Okta may buy professional contact and company information about you from external data vendors and combine it with data they already have, even if you never directly gave Okta that information.
This analysis describes what Okta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This means Okta may hold and use personal data about you that you never knowingly provided to them, sourced from data brokers or list vendors, and you may be unaware of its existence or how it was obtained.
Interpretive note: The adequacy of GDPR Article 14 notice delivery for indirectly collected data depends on Okta's operational practices, which are not fully described in this policy document.
This new provision explicitly discloses Okta's practice of purchasing and enriching personal data from external sources, which is a more aggressive data practice not previously disclosed in the policy.
View full change record →Professional contact data such as your name, employer, job title, and business email may be obtained by Okta from third-party data brokers without your direct knowledge, then used for marketing and outreach. Under GDPR, this practice requires a lawful basis and transparency notice; under CCPA, it may constitute 'collection' triggering notice-at-collection obligations.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"We may obtain personal information about you from third-party sources, including business contact information from data providers and list vendors, and information about your company from business information providers. We may combine this information with other personal information we maintain about you.Excerpt from Okta's Privacy Policy
REGULATORY LANDSCAPE: This provision implicates GDPR Articles 13 and 14 (transparency obligations for data not obtained directly from the data subject), Article 6 (lawful basis, likely legitimate interests for B2B marketing), and CCPA/CPRA notice-at-collection requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This means Okta may hold and use personal data about you that you never knowingly provided to them, sourced from data brokers or list vendors, and you may be unaware of its existence or how it was obtained.
Professional contact data such as your name, employer, job title, and business email may be obtained by Okta from third-party data brokers without your direct knowledge, then used for marketing and outreach. Under GDPR, this practice requires a lawful basis and transparency notice; under CCPA, it may constitute 'collection' triggering notice-at-collection obligations.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Okta.