Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Oct 2, 2026; our capture on Oct 17, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“If your DPF Principles-related complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms”
“Right to Know About Personal Data Collected, Disclosed, or Sold. You have the right to request to know what Personal Data we collect, use, disclose, share and sell about you.”
“Right to Limit the Use and Disclosure of Sensitive Personal Data...If we ever use or disclose your Sensitive Personal Data for a reason other than the legitimate business purposes...we will update this Privacy Policy”
“Right to Non-Discrimination for the Exercise of Your Privacy Rights. You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights conferred by the CCPA.”
“Right to Opt-Out of the Sale or Sharing of Personal Data. You have the right to opt-out of the sale of your Personal Data by us as a business.”
“Each of our customers (each an "Okta customer"), not Okta, controls whether they provide you with an account or other access to the Okta identity cloud service through their subscription”
This document describes how Okta handles your personal information — what it collects, how long it keeps it, and who it shares it with, including event sponsors and third-party ad networks like Google that can track you across the web over time. If you are in California, you have the right to ask what data Okta holds about you, opt out of its sale, and not be penalized for exercising those rights. Your access to Okta's identity services is controlled by the organization that subscribes to Okta, not by Okta directly.
Okta's Privacy Policy establishes the terms under which Okta collects, uses, retains, and shares Personal Data, including Sensitive Personal Data, in connection with its identity cloud services and related activities. It allocates control over individual access to the Okta identity cloud to Okta's customers rather than to Okta itself, and retains Personal Data for periods consistent with the original purpose of collection or as required by legal obligations, dispute resolution, and agreement enforcement. The policy acknowledges that certain sharing of Personal Data may constitute a 'sale' under CCPA, recognizes corresponding opt-out and non-discrimination rights, and commits to updating the policy before using or disclosing Sensitive Personal Data for purposes other than legitimate business purposes. Cross-border transfers to countries lacking adequacy decisions, third-party advertising network tracking, and disclosure of event-attendee Personal Data to sponsors for commercial purposes are also established within the document.
As an individual, Okta retains your Personal Data for as long as consistent with why it was originally collected, with extensions possible for legal obligations, disputes, and enforcement. Okta contracts with third-party advertising networks, including Google, that may track your activity over time across Okta's websites, emails, and other sites. If you are a California resident, you can submit a request to know what Personal Data Okta collects, uses, discloses, shares, or sells about you, opt out of the sale of your Personal Data, and do so without risk of discriminatory treatment from Okta. Attending an Okta event may result in your contact details, content interests, and other activity data being shared with that event's sponsors for commercial purposes.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“If your DPF Principles-related complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms”
“Right to Know About Personal Data Collected, Disclosed, or Sold. You have the right to request to know what Personal Data we collect, use, disclose, share and sell about you.”
“Right to Limit the Use and Disclosure of Sensitive Personal Data...If we ever use or disclose your Sensitive Personal Data for a reason other than the legitimate business purposes...we will update this Privacy Policy”
“Right to Non-Discrimination for the Exercise of Your Privacy Rights. You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights conferred by the CCPA.”
“Right to Opt-Out of the Sale or Sharing of Personal Data. You have the right to opt-out of the sale of your Personal Data by us as a business.”
“Each of our customers (each an "Okta customer"), not Okta, controls whether they provide you with an account or other access to the Okta identity cloud service through their subscription”
“We will retain your Personal Data for a period of time that is consistent with the original purpose of the data collection, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.”
“If you choose to register for or attend a virtual or in-person event or webinar that we host (such as our Oktane customer conference), enter a contest or raffle with us and a sponsor, or download content (such as a …”
“Some of the countries where your Personal Data may be processed, including the United States, are not subject to an adequacy decision by the European Commission or your local legislature and/or regulator”
“Okta shares Personal Data as further described below in Section XI, which may be considered a "sale" of Personal Data under the California Consumer Privacy Act.”
“we contract with third-party advertising networks (e.g., Google) that may track your activity overtime and across different channels, including our websites, email activity, and other websites and applications”
“We use targeting and advertising cookies to help us understand our marketing efforts and to reach potential customers across the web...track your activity overtime and across different channels”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Binding arbitration available for unresolved DPF complaints and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.