Targeted Advertising Data Sharing and Opt-Out

What it is

The policy authorizes sharing of personal information with advertising networks, analytics providers, and social media companies for targeted advertising, and discloses an opt-out right for California residents through a designated link or privacy request portal.

Why it matters (compliance & governance perspective)

This provision establishes Amplitude's participation in targeted advertising data sharing ecosystems and creates an opt-out obligation under CCPA/CPRA for California residents. Under CPRA, sharing personal information for cross-context behavioral advertising constitutes a regulated activity even where no monetary consideration is exchanged.

Change history

Consumer impact (what this means for users)

Under this clause, Amplitude may share identifiers, behavioral data, and other personal information with third-party advertising and analytics partners for targeted advertising purposes. California residents may opt out of this sharing by using the Do Not Sell or Share link on Amplitude's website or submitting a request at https://privacy.amplitude.com.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA/CPRA, which defines sharing for cross-context behavioral advertising as a regulated activity requiring opt-out rights, enforceable by the California Privacy Protection Agency and the California Attorney General. The provision may also engage state privacy laws in Virginia, Colorado, Connecticut, Texas, and other states that include targeted advertising opt-out rights. The FTC exercises general authority over unfair or deceptive advertising and data practices. GOVERNANCE EXPOSURE: Medium. The opt-out mechanism must be functional, conspicuous, and processed within the statutory timeframe (15 business days under CPRA). Failure to honor opt-out requests or to maintain a functional opt-out mechanism creates direct regulatory exposure. Organizations deploying Amplitude should assess whether their own privacy notices and consent mechanisms disclose Amplitude's advertising-related data sharing to end users. JURISDICTION FLAGS: California creates the most specific compliance obligations under CPRA, including opt-out signal recognition requirements (Global Privacy Control). Virginia, Colorado, Connecticut, and Texas privacy laws also include targeted advertising opt-out rights with varying procedural requirements. EU/EEA data subjects require a distinct legal basis (consent or legitimate interests) for targeted advertising under GDPR. CONTRACT AND VENDOR IMPLICATIONS: Organizations deploying Amplitude on consumer-facing properties should assess whether Amplitude's advertising data flows affect their own CCPA/CPRA compliance posture, particularly if Amplitude's tracking code is present on properties that collect California consumer data. The characterization of third-party advertising data sharing as a sale or share determines opt-out obligations. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the Do Not Sell or Share mechanism on Amplitude's website is functional, that Global Privacy Control signals are recognized where required, and that opt-out requests are honored within applicable statutory deadlines. Organizations should update their vendor lists and data maps to reflect Amplitude's advertising data sharing practices.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Dual Controller and Processor Role medium
• Aggregated and De-Identified Platform Data Use medium
• Cross-Border Data Transfers medium
• US State Privacy Rights (Multi-State) medium
• Cookie and Tracking Technology Use low
• Data Retention low