Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This privacy policy governs Okta's collection and use of personal information from individuals who visit Okta's website, register for trials, attend events, or use Okta's identity and access management services. The policy establishes that Okta collects name, email, company information, device identifiers, and behavioral data, and authorizes sharing this information with advertising partners and third-party service providers. Individuals in California, the EU, and the UK may submit requests to access, delete, or opt out of certain data processing activities by contacting privacy@okta.com.
This document is Okta's Privacy Policy governing the collection, use, sharing, and retention of personal data by Okta, Inc. and its subsidiaries including Auth0, across Okta's websites, marketing activities, and customer-facing identity platforms; the stated legal bases for processing include contractual necessity, legitimate interests, consent, and compliance with legal obligations. The policy states that Okta collects personal data including identifiers, usage data, device and log data, and professional information, and the terms authorize sharing this data with service providers, business partners, advertising networks, and in connection with corporate transactions such as mergers or acquisitions. Notably, the policy covers both Okta's own website visitor data and its role as a data processor for enterprise customers deploying Okta or Auth0 products, creating a layered data relationship where end users of enterprise deployments are governed by their employer's or developer's privacy terms rather than this policy directly; the practical scope of Okta's data controller role versus processor role may require independent evaluation depending on the specific product context. The policy engages GDPR and UK GDPR for EU and UK residents, CCPA and CPRA for California residents, and other applicable global privacy frameworks; material compliance considerations include the adequacy of disclosed cross-border data transfer mechanisms, the granularity of consent for marketing and analytics cookies, and the clarity of data subject rights procedures for individuals accessing Okta or Auth0 services through enterprise deployments.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial2 important changes detected
3 versions captured · Last updated: June 2026
Provides comprehensive transparency about the scope and sources of data collection, including new category of inferred data derived from collected information.
Separates California-specific CCPA/CPRA rights from general GDPR/CCPA provisions, reflecting distinct regulatory requirements and providing state-specific guidance.
Separates European data protection rights from CCPA/CPRA and provides specific DPO contact information for exercising rights, enhancing compliance transparency for EU/UK/Swiss users.
Explicitly addresses personal data handling during M&A activities and commits to notification, clarifying data subject rights during corporate transitions.
Establishes clear COPPA-compliant policy regarding children's data collection and removal procedures for accidental collection.
Replaced by separate, jurisdiction-specific provisions for California (CCPA/CPRA) and EU/UK/Swiss rights, allowing for more tailored regulatory compliance disclosures.
Removed standalone provision suggesting marketing communications handling is now covered under broader data usage and subject rights sections in current version.
Expanded to explicitly define the data controller vs. processor distinction with concrete examples and clarified that customer privacy policies govern processing in processor role.
Significantly expanded scope to include comprehensive list of service provider categories beyond just advertising and analytics partners.
Added specific geographic focus on EEA, UK, and Switzerland; changed framing from conditional safeguards to affirmative reliance on Standard Contractual Clauses and European Commission approval.
Expanded to explicitly include web beacons and pixel tags, clarified purpose as device recognition and personalization, added note about third-party tracking, and added browser settings adjustment option.
Added detailed framework for retention determination including consideration of data sensitivity, harm risk, processing purposes, and legal requirements.
Monitoring
Auth0 has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Product Data Carve-Out and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.