Okta may buy professional contact and company information about you from external data vendors and combine it with data they already have, even if you never directly gave Okta that information.
This analysis describes what Okta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This means Okta may hold and use personal data about you that you never knowingly provided to them, sourced from data brokers or list vendors, and you may be unaware of its existence or how it was obtained.
Interpretive note: The adequacy of GDPR Article 14 notice delivery for indirectly collected data depends on Okta's operational practices, which are not fully described in this policy document.
Professional contact data such as your name, employer, job title, and business email may be obtained by Okta from third-party data brokers without your direct knowledge, then used for marketing and outreach. Under GDPR, this practice requires a lawful basis and transparency notice; under CCPA, it may constitute 'collection' triggering notice-at-collection obligations.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
Okta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may obtain personal information about you from third-party sources, including business contact information from data providers and list vendors, and information about your company from business information providers. We may combine this information with other personal information we maintain about you.— Excerpt from Okta's Okta Privacy Policy
REGULATORY LANDSCAPE: This provision implicates GDPR Articles 13 and 14 (transparency obligations for data not obtained directly from the data subject), Article 6 (lawful basis, likely legitimate interests for B2B marketing), and CCPA/CPRA notice-at-collection requirements. The FTC has addressed data broker practices under its unfair or deceptive acts authority. The relevant EU enforcement authority is the Irish Data Protection Commission for Okta Ireland Limited. GOVERNANCE EXPOSURE: Medium. B2B data enrichment is a common practice, but GDPR Article 14 requires that when personal data is not collected directly from the individual, the controller must provide a privacy notice to the data subject within a reasonable period. The policy's disclosure partially satisfies this, but the adequacy of notice delivery (whether affected individuals actually receive it) may be questioned. JURISDICTION FLAGS: EU/EEA individuals have the right to know the source of indirectly collected data under GDPR Article 14(2)(f). California residents can request disclosure of categories of sources under CCPA. Individuals in jurisdictions with strict data minimization requirements may find broad enrichment practices subject to challenge. CONTRACT AND VENDOR IMPLICATIONS: Organizations contracting with Okta for marketing services should assess whether Okta's use of third-party enrichment data creates any co-controller liability or conflicts with their own data governance policies. Procurement teams should request details about which data vendors Okta uses and whether those vendors maintain adequate data subject consent or legitimate interest assessments. COMPLIANCE CONSIDERATIONS: Legal teams should verify whether Okta's privacy notice adequately satisfies GDPR Article 14 obligations for indirectly collected data, including the requirement to inform individuals of data sources. California compliance teams should confirm Okta's notice-at-collection disclosures are updated to reflect data broker sourcing as required by CPRA amendments.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This means Okta may hold and use personal data about you that you never knowingly provided to them, sourced from data brokers or list vendors, and you may be unaware of its existence or how it was obtained.
Professional contact data such as your name, employer, job title, and business email may be obtained by Okta from third-party data brokers without your direct knowledge, then used for marketing and outreach. Under GDPR, this practice requires a lawful basis and transparency notice; under CCPA, it may constitute 'collection' triggering notice-at-collection obligations.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Okta.