California residents have the right to opt out of Okta sharing their personal data with advertising partners for targeted ads, and can do so through Okta's privacy choices page or by enabling Global Privacy Control in their browser.
This analysis describes what Okta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Even though Okta states it does not 'sell' data in the traditional sense, California law's definition of 'sharing' for advertising purposes is broad enough to capture certain analytics and advertising activities, and California residents have an enforceable right to stop this.
If you are a California resident, Okta acknowledges that some of its third-party data sharing for behavioral advertising may qualify as 'sharing' under CCPA/CPRA, giving you a legally enforceable right to opt out. You can exercise this right immediately through Okta's privacy choices portal or by enabling GPC in a compatible browser.
How other platforms handle this
We may also collect your personal data from other people or companies.
If you are a California resident, you may have the right to: Know what personal information we collect, use, disclose, sell, or share. Correct inaccurate personal information. Delete your personal information. Opt out of the sale or sharing of your personal information. Limit the use and disclosure ...
If you are a California resident, you have the right to: Know what personal information is being collected about you; Know whether your personal information is sold or disclosed and to whom; Say no to the sale of personal information; Access your personal information; Request deletion of your person...
Monitoring
Okta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"California residents have the right to opt out of the sale or sharing of their personal information. Okta does not sell personal information as the term is traditionally defined. However, we may share personal information with third parties in ways that may constitute 'sharing' under California law for cross-context behavioral advertising purposes. California residents may opt out of this sharing by visiting our privacy choices page or by broadcasting an opt-out preference signal (such as the Global Privacy Control).— Excerpt from Okta's Okta Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages CCPA as amended by CPRA, including the right to opt out of sharing of personal information for cross-context behavioral advertising, the requirement to honor GPC signals, and associated obligations regarding retention and use of opt-out preferences. The California Privacy Protection Agency (CPPA) and California Attorney General are the primary enforcement authorities. The policy's acknowledgment that sharing may occur for behavioral advertising purposes is significant and should be evaluated against the full scope of third-party analytics integrations deployed on okta.com. GOVERNANCE EXPOSURE: Medium. The policy's explicit acknowledgment of potential CCPA 'sharing' is a transparent disclosure, but the adequacy of the opt-out mechanism, the accuracy of the data categories disclosed as shared, and the completeness of the 'Do Not Sell or Share' infrastructure are all reviewable. Failure to honor GPC signals is an enforcement priority for the CPPA. JURISDICTION FLAGS: This provision applies specifically to California residents. Similar rights exist under Virginia VCDPA, Colorado CPA, and other state comprehensive privacy laws, though the policy's explicit opt-out mechanism is framed in California terms. Organizations with employees or customers in multiple U.S. states should assess whether Okta's opt-out mechanism satisfies obligations under other state privacy frameworks. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should confirm whether their DPA or service agreement with Okta includes contractual restrictions preventing Okta from using or sharing customer-sourced data for Okta's own cross-context behavioral advertising purposes, as required for CPRA service provider status. COMPLIANCE CONSIDERATIONS: California-regulated organizations using Okta's marketing or website services should verify that Okta's opt-out mechanism is functional, that GPC signals are honored in practice, and that the data categories listed as 'shared' in the policy align with actual third-party integrations. Annual review of Okta's data sharing disclosures is advisable given ongoing CPPA enforcement activity.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Even though Okta states it does not 'sell' data in the traditional sense, California law's definition of 'sharing' for advertising purposes is broad enough to capture certain analytics and advertising activities, and California residents have an enforceable right to stop this.
If you are a California resident, Okta acknowledges that some of its third-party data sharing for behavioral advertising may qualify as 'sharing' under CCPA/CPRA, giving you a legally enforceable right to opt out. You can exercise this right immediately through Okta's privacy choices portal or by enabling GPC in a compatible browser.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Okta.