Third-Party Data Sharing for Advertising and Analytics

What it is

Okta shares your personal data with advertising and analytics companies that can track your behavior across websites to serve you targeted ads, not just with companies that help Okta operate its services.

Why it matters (compliance & governance perspective)

Sharing behavioral data with advertising partners for cross-site tracking extends beyond operational service delivery and creates profiles that follow users across the web, which has significant privacy implications and triggers specific opt-out rights in several jurisdictions.

Consumer impact (what this means for users)

Your browsing behavior on Okta's websites may be shared with third-party advertising networks that use this data to show you targeted ads on other websites, and your interaction patterns may be retained and profiled by these partners under their own privacy policies.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing personal data with advertising partners for behavioral targeting engages GDPR Article 6 (legal basis), Article 7 (consent conditions), and the ePrivacy Directive for EU/EEA users; consent is generally required for non-essential cookies and cross-site tracking in EU jurisdictions. CPRA classifies sharing personal information with third parties for cross-context behavioral advertising as regulated activity subject to consumer opt-out rights under California Civil Code Section 1798.120. The FTC Act applies to material non-disclosure of data sharing for advertising purposes. GOVERNANCE EXPOSURE: Medium. While third-party advertising data sharing is common in B2B marketing, it requires documented consent or legitimate interest assessments for EU users and clear opt-out mechanisms for California residents. Regulators have recently scrutinized cookie consent management platforms for adequacy, and failure to honor opt-out signals (including Global Privacy Control) may constitute a CPRA violation. JURISDICTION FLAGS: EU and UK users require affirmative consent for non-essential advertising cookies; California residents have a right to opt out of sharing for behavioral advertising. Colorado, Virginia, Texas, and other US states with comprehensive privacy laws may impose analogous opt-out requirements. The involvement of advertising partners operating in multiple jurisdictions may complicate sub-processor disclosure obligations. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should assess whether their employees' professional browsing of Okta's marketing properties results in behavioral data being captured by advertising partners, and whether this creates any internal privacy program obligations. Procurement teams should verify Okta's advertising partner list and assess whether those partners' data practices are disclosed. COMPLIANCE CONSIDERATIONS: Legal teams should audit whether Okta's cookie consent management platform honors the Global Privacy Control opt-out signal as required under CPRA. EU compliance teams should verify that advertising cookies are not set prior to affirmative consent. Data mapping should account for data flows to advertising partners as third-party disclosures.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Data Controller vs. Processor Dual-Role Distinction medium
• Personal Data Collection Scope medium
• Cross-Border Data Transfers medium
• California Resident Privacy Rights (CCPA/CPRA) low
• Cookie and Tracking Technology Use medium
• Data Retention low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.