vimeo analytics visitor identifier used to recognise the browser and measure video usage across sessions. Not set when the privacy enhanced embed or dnt=1 is used. |
| player session | functional | Session | Player session cookies that maintain playback state and preferences for the current viewing session. |
| _abexps | analytics | Session | Stores A/B experiment assignments so that Vimeo can test and optimise the player and storefront experience. |
| sessionid | functional | Session | Maintains the logged in session for users who sign in to an OTT storefront to access subscription content. |
Vimeo OTT uses cookies for user preferences — inform visitors with a consent banner.
In standard mode the Vimeo player and OTT storefront set cookies such as vuid, an analytics visitor identifier lasting about two years, player session cookies, _abexps for A/B experiments, and sessionid for logged in sessions. When the privacy enhanced embed or the dnt=1 parameter is used, Vimeo disables the third party tracking cookies.
In standard mode, yes. The analytics cookies such as vuid are not strictly necessary, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before the player loads. If you use the privacy enhanced embed with dnt=1 and set no analytics cookies, consent for cookie storage may not be required.
When tracking cookies are set, the storage and reading rely on consent under the ePrivacy Directive, and the processing of personal data such as IP addresses relies on consent under Article 6(1)(a) of the GDPR. With the privacy enhanced embed, the remaining processing should be assessed and a transfer disclosure still made.
Yes. Vimeo processes data in the United States, so IP addresses and the vuid identifier can be transferred there. Document the transfer under the EU US Data Privacy Framework, under which Vimeo is certified, and the Standard Contractual Clauses as a complementary safeguard.
A full DPIA is not always mandatory, but it is advisable when you embed Vimeo OTT widely or combine it with other tracking. Document the purposes, the vuid identifier and its duration, the international transfer to the US, and retention, and note the privacy enhanced embed as a key mitigation.
Either enable the privacy enhanced embed and add the dnt=1 parameter to the player URL so that no third party tracking cookies are set, or gate the standard embed behind your consent management platform with a click to load wrapper. List the Vimeo cookies in your cookie policy and disclose the US processing in your privacy notice.
Alternatives include self hosting video with a privacy friendly player, using a European video platform, or choosing another OTT provider with EU data residency. The Vimeo privacy enhanced embed itself is often the simplest way to keep Vimeo while reducing tracking, so the best choice depends on your monetisation and hosting needs.
List each Vimeo cookie such as vuid, _abexps, and sessionid with its purpose and duration, name Vimeo as a recipient, and disclose the transfer to the United States. State whether you use the privacy enhanced embed, and keep the entries in sync with a regular cookie scan because names and durations can change.