Businesses using Mixpanel are not allowed to send Mixpanel data about users' health, finances, government IDs, biometrics, or children's information unless Mixpanel specifically approves it in writing.
This analysis describes what Mixpanel's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This restriction establishes a procedural requirement that affects how customers may use the service. By requiring pre-authorization for sensitive data categories, the provision establishes Mixpanel's role as a gatekeeper for certain data submissions and creates an operational mechanism for customers to assess compliance before transmitting data to the platform.
The updated terms remove a contractual protection that previously prohibited Mixpanel from treating individually identifiable data as Usage Data. Under the revised language, Mixpanel may now classify data that identifies or is attributable to specific individuals as Usage Data, potentially making such data subject to uses and disclosures beyond what the Customer Content exclusion permits. This broadens the category of data Mixpanel may process and analyze under the Usage Data definition. The terms do not provide a mechanism to opt out of this reclassification.
View change record →The updated terms establish an automatic 7% fee increase mechanism that takes effect upon each subscription renewal. Previously, subscription fees remained fixed for the duration of the subscription term, with new pricing becoming effective only at the start of a new subscription term and only if the parties agreed in writing. Under the revised language, fees will now automatically escalate by 7% upon commencement of each renewal term unless the parties expressly agree otherwise in writing. This shifts the default pricing behavior from fixed-term rates to automatic annual escalation.
View change record →Removal of this sensitive data prohibition eliminates explicit restrictions on submitting health, financial, biometric, and children's data, potentially expanding the types of personal information customers can process.
View full change record →If a business accidentally sends your health, financial, or children's data to Mixpanel through its analytics tracking, that business — not Mixpanel — bears full legal responsibility for the violation, and Mixpanel's terms explicitly prohibit such transmissions without prior written approval.
How other platforms handle this
index, frame, embed or link to the Services in a manner not authorized by us, or to collect information about users for the purpose of sending, facilitating, or encouraging unsolicited bulk or other communications
You may not display any personal contact, banking, or peer-to-peer payment information, whether in relation to you or any other person (for example, names, home addresses or postcodes, telephone numbers, email addresses, URLs, credit/debit card...)
"Frame" or "mirror" or otherwise incorporate part of the services into any website, or "deep-link" to any portion of the services without our express written permission...
"Customer will not submit to the Service any Sensitive Personal Information without Mixpanel's express written authorization. Sensitive Personal Information includes health or medical information, financial account information, social security numbers or government-issued identification numbers, biometric data, information relating to children under the age of 13 (or the applicable age of digital consent in the relevant jurisdiction), and other categories of sensitive personal information as defined under applicable law.Excerpt from Mixpanel's Terms of Use
(1) REGULATORY FRAMEWORK: This provision directly implicates COPPA 16 CFR Part 312 (prohibition on collecting personal information from children under 13 without verifiable parental consent), enforced by the FTC; HIPAA 45 CFR §§164.502 and 164.514 …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This restriction establishes a procedural requirement that affects how customers may use the service. By requiring pre-authorization for sensitive data categories, the provision establishes Mixpanel's role as a gatekeeper for certain data submissions and creates an operational mechanism for customers to assess compliance before transmitting data to the platform.
If a business accidentally sends your health, financial, or children's data to Mixpanel through its analytics tracking, that business — not Mixpanel — bears full legal responsibility for the violation, and Mixpanel's terms explicitly prohibit such transmissions without prior written approval.
ConductAtlas has identified this type of provision across 282 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mixpanel.