Does AWS Amplify require disclosure in our privacy policy?

Yes. AWS Amplify is a third-party service processor that collects and processes user data, so it must be disclosed in your privacy policy. You must inform users that their data is transmitted to and processed by AWS Amplify services and explain which specific AWS services you use (Auth, Storage, API, or Analytics). This disclosure is required under GDPR, CCPA, and other privacy regulations.

What data does AWS Amplify collect?

AWS Amplify collects data depending on which services you enable. If using Authentication, it processes login credentials and identity information. Storage services collect file uploads and metadata. The API service processes requests and responses. Analytics collects user behavior, session data, device information, and engagement metrics. You should audit your specific configuration to disclose the exact data categories you transmit to AWS Amplify.

Does AWS Amplify require a cookie consent banner?

AWS Amplify itself does not set cookies. However, if you enable AWS Amplify Analytics, it may use browser storage mechanisms and local identifiers to track user behavior. Additionally, any authentication or API services may use session tokens. You should review your specific AWS Amplify configuration and consult consent requirements in your jurisdiction before determining if a banner is necessary.

Who processes data collected through AWS Amplify and where?

Amazon Web Services, Inc. (a subsidiary of Amazon.com, Inc.) is the data processor. Data is transferred to and processed in the United States, where AWS infrastructure is located. Under GDPR, this international transfer requires appropriate safeguards such as Standard Contractual Clauses. You should verify AWS's current data processing agreements and Data Processing Addendum (DPA) to ensure compliance with your jurisdiction's requirements.

Storage

Privacy policy clauses for AWS Amplify

AWS Amplify is a cloud development platform that provides backend services for web and mobile applications, including authentication, data storage, APIs, and analytics. Websites use it to build scalable applications while outsourcing infrastructure management to Amazon Web Services.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data AWS Amplify collects

Your privacy policy must disclose each of the following data types when you use AWS Amplify.

Depends on services used (Auth, Storage, API, Analytics)

When does AWS Amplify trigger privacy obligations?

Immediate obligations when AWS Amplify is installed

Adding AWS Amplify to your app or website triggers data protection obligations the moment any AWS Amplify service begins processing user data. This happens automatically with several Amplify services:

Auth service: Immediately processes authentication data (email, phone, password hashes, MFA tokens) and stores user identity attributes in Amazon Cognito. This triggers GDPR Article 13/14 disclosure obligations (lawful basis, processor identity, retention) for any EU users, and CCPA Section 1798.100 disclosure requirements for California residents.

Storage service: Automatically transmits files to Amazon S3 and processes metadata. GDPR applies if any user data is stored; CCPA applies to California users regardless of file content sensitivity.

Analytics service: Amplify Analytics (via Amazon Pinpoint) collects session, event, and device data by default. This is cross-border data transfer to the US, triggering GDPR Chapter V adequacy assessments and Standard Contractual Clauses (SCCs) requirements.

First concrete step: Before deploying, execute a Data Processing Agreement (DPA) with AWS covering all Amplify services you enable. AWS provides standard terms under their Customer Agreement Appendix, but you must document which Amplify services you use and confirm SCC adequacy for your user jurisdictions. If you serve EU users, confirm AWS's SCC compliance status post-Schrems II (currently documented in AWS data processing addendum).

Privacy policy clauses for AWS Amplify

What data AWS Amplify collects

When does AWS Amplify trigger privacy obligations?

Immediate obligations when AWS Amplify is installed

Where data goes

Common compliance pitfalls

Failing to account for cross-border transfer implications

Misconfiguring or undisclosing Amplify Analytics by default

Missing DPA updates after SDK upgrades

Sample privacy policy clause

What regulators look for

DPA and GDPR enforcement priorities

Frequently asked questions

Does AWS Amplify require disclosure in our privacy policy?

What data does AWS Amplify collect?

Does AWS Amplify require a cookie consent banner?

Who processes data collected through AWS Amplify and where?

Don't ship without Bandit.