Vrbo integrates 41 third-party SDKs spanning analytics, infrastructure, and advertising. Its App Store privacy label declares cross-app tracking via User Content. It collects data linked to your identity including Purchases, Financial Info, Location, and Contact Info and 4 more categories. It includes 6 advertising or attribution SDKs. Whether this is acceptable depends on your personal privacy preferences.

What permissions does Vrbo need?

Vrbo requests 6 iOS permissions: App Tracking Transparency, Camera, Photo Library, Location (When In Use), Location (Always & When In Use), and Calendars.

What data does Vrbo collect?

According to its App Store privacy label, Vrbo declares cross-app tracking via User Content. It collects data linked to your identity including Purchases, Financial Info, Location, Contact Info, User Content, Search History, Identifiers, and Usage Data. It collects User Content and Diagnostics not linked to your identity.

How many SDKs does Vrbo have?

Vrbo integrates 41 third-party SDKs. 3 for advertising, 3 for attribution, 14 for analytics, 1 for crash reporting, 1 for payments, 1 for customer support, 1 for social integration, and 13 for infrastructure.

Does Vrbo use Facebook tracking?

Yes. Vrbo includes 3 Facebook SDKs: Facebook AEM, Facebook SDK, and Facebook Login. These are used for ad measurement, attribution, and integration with Facebook's advertising platform (developers.facebook.com).

Does Vrbo use Google SDKs?

Yes. Vrbo includes 18 Google or Firebase SDKs: Firebase A/B Testing, Firebase Analytics, Firebase Core, Firebase Performance, Firebase Remote Config, Google App Measurement, Firebase Crashlytics, Google Sign-In, Firebase Installations, Google Data Transport, Google Utilities, Firebase Analytics On-Device Conversion, Firebase Core Extension, Firebase Core Internal, Firebase Remote Config Interop, Firebase Sessions, Firebase Shared Swift, and Google App Measurement On-Device Conversion. These are used for ads, analytics, and cloud services.

Does Vrbo use App Tracking Transparency?

Yes. Vrbo requests the App Tracking Transparency permission, which means it asks for your consent to track your activity across other companies' apps and websites.

Does Vrbo access your location?

Yes. Vrbo requests location access. The developer states: "Your current location will be used to find airports and hotels near you.".

Does Vrbo access your camera?

Vrbo requests access to your camera. The developer says this is for "Enable camera access to update your profile photo, get destination suggestions, or share attachments". These permissions are only active when you grant them in iOS Settings.

Does Vrbo run in the background?

Yes. Vrbo registers 2 background modes, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to Vrbo?

Other travel apps include Air Canada , Aeroméxico , Air France , Airalo , Airbnb , and Priority Pass+ . Each app takes a different approach to travel and varies in its data collection and SDK usage.

Travel · Privacy report

Vrbo Vacation Rentals

Free · ★4.8 · HomeAway.com, Inc.

Is Vrbo safe?

It leans heavily on third-party trackers.

Our take. Vrbo is built with more third-party tracking code than 97% of the travel we have scanned, including an analytics SDK from Israel.

Privacy footprint · vs 103 travelHeavy

Trackers from other companies20 · a lot

typical travel: 5

Data the app links to you8 types · some

typical travel: 5 · from its own privacy label

What it collects about you

Vrbo links 8 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data Vrbo ties to your identity, and it also declares it shares data to track you across other apps.

PurchasesFinancial InfoLocationContact InfoUser ContentSearch HistoryIdentifiersUsage Data

Who else is inside

It carries trackers from 5 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🇺🇸GoogleAnalytics

Firebase, AdMob and Google analytics SDKs, built to record how you use the app and serve ads.

SDKs

🏢Other third partiesanalytics

A third-party SDK.

SDKs

🇺🇸MetaAdvertising

Facebook advertising SDKs, built to link app activity to Facebook and Instagram ad profiles.

SDKs

🇮🇱AppsFlyerAttribution · Israel

Marketing attribution and audience analytics.

SDKs

🇺🇸BranchAttribution

Deep linking and marketing attribution.

SDK

How it compares

Where it sits among travel.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one travel app. Vrbo sits to the right, carrying more third-party tracking than most.

Other signals

Two more flags.

Each is a fact read straight from the app. The same checks run on every app we scan. Only the ones that apply here are shown.

It declares cross-app tracking

Its own App Store label says it tracks you across other companies apps and websites using your advertising identifier.

It sends analytics to a company in Israel

AppsFlyer is a Israel company. Its analytics SDK is built into the app.

The evidence

What it's built from.

All 41 SDKs in the app, grouped by what they are for. 20 are third-party trackers.

3advertising

3attribution

14analytics

1crash reporting

20standard libraries

20 of the 41 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

GoogleAnalytics · USA

Firebase A/B Testing · Firebase Analytics · Firebase Core · Firebase Performance · Firebase Remote Config · Firebase Analytics On-Device Conversion · Firebase Remote Config Interop · Firebase Sessions

Other third partiesanalytics

Google App Measurement · Google App Measurement On-Device Conversion · Salesforce Marketing Cloud · OneTrust Privacy/Consent · Quantum Metric · Salesforce Marketing Cloud SDK

MetaAdvertising · USA

Facebook AEM · Facebook SDK · Facebook Login

AppsFlyerAttribution · Israel

AppsFlyer · AppsFlyer Migration Helper

BranchAttribution · USA

Branch

Standard libraries20 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v2026.12.912, 2026-04-01.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 103 travel in our corpus. Trackers: median 5. Data linked to you: median 5.