When a business uses Mixpanel to track its users, that business is responsible for its users' data as the data controller. Mixpanel processes the data on the business's behalf and is not directly responsible to end users for how their data is handled.
This analysis describes what Mixpanel's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision determines where legal accountability sits for end-user data. Because the business deploying Mixpanel is the data controller, end users must direct data rights requests such as access, deletion, and opt-out to the deploying business, not to Mixpanel.
Interpretive note: The exact contractual language governing the controller-processor relationship was not available in the truncated document; this analysis reflects the standard structure of Mixpanel's published terms and their Data Processing Agreement framework.
The updated terms remove a contractual protection that previously prohibited Mixpanel from treating individually identifiable data as Usage Data. Under the revised language, Mixpanel may now classify data that identifies or is attributable to specific individuals as Usage Data, potentially making such data subject to uses and disclosures beyond what the Customer Content exclusion permits. This broadens the category of data Mixpanel may process and analyze under the Usage Data definition. The terms do not provide a mechanism to opt out of this reclassification.
View change record →The updated terms establish an automatic 7% fee increase mechanism that takes effect upon each subscription renewal. Previously, subscription fees remained fixed for the duration of the subscription term, with new pricing becoming effective only at the start of a new subscription term and only if the parties agreed in writing. Under the revised language, fees will now automatically escalate by 7% upon commencement of each renewal term unless the parties expressly agree otherwise in writing. This shifts the default pricing behavior from fixed-term rates to automatic annual escalation.
View change record →This addition establishes a data processing framework with GDPR/privacy regulation implications by clarifying Mixpanel's role as processor and customer's role as controller, a significant compliance addition.
View full change record →End users whose behavioral data is collected through Mixpanel-powered applications cannot typically exercise data rights directly against Mixpanel. Their rights are governed by the deploying business's privacy policy and the applicable legal framework in their jurisdiction.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
REGULATORY LANDSCAPE: The controller-processor distinction directly engages GDPR Article 28, which requires a Data Processing Agreement specifying the subject matter, duration, nature, and purpose of processing, as well as processor obligations and data subject rights …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision determines where legal accountability sits for end-user data. Because the business deploying Mixpanel is the data controller, end users must direct data rights requests such as access, deletion, and opt-out to the deploying business, not to Mixpanel.
End users whose behavioral data is collected through Mixpanel-powered applications cannot typically exercise data rights directly against Mixpanel. Their rights are governed by the deploying business's privacy policy and the applicable legal framework in their jurisdiction.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mixpanel.