Do I need to disclose Amplitude in my privacy policy?

Yes, you must disclose Amplitude in your privacy policy because it collects personal data about your users. Under GDPR, CCPA, and similar regulations, you are required to transparently identify all third parties that process user data. Your policy should specify that Amplitude collects user events, device information, and IP addresses for analytics purposes.

What specific data does Amplitude collect?

Amplitude collects user events (actions taken on your site or app), device information (device type, OS, browser), IP addresses, user properties (custom attributes you define), and session data. This data is used to create user behavior profiles and analytics reports. The scope of collection depends on how you implement Amplitude and what events you choose to track.

Do I need a cookie consent banner for Amplitude?

Yes, in most jurisdictions. Amplitude uses cookies (amp_* cookies with approximately 1-year expiration) for user identification and analytics tracking. Under GDPR and ePrivacy Directive, you must obtain explicit consent before placing non-essential cookies. Implement a cookie consent banner that allows users to opt-out of analytics tracking before Amplitude loads.

Who is the data processor and where is my data stored?

Amplitude Inc., a United States-based company, processes the data you collect. Data is transferred to and stored in the US. If you operate under GDPR, you should have a Data Processing Agreement (DPA) with Amplitude in place, and you may need to implement additional safeguards such as Standard Contractual Clauses (SCCs) for international data transfers. Review Amplitude's privacy policy at https://amplitude.com/privacy for their current data handling practices.

Analytics

Privacy policy clauses for Amplitude

Amplitude is a product analytics platform that tracks user interactions and behavior on websites and applications. It collects event data to help businesses understand how users engage with their digital products, measure feature usage, and optimize user experience.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Amplitude collects

Your privacy policy must disclose each of the following data types when you use Amplitude.

User events

Device info

IP address

User properties

Session data

When does Amplitude trigger privacy obligations?

Installation triggers immediate data collection

The moment you install Amplitude's SDK on your website or app, it begins collecting user events, device information (OS, browser type, device model), IP addresses, and session identifiers. Amplitude sets first-party cookies prefixed `amp_*` with a 1-year expiration to identify and track users across sessions. This automatic data flow—not dependent on user action or consent—creates immediate compliance obligations.

Regulatory triggers by jurisdiction

GDPR (EU/EEA users):

Privacy policy clauses for Amplitude

What data Amplitude collects

When does Amplitude trigger privacy obligations?

Installation triggers immediate data collection

Regulatory triggers by jurisdiction

Where data goes

Cookies set by Amplitude

Common compliance pitfalls

Pitfall 1: Vague or missing consent disclosures

Pitfall 2: Misconfiguring consent categories

Pitfall 3: Missing Data Processing Agreement (DPA)

Sample privacy policy clause

What regulators look for

GDPR Data Protection Authorities (DPAs)

FTC (US)

Enforcement patterns

Frequently asked questions

Do I need to disclose Amplitude in my privacy policy?

What specific data does Amplitude collect?

Do I need a cookie consent banner for Amplitude?

Who is the data processor and where is my data stored?

Don't ship without Bandit.