How This Briefing Works
This dossier opens with key findings, then maps the gap between what Amplitude discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 25 sites
vendor fires before consent
2 CRIT · 3 HIGH
Briefing
Amplitude is a publicly-traded (AMPL, Nasdaq) AI analytics and digital experience platform serving 11,000+ digital products. The company holds SOC 2 Type II, ISO 27001/27017/27018 certifications and claims GDPR compliance via EU-US Data Privacy Framework. Runtime observation of amplitude.com reveals 97 cookies (41 pre-consent), 90+ third-party domains, and fingerprinting activity. Detected on 22 sites in BLACKOUT's network with a 40.9% pre-consent tracking rate.
What This Means For You
If Amplitude is deployed on your site, you inherit their multi-script footprint including analytics, experimentation, session replay, and engagement modules. Under GDPR Art 5(3) and the ePrivacy Directive, you as the site operator bear liability for all cookies and tracking that Amplitude's scripts initiate on your visitors. Amplitude's 40.9% pre-consent tracking rate across observed deployments means your site likely fires tracking before consent is obtained. Their SOC 2 Type II and ISO 27001 certifications cover Amplitude's internal operations and infrastructure -- they do not extend to the client-side JavaScript executing on your visitors' browsers. The gap between their 5 disclosed subprocessors and the 30+ third-party domains observed on their own site raises questions about undisclosed data flows that may also occur through customer-deployed scripts.
Risk Channel Breakdown
Amplitude's own analytics SDK accesses navigator properties (languages, platform) and browser storage for device identification. When deployed alongside their Experiment and Engagement Browser products, the combined instrumentation creates a measurement surface that persists identity across sessions. On their own site, multiple attribution systems compete (Google Analytics, Bizible, Infinigrow), creating conflicting attribution signals that distort conversion measurement.
Scanner detected data flowing to Clearbit (company reveal), 6sense (intent data), ZoomInfo (contact enrichment), and StackAdapt (programmatic advertising) on Amplitude's own website. These vendors syndicate visitor signals to demand-side platforms. Any organization whose employees visit amplitude.com has their intent signals captured and potentially available to competitors via these data brokers.
The site loads 90+ third-party domains including obfuscated scripts from roundprincemusic.com (CHEQ ad verification) that perform canvas, WebGL, and navigator fingerprinting. Dynamic code execution via eval and function constructors was detected. The engagement-browser SDK uses chunked code splitting across 15+ dynamic script loads, expanding the client-side attack surface significantly.
41 cookies fire before the Civic Cookie Control consent banner renders, creating strict liability exposure under ePrivacy Directive Art 5(3). Pre-consent cookies include identity-level trackers (sa-user-id, TDID, uuid2, MUID) from ad networks. The privacy policy claims to honor GPC signals, but tracking initiates before any signal processing can occur. Trust center lists only 5 infrastructure subprocessors while the site shares data with 30+ third-party vendors.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Tracking continues after opt-out
Gated or missing due diligence docs
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Amplitude's public claims against observed runtime behavior and identified 6 contradictions.
"Claims GDPR compliance via EU-US Data Privacy Framework and honors GPC signals"
41 cookies fire before Civic Cookie Control consent banner renders, including identity-level ad network cookies (sa-user-id, TDID, uuid2, MUID, _fbp)
5 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
5 for current users · 5 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 5, observed 6
googletagmanager, googleanalytics4, metapixel…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →