Amplitude wears two hats: it controls data about website visitors and business contacts directly, but for data collected inside its customers' apps, it acts only as a processor following the customer's instructions.
This analysis describes what Amplitude's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This distinction determines who is legally responsible for your data and who you should contact with privacy requests, depending on how you encountered Amplitude.
If your data was collected through a third-party app that uses Amplitude, your privacy rights run primarily against that app operator, not Amplitude directly, which may limit your practical recourse against Amplitude for that data.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
to object to profiling activities based on our own legitimate interests
"Amplitude acts as a "data controller" with respect to the personal information it collects about visitors to the Amplitude website and about contacts and representatives of our current and potential customers and partners. Amplitude acts as a "data processor" or "service provider" with respect to the personal information that Amplitude processes on behalf of our customers using the Amplitude platform.Excerpt from Amplitude's Privacy Notice
(1) REGULATORY LANDSCAPE: GDPR Articles 4(7) and 4(8) define controller and processor roles with distinct legal obligations; this provision's characterization of Amplitude as a processor for customer deployments directly engages those definitions and corresponding DPA …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This distinction determines who is legally responsible for your data and who you should contact with privacy requests, depending on how you encountered Amplitude.
If your data was collected through a third-party app that uses Amplitude, your privacy rights run primarily against that app operator, not Amplitude directly, which may limit your practical recourse against Amplitude for that data.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Amplitude.