Do I need to disclose Mixpanel in my privacy policy?

Yes. Mixpanel collects personally identifiable information and behavioral data, making disclosure legally required under GDPR, CCPA, and most privacy regulations. You must explicitly name Mixpanel, describe the data collected, explain the lawful basis for processing, and provide links to Mixpanel's privacy documentation so users understand their rights.

What specific data does Mixpanel collect?

Mixpanel collects user events and actions, device information (type, OS, browser), IP addresses, geographic location derived from IP data, and custom user properties you configure. It uses persistent cookies (mp_*) that remain for up to one year to identify users and track sessions across visits.

Does Mixpanel require a cookie consent banner?

Yes, in most jurisdictions. Mixpanel's tracking cookies require explicit consent under GDPR (EU/UK) and similar privacy laws before deployment. You must obtain affirmative opt-in consent through a cookie banner before Mixpanel's tracking code executes, unless you have another lawful basis documented.

Who processes my data with Mixpanel and where is it stored?

Mixpanel Inc., a United States-based company, acts as a data processor on your behalf. Data is transferred to and processed in the US by default, though Mixpanel offers EU data residency options. Review Mixpanel's Data Processing Agreement and configure regional storage settings to comply with GDPR transfer restrictions if serving EU users.

Analytics

Privacy policy clauses for Mixpanel

Mixpanel is an analytics platform that tracks user interactions, events, and behaviors on websites and applications. Websites use Mixpanel to understand user engagement patterns, measure feature adoption, and optimize user experience through detailed event-level data collection.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Mixpanel collects

Your privacy policy must disclose each of the following data types when you use Mixpanel.

User events and actions

Device info

IP address

Geographic location

Custom user properties

When does Mixpanel trigger privacy obligations?

Immediate Data Collection Begins

The moment you install Mixpanel's SDK or embed its tracking code, it begins collecting user events, device identifiers, IP addresses, and geographic location data. This is not deferred—data flows to Mixpanel Inc (US-based) on the first user interaction. You do not need a threshold of users or revenue to trigger obligations; any collection triggers them.

Which Regulations Apply

GDPR (if any users are in the EU/EEA):

Privacy policy clauses for Mixpanel

What data Mixpanel collects

When does Mixpanel trigger privacy obligations?

Immediate Data Collection Begins

Which Regulations Apply

US Data Residency Consideration

Where data goes

Cookies set by Mixpanel

Common compliance pitfalls

Pitfall 1: Installing Mixpanel Before Consent

Pitfall 2: Missing or Incomplete Data Processing Agreement (DPA)

Pitfall 3: Misconfiguring Event Names or Custom Properties

Legal note

Sample privacy policy clause

What regulators look for

DPA Audit Priorities for Mixpanel

Frequently asked questions

Do I need to disclose Mixpanel in my privacy policy?

What specific data does Mixpanel collect?

Does Mixpanel require a cookie consent banner?

Who processes my data with Mixpanel and where is it stored?

Don't ship without Bandit.