AMP gates the JavaScript it allows and requires asynchronous evaluation. 3rd party JS is also allowed, but it has to be in a sandboxed iframe which, in a browse

AMP gates the JavaScript it allows and requires asynchronous evaluation. 3rd party JS is also allowed, but it has to be in a sandboxed iframe which, in a browser at least, would guard some of the user's state from exfiltration attacks (it's unclear to me if the iframe feature is available in email AMP). https://www.ampproject.org/learn/about-how/ https://www.ampproject.org/learn/about-how/