Cookies and consent management (Browser SDK)

1. The context of a particular visit.
2. Who creates the cookie.

Every cookie has an owner, which is the domain defined in the cookie:

• First-party cookies are issued by a website that a user views directly. If a user lands on a website—for example, fit.amplitude.com—this site creates a cookie which is then saved on the user's computer. This is how Amplitude works. When a customer decides to add Amplitude Browser SDK 2 to their website, the customer (through their website) directly creates the cookie stored in the visitor's computer.

• Third-party cookies are not created by the website being visited, but by someone else. Imagine you're visiting fit.amplitude.com, and the site uses YouTube videos for virtual non-live classes. In this case, YouTube sets the cookie that is saved on the user's computer.

What's happening in this case is that the website owner embeds pieces of code, provided by YouTube, for the videos to play directly in fit.amplitude.com. When that YouTube code executes in the browser, or the video loads, YouTube can track the player and put data in its cookies. This is why the cookie qualifies as a third-party cookie—because it's created by a different domain than fit.amplitude.com / amplitude.com

If you're concerned that this renders the Amplitude cookie vulnerable to authentication information theft, you shouldn't be. Amplitude stores no authentication information in that cookie, so there's no danger of an XSS attack. The worst thing an attacker could do is steal Amplitude's cookie and take that user's device ID and user ID, which shouldn't be PII to begin with.

Nonetheless, if this is a serious concern for you, then you should probably disable Amplitude's cookies.

For these reasons, Amplitude doesn't consider this as a security vulnerability. However, you can enable the secure flag if needed:

amplitude.init("API_KEY", {
  cookieOptions: {
    secure: true,
  },
});

At the time of this writing, Amplitude doesn't have a default integration with any of these tools. You must configure your CMP to pass the outcome of the consent to the Amplitude SDK, so that any end user who hasn't provided consent or who has revoked consent (depending on the end user's jurisdiction) is opted out of tracking by the Amplitude SDK.

Here's an example integration pattern:

// Track events
amplitude.track("Button Clicked");
 
// Initialize when CMP provides consent status
amplitude.init("API_KEY");

Customers may also choose to implement through a server side integration, therefore bypassing Amplitude's cookies from the SDK. However, customers who integrate through a server side integration are still responsible for ensuring that they get any necessary consents and make any necessary disclosures for the personal data they collect and send to Amplitude.

1. Analytics cookies can ONLY be placed without asking for user consent if they only collect anonymous statistical data for audience measurement (total traffic, page views).
2. This doesn't mean a customer can collect ALL data about a user for analysis.
3. Under the exemption, customers can't use or create "user" analyses.

Therefore, a customer's use of an analytics service under the exemption is very limited. Without the CNIL cookie exemption, customers might only collect and measure part of their traffic. The power of the limited data set (for example, the data set with just the users that opt-in/consent) in Amplitude is much more valuable than the very limited data that can be collected under the exemption. This is because:

Audience measurement (page views, total sessions) doesn't help customers make better decisions; behavioral analytics guide actions and learning.

Amplitude doesn't need 100% of traffic to derive meaningful insights.

Most of the exempted tools don't have the powerful analytics capabilities of Amplitude.

Besides using the SDKs, customers can still send data to Amplitude server-side. This doesn't require customers to obtain consent for a separate Amplitude SDK cookie. However, as mentioned above, customers who integrate through a server side integration are responsible for ensuring that they obtain any necessary consents and make any necessary disclosures for the personal data they collect and send to Amplitude.

You can configure the SDK to only track page views and basic session information:

amplitude.init("API_KEY", {
  autocapture: {
    attribution: false,
    pageViews: true,
    sessions: true,
    formInteractions: false,
    fileDownloads: false,
    elementInteractions: false,
  },
});

• Reach out to Amplitude at mailto:cnil-support@amplitude.com, if you are a prospective customer, or via this form, if you are an existing customer, to:

  • request that IP address be dropped for projects that contain end users that haven't provided consent;
  • discuss disabling Amplitude's User Look-Up and the ability to view user streams for projects that contain data for end users that haven't provided consent; and
  • discuss the most effective configuration options for your use case.

• Don't send deviceID to Amplitude for end users that haven't provided consent.

• For end users that haven't provided consent, set a userID that's randomly generated or hashed.

• Consider disabling the capacity to filter end users at the individual level by hiding user properties, such as userID, deviceID and Amplitude ID. See this documentation.

• Consider disabling user downloads. See this documentation.

Amplitude also offers customers the choice of having their data hosted in the US-West based AWS environment or the EU based AWS environment. To ensure that Amplitude's customers can appropriately respond to and comply with end-user data deletion requests as required by global privacy laws such as GDPR, Amplitude has built an API endpoint that allows customers to programmatically submit requests to delete all data for a set of known Amplitude IDs and/or User IDs. For more details, see the developer documentation: User Privacy API.

Additionally, Data Subject Access Requests (DSARs) can be completed using the DSAR API, which makes it easy to retrieve all data about a single user. More details can be found here.

More information on Amplitude's stance on privacy and security can be found here.

Additionally, upon request, Amplitude can disable its cohort syncing and data streaming capabilities for orgs containing only data for end users that haven't provided consent.

To comply with this requirement, customers shouldn't use Amplitude's cross domain tracking, and should use a separate platform instrumentation for any projects with data from end users that haven't provided consent. By default, Amplitude doesn't employ cross domain tracking for customers.