The policy authorizes sharing of personal information with third-party service providers performing hosting, analytics, payment processing, email delivery, marketing, advertising, customer service, and data enrichment functions, subject to a stated limitation that such providers use data only as necessary for those services.
This analysis describes what Amplitude's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Amplitude's sub-processor and vendor data sharing framework and the contractual limitation imposed on third-party service providers. The inclusion of data enrichment services as a permitted category may create downstream data use considerations relevant to GDPR's purpose limitation principle and CCPA's service provider requirements.
Interpretive note: The policy does not enumerate specific third-party service providers or specify sub-processor notification procedures, creating some uncertainty about the full scope of downstream data sharing.
New comprehensive disclosure of service provider categories and contractual protections, clarifying the full scope of third-party access beyond advertising networks.
View full change record →Under this clause, personal information may be shared with a range of third-party vendors including hosting providers, analytics companies, payment processors, email delivery services, and data enrichment providers, with Amplitude asserting a contractual limitation that such parties use data only for the stated service purpose.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
You and your organization's administrator can access several types of Service Data directly from Google Cloud, including your account information, billing contact information, payment and transaction information, as well as product and communication settings and configurations.
to request that your data be transferred to a third party (data portability)
"We may share your personal information with third-party service providers that perform services on our behalf, such as hosting, data analytics, payment processing, email delivery, marketing, advertising, customer service, and data enrichment services. We require these service providers to use your personal information only as necessary to perform services for us.Excerpt from Amplitude's Privacy Notice
REGULATORY LANDSCAPE: This provision engages GDPR Article 28 (processor and sub-processor requirements), CCPA/CPRA service provider contract requirements, and general FTC expectations regarding vendor data security and privacy practices.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes Amplitude's sub-processor and vendor data sharing framework and the contractual limitation imposed on third-party service providers. The inclusion of data enrichment services as a permitted category may create downstream data use considerations relevant to GDPR's purpose limitation principle and CCPA's service provider requirements.
Under this clause, personal information may be shared with a range of third-party vendors including hosting providers, analytics companies, payment processors, email delivery services, and data enrichment providers, with Amplitude asserting a contractual limitation that such parties use data only for the stated service purpose.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Amplitude.