Amplitude

Overview

Amplitude is a product analytics platform used by software companies, mobile app developers, and digital product teams to understand how users engage with their products. Unlike web analytics tools focused on marketing attribution, Amplitude is designed for product instrumentation — tracking feature usage, measuring activation and retention, running funnel analyses, and powering A/B test measurement. It is widely deployed across SaaS, fintech, gaming, and consumer app products.

What This Script Does

The Amplitude JavaScript SDK (cdn.amplitude.com/libs/amplitude-*.min.js) instruments every page and interaction in the host application:

Event tracking

• Tracks page views automatically on load and navigation
• Captures click events, form submissions, and custom events defined by the product team via amplitude.track() calls
• Each event includes a full property payload: page URL, referral source, UTM parameters, user properties, and any custom properties the developer attaches
• Events are batched and sent to Amplitude's ingestion API (api2.amplitude.com/2/httpapi) at configurable intervals or on session end

User identification and session stitching

• Sets the amplitude_id first-party cookie (persistent, typically 10 years by default) containing the device ID, the last event time, and the session ID
• The device ID is a UUID generated on first visit and persisted across sessions to identify returning users
• When a user logs in, the application calls amplitude.setUserId() to associate the device ID with a known user ID, enabling cross-device stitching in Amplitude's user profiles
• Session IDs (millisecond timestamps) mark session boundaries; a new session ID is assigned after 30 minutes of inactivity

User properties and cohorts

• Collects device metadata automatically: OS, browser, browser version, country, language, screen dimensions, carrier
• Developers can attach custom user properties (subscription tier, feature flags, experiment variants) to enrich analysis
• Amplitude's cohort engine groups users by behavioral criteria for retention and funnel analysis

Consent & Compliance

• Category: Analytics
• GDPR: Amplitude is a product analytics tool. Under GDPR, tracking user behavior for product improvement can rely on legitimate interests in some cases, but many DPAs and regulators treat persistent behavioral analytics as requiring consent — particularly when a device ID is stored in a long-lived cookie. The default 10-year cookie expiry is difficult to justify under the storage limitation principle. Amplitude offers a consent-aware initialization mode.
• CCPA: Amplitude supports CCPA compliance through its data deletion API, allowing users' event histories and profiles to be purged on request.
• Data transfers: Amplitude is a US company headquartered in San Francisco. Data is processed in the US by default. Amplitude offers EU data residency (data stored in Frankfurt via AWS eu-central-1) for customers requiring European data processing. EU-US Data Privacy Framework applies for US-processed data.
• Cookies set: amplitude_id_[API_KEY] (1st party, up to 10 years by default — configurable), amplitude_unsent_[API_KEY] (1st party, session, for unsent event queue)

Should You Block This Without Consent?

Yes — with analytics consent. Amplitude sets a long-lived device ID cookie and tracks behavioral patterns across sessions. This requires analytics consent under GDPR. Amplitude should not initialize until analytics consent is granted. Consider configuring the cookie expiry to a shorter duration (e.g., 1 year) and enabling the consent-aware SDK initialization pattern to avoid collecting data before consent is given.