One Identity claims it has a legitimate business reason to send you marketing emails and contact you about its products without needing your explicit consent, as long as it believes the communications are relevant to your professional role.
This analysis describes what OneLogin's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The reliance on legitimate interests as a legal basis under data protection frameworks (such as GDPR) establishes the procedural mechanism by which OneLogin processes marketing-related personal data without requiring opt-in consent, provided the entity's interests are deemed to outweigh user privacy interests.
The updated policy discloses that OneLogin may record calls with consent and use AI to analyze call transcripts, chat conversations, and sales emails for multiple purposes including follow-up task identification, call summarization, sales analytics, communication effectiveness analysis, and forecast modeling. Under the revised terms, recorded call audio and video may be reviewed for employee training, monitoring, and coaching purposes. The policy also states that OneLogin will save chat and call conversation data to inform future interactions. These practices apply when you communicate with OneLogin via phone calls, chat, email, text, or other teleconference solutions. You should review the updated disclosure to understand how your communication data will be processed and retained.
View change record →The updated policy removes explicit language describing how OneLogin uses AI to analyze customer communications. Previously, the policy stated that call audio and video would be recorded with consent and analyzed using AI to identify follow-up tasks, summarize calls, and conduct sales analytics; that chatbot conversations would be analyzed and saved; and that sales emails would be analyzed to determine communication efficacy and forecast next steps. These specific AI analysis practices are no longer described in the updated policy. The revised language also narrows one stated data use purpose, changing 'answers or services you have asked or licensed' to 'services you have purchased.' No consumer opt-out mechanisms or alternative disclosures are provided in the change text.
View change record →This provision explicitly mentioning 'legitimate interests' as a legal basis was removed, potentially obscuring the legal justification for marketing communications that was previously disclosed.
View full change record →One Identity may send you unsolicited marketing communications based on its own assessment that this is in its legitimate business interests, without obtaining your prior consent — though you can object to this processing and request it stops.
Cross-platform context
See how other platforms handle Legitimate Interests as Legal Basis for Marketing and similar clauses.
Compare across platforms →Monitoring
OneLogin has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We rely on our legitimate interests to process your personal information for business development and marketing purposes, including to send you information about our products, services, and events that we believe may be of interest to you as a business professional.— Excerpt from OneLogin's OneLogin Privacy Policy
REGULATORY FRAMEWORK: GDPR Art. 6(1)(f) permits processing based on legitimate interests only where those interests are not overridden by the data subject's rights and freedoms. GDPR Art. 21 grants an absolute right to object to processing for direct marketing. UK GDPR mirrors these provisions. The UK ICO and EDPB have issued guidance indicating that direct marketing to individuals requires a Legitimate Interests Assessment (LIA) and that consent is often the more appropriate basis. PECR (Privacy and Electronic Communications Regulations 2003) in the UK may additionally require prior consent for electronic marketing.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The reliance on legitimate interests as a legal basis under data protection frameworks (such as GDPR) establishes the procedural mechanism by which OneLogin processes marketing-related personal data without requiring opt-in consent, provided the entity's interests are deemed to outweigh user privacy interests.
One Identity may send you unsolicited marketing communications based on its own assessment that this is in its legitimate business interests, without obtaining your prior consent — though you can object to this processing and request it stops.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OneLogin.