The policy establishes that Amplitude acts as a data controller for personal information collected through its own website and marketing activities, and as a data processor or service provider when processing data submitted by business customers through the Amplitude platform.
This analysis describes what Amplitude's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision determines which legal obligations, data subject rights workflows, and contractual requirements apply depending on the data processing context. Organizations deploying Amplitude's SDK must assess their own controller responsibilities for end-user personal data processed through the platform, and should ensure a Data Processing Agreement with Amplitude is in place to govern the processor relationship.
Restructured explanation to emphasize customer control and responsibility, and clarified that Amplitude acts as controller only for website/marketing data collection.
View full change record →Under this clause, individuals interacting with Amplitude's website or marketing activities may submit privacy rights requests directly to Amplitude as the data controller. End users of third-party applications built on Amplitude's platform must direct data requests to the deploying organization, which acts as the data controller for those processing activities.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
"When we provide our Services to our Customers, we process personal information on behalf of our Customers as a service provider or data processor. Our Customers control what personal information is submitted to Amplitude through the Services and are responsible for their use of the Services. When we collect personal information about you through our website and marketing activities, we act as a data controller.Excerpt from Amplitude's Privacy Notice
REGULATORY LANDSCAPE: This provision engages GDPR Articles 4, 24, and 28 (controller and processor definitions and obligations) and CCPA/CPRA's service provider framework.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision determines which legal obligations, data subject rights workflows, and contractual requirements apply depending on the data processing context. Organizations deploying Amplitude's SDK must assess their own controller responsibilities for end-user personal data processed through the platform, and should ensure a Data Processing Agreement with Amplitude is in place to govern the processor relationship.
Under this clause, individuals interacting with Amplitude's website or marketing activities may submit privacy rights requests directly to Amplitude as the data controller. End users of third-party applications built on Amplitude's platform must direct data requests to the deploying organization, which acts as the data controller for those processing activities.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Amplitude.