Auth0 · Auth0 Privacy Policy · View original document ↗

Data Controller vs. Processor Dual-Role Distinction

Medium severity High confidence Explicitdocumentlanguage Unique · 0 of 343 platforms
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for Auth0 Create a free account to receive the weekly governance digest and monitor one platform for governance changes.
Create free account No credit card required.
Document Record

What it is

If you log into an app that uses Okta or Auth0 for authentication, your data is controlled by that app's developer or employer, not Okta directly, and Okta's privacy policy does not govern those interactions.

This analysis describes what Auth0's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

Many users encounter Okta or Auth0 without realizing it, as it powers login for thousands of enterprise apps. Those users cannot rely on this policy for their data rights; they must look to their employer's or the application's own privacy terms.

Change history

modified Jun 2, 2026

Expanded to explicitly define the data controller vs. processor distinction with concrete examples and clarified that customer privacy policies govern processing in processor role.

View full change record →

Consumer impact (what this means for users)

If you access services through an Okta or Auth0 powered login screen, your personal data including authentication credentials and login metadata is processed under your employer's or the app developer's privacy policy, not Okta's, limiting your ability to exercise rights directly against Okta in that context.

How other platforms handle this

Ledger Medium

At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.

Garmin Medium

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...

Strava Medium

We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...

See all platforms with this clause type →

Monitoring

Auth0 has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
When Okta provides its products and services to its customers (e.g., organizations that use Okta to manage their workforce or Auth0 to manage their customer identity), Okta processes personal data on behalf of those customers as a data processor. In those cases, the customer is the data controller and their privacy policy governs the processing of personal data. This Privacy Policy does not apply to personal data that Okta processes on behalf of its customers in its role as a data processor.

— Excerpt from Auth0's Auth0 Privacy Policy

ConductAtlas Analysis

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly implicates GDPR Articles 4(7) and 4(8) defining controller and processor roles, and Articles 26 and 28 governing joint controller and processor agreements. Under GDPR, the data controller bears primary accountability for data subject rights; however, processors may carry independent obligations under Article 28 and cannot sub-process without controller authorization. UK GDPR contains equivalent provisions. The Irish DPC and ICO are the primary supervisory authorities. GOVERNANCE EXPOSURE: High. The dual-role structure is common in enterprise SaaS but creates compliance complexity for organizations deploying Auth0 or Okta as a CIAM or workforce identity solution. If the controller-processor boundary is not clearly established in a current DPA, both Okta and the enterprise customer may face regulatory exposure in the event of a data incident or data subject complaint. The adequacy of Okta's standard DPA terms should be evaluated against GDPR Article 28 requirements. JURISDICTION FLAGS: EU and UK jurisdictions create the highest exposure given GDPR and UK GDPR's explicit controller-processor framework and enforcement track record. California's CPRA also distinguishes between businesses and service providers, with analogous accountability implications. Organizations in healthcare or financial services may face additional contractual requirements beyond a standard DPA. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Okta or Auth0 must ensure a compliant DPA is in place, including provisions for sub-processor management, data breach notification timelines, and audit rights. Procurement teams should review whether Okta's standard DPA adequately covers the organization's specific use case, particularly for Auth0 deployments that authenticate external end users at scale. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that the organization's own privacy notices accurately disclose Okta's and Auth0's role in data processing and that end users are informed of the relevant data controller. Data mapping exercises should reflect the controller-processor boundary. DPA review should be triggered upon onboarding and at each material policy change.

Full compliance analysis

Regulatory citations, enforcement risk, and due diligence action items.

Track 1 platform — free Try Monitor free for 14 days

Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.

Applicable agencies

  • FTC
    The FTC has authority over unfair or deceptive data practices affecting US consumers, including inadequate disclosure of data controller identity and responsibility
    File a complaint →

Applicable regulations

CCPA/CPRA
California, USA
Colorado AI Act
US-CO
Connecticut Data Privacy Act Amendments
US-CT
CAN-SPAM
United States Federal
FTC Act Section 5
United States Federal
GDPR
European Union
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
Universal Opt-Out Mechanism Expansion 2026
US
VPPA
United States Federal

Provision details

Document information
Document
Auth0 Privacy Policy
Entity
Auth0
Document last updated
May 5, 2026
Tracking information
First tracked
May 10, 2026
Last verified
May 10, 2026
Record ID
CA-P-009756
Document ID
CA-D-00692
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
24854c9266e2593701f66c2ff96a660ca3f1c32569b38d50c28c77fd5248028d
Analysis generated
May 10, 2026 22:19 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: Auth0
Document: Auth0 Privacy Policy
Record ID: CA-P-009756
Captured: 2026-05-10 22:19:34 UTC
SHA-256: 24854c9266e25937…
URL: https://conductatlas.com/platform/auth0/auth0-privacy-policy/data-controller-vs-processor-dual-role-distinction/
Accessed: June 27, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Compliance Governance Intelligence

Need to monitor specific governance provisions?

Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.

Arbitration clauses AI governance Data rights Indemnification Retention policies
Start Compliance free trial

Or start with Monitor →

Built from archived source documents, structured governance mappings, and historical version tracking.

Frequently Asked Questions

What does Auth0's Data Controller vs. Processor Dual-Role Distinction clause do?

Many users encounter Okta or Auth0 without realizing it, as it powers login for thousands of enterprise apps. Those users cannot rely on this policy for their data rights; they must look to their employer's or the application's own privacy terms.

How does this clause affect you?

If you access services through an Okta or Auth0 powered login screen, your personal data including authentication credentials and login metadata is processed under your employer's or the app developer's privacy policy, not Okta's, limiting your ability to exercise rights directly against Okta in that context.

Is ConductAtlas affiliated with Auth0?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Auth0.