Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that OpenSea engages Google and Amplitude as third-party analytics providers that collect Usage Information via cookies, Pixel Tags, and similar technologies on OpenSea's behalf, with their use of that data governed by their own terms and policies.
This analysis describes what OpenSea's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that third-party analytics providers collect behavioral data directly from users via their own tracking technologies, with data use governed by the providers' own terms rather than solely by OpenSea's policy. This arrangement may require evaluation under GDPR joint controller or processor frameworks depending on the nature of the data flows.
Interpretive note: Whether Google and Amplitude act as processors or joint controllers under GDPR depends on the specific data flows and contractual arrangements, which are not detailed in the policy.
Under this clause, user activity on OpenSea is collected by Google and Amplitude through their own tracking technologies. The agreement states that these providers' use of the collected data is governed by their own terms of use and privacy policies, which users would need to review separately.
Cross-platform context
See how other platforms handle Third-Party Analytics Integration and similar clauses.
Compare across platforms →Monitoring
OpenSea has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We engage with third-party services ("Third Party Services"), including Google and Amplitude, to help collect some of the information referred to above. These Third Party Services, acting on our behalf, may collect information about your use of our Service through their own cookies, Pixel Tags, or other technologies ("Usage Information"). The Third Party Services' ability to use and share Usage Information is restricted by such Third Party Services' terms of use and privacy policy.Excerpt from OpenSea's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR processor and joint controller provisions, the EU ePrivacy Directive (cookie consent requirements), and CCPA service provider obligations. The relevant enforcement authorities are EU data protection authorities and the UK ICO for EEA and UK users, and the FTC for U.S. users. The statement that third-party use is restricted by their own terms does not by itself satisfy GDPR data processing agreement requirements. (2) GOVERNANCE EXPOSURE: Medium. The disclosure that third-party analytics providers operate under their own terms may be insufficient under GDPR to establish that these providers act solely as processors; if Google or Amplitude determine their own purposes for data use, a joint controller assessment may be required. (3) JURISDICTION FLAGS: EEA and UK users are most affected, as GDPR requires specific contractual arrangements with processors and transparency about data flows to third parties. California users under CCPA are entitled to disclosure of service provider relationships and applicable contractual restrictions. (4) CONTRACT AND VENDOR IMPLICATIONS: Compliance teams should confirm that data processing agreements with Google and Amplitude satisfy GDPR Article 28 requirements and assess whether any joint controller agreements are required. The policy's reference to third-party terms as the governing mechanism for data use restrictions should be evaluated for adequacy. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit cookie consent mechanisms to confirm compliance with ePrivacy Directive requirements, review data processing agreements with analytics vendors, and assess whether the disclosure of vendor identity and data flows is sufficient under applicable transparency requirements.
This provision discloses that third-party analytics providers collect behavioral data directly from users via their own tracking technologies, with data use governed by the providers' own terms rather than solely by OpenSea's policy. This arrangement may require evaluation under GDPR joint controller or processor frameworks depending on the nature of the data flows.
Under this clause, user activity on OpenSea is collected by Google and Amplitude through their own tracking technologies. The agreement states that these providers' use of the collected data is governed by their own terms of use and privacy policies, which users would need to review separately.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenSea.