%22%3E%0A%3Cg%20clip-path%3D%22url(%23clip1_3355_192)%22%3E%0A%3Cpath%20d%3D%22M32%200H0V32H32V0Z%22%20fill%3D%22url(%23paint0_linear_3355_192)%22%2F%3E%0A%3Cpath%20fill-rule%3D%22evenodd%22%20clip-rule%3D%22evenodd%22%20d%3D%22M20.2506%2022.5213L18.5839%2021.1879L19.4173%2020.1466L20.5159%2021.0253L22.7786%2017.6306L23.8893%2018.3706L21.2226%2022.3706C21.1173%2022.5253%2020.9533%2022.6306%2020.7706%2022.6599C20.7346%2022.6639%2020.7013%2022.6666%2020.6666%2022.6666C20.5173%2022.6666%2020.3706%2022.6159%2020.2506%2022.5213ZM7.99992%2015.9999H10.6666V14.6666H7.99992V15.9999ZM8.00125%2013.3333H12.0013V11.9999H8.00125V13.3333ZM24.0013%209.33325V8.66659C24.0013%208.29859%2023.7026%207.99992%2023.3346%207.99992H14.0013C13.6319%207.99992%2013.3346%208.29859%2013.3346%208.66659V9.33325H6.66659V7.46659C6.66659%207.04125%206.93059%206.66659%207.22925%206.66659H24.7706C25.0706%206.66659%2025.3346%207.04125%2025.3346%207.46659V9.33325H24.0013ZM20.8333%2015.9999C23.3159%2015.9999%2025.3346%2018.0946%2025.3346%2020.6666C25.3346%2023.2399%2023.3159%2025.3333%2020.8333%2025.3333C18.3519%2025.3333%2016.3333%2023.2399%2016.3333%2020.6666C16.3333%2018.0946%2018.3519%2015.9999%2020.8333%2015.9999ZM26.6666%2015.9999V7.46659C26.6666%206.29059%2025.8159%205.33325%2024.7706%205.33325H7.22925C6.18392%205.33325%205.33325%206.29059%205.33325%207.46659V19.1999C5.33325%2020.3773%206.18392%2021.3333%207.22925%2021.3333H15.0653C15.3933%2024.3253%2017.8386%2026.6666%2020.8333%2026.6666C24.0506%2026.6666%2026.6666%2023.9759%2026.6666%2020.6666C26.6666%2017.3586%2024.0506%2014.6666%2020.8333%2014.6666C17.8386%2014.6666%2015.3933%2017.0093%2015.0653%2019.9999H7.22925C6.93059%2019.9999%206.66659%2019.6266%206.66659%2019.1999V10.6666H13.3346V15.9999H14.6679V10.6666V9.33325H22.6666V10.6666V13.3333H24.0013V10.6666H25.3346V15.9999H26.6666Z%22%20fill%3D%22white%22%2F%3E%0A%3C%2Fg%3E%0A%3C%2Fg%3E%0A%3Cdefs%3E%0A%3ClinearGradient%20id%3D%22paint0_linear_3355_192%22%20x1%3D%220%22%20y1%3D%2232%22%20x2%3D%2232%22%20y2%3D%220%22%20gradientUnits%3D%22userSpaceOnUse%22%3E%0A%3Cstop%20stop-color%3D%22%23BD0816%22%2F%3E%0A%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23FF5252%22%2F%3E%0A%3C%2FlinearGradient%3E%0A%3CclipPath%20id%3D%22clip0_3355_192%22%3E%0A%3Crect%20width%3D%2232%22%20height%3D%2232%22%20fill%3D%22white%22%2F%3E%0A%3C%2FclipPath%3E%0A%3CclipPath%20id%3D%22clip1_3355_192%22%3E%0A%3Crect%20width%3D%2232%22%20height%3D%2232%22%20fill%3D%22white%22%2F%3E%0A%3C%2FclipPath%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Amazon Cognito
AWS identity service that handles user sign up, sign in, multi factor authentication, password recovery and federation with social or enterprise identity providers for web and mobile apps.
What does Amazon Cognito do?
What Amazon Cognito does
Amazon Cognito is the identity service of AWS. It provides user pools to sign up and authenticate end users with email, phone, social logins (Google, Facebook, Apple, SAML, OIDC), multi factor authentication and password recovery, and identity pools that grant temporary AWS credentials to authenticated users so an app can call AWS APIs on their behalf.
Data and cookies handled
Cognito processes account attributes (email, phone, custom claims), passwords, MFA secrets, OAuth and OIDC tokens, IP addresses, device fingerprints (when advanced security is enabled) and login activity. The hosted UI sets first party cookies on the auth domain (XSRF token, session cookie) and the client app typically stores ID, access and refresh tokens in cookies or browser storage.
GDPR and ePrivacy implications
Cookies and tokens used to keep a user signed in are strictly necessary under Article 5(3) of the ePrivacy Directive and do not require prior consent. AWS acts as a processor under the AWS Data Processing Addendum, which includes Standard Contractual Clauses and references the EU US Data Privacy Framework. Advanced security features (adaptive authentication, compromised credentials check) involve risk based profiling that should be disclosed in the privacy notice.
Consent requirements
You do not need consent to authenticate a user with Cognito. You do need consent when the login flow loads third party social federation widgets that set tracking cookies (Google, Facebook, Apple), and you must inform users that signing in via a social provider shares some identifiers with that provider.
Data transfers and EU regions
Cognito user pools and identity pools store data in the AWS region you choose. To minimise transfers, deploy in eu west 1 (Ireland), eu central 1 (Frankfurt), eu west 3 (Paris), eu south 1 (Milan), eu north 1 (Stockholm) or eu west 2 (London). Administrative metadata, support tickets and operational telemetry can still be processed by AWS staff in the United States under SCCs and the EU US Data Privacy Framework.
Practical compliance steps
Sign the AWS DPA, select an EU AWS region, enforce strong password policy and MFA, set token validity to a reasonable lifetime, restrict admin actions through IAM roles, log CloudTrail and Cognito events for accountability, document data subject rights workflows (export, deletion via AdminDeleteUser API), and run a DPIA when advanced security features or large scale identity processing are activated.
Amazon Cognito and the GDPR
- Legal basis
- Article 6(1)(b) GDPR (contract performance) for user authentication and account management; Article 6(1)(f) GDPR (legitimate interest) for security and fraud prevention. Consent is only required for optional social or marketing federation that triggers third party tracking.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, German TTDSG, French CNIL guidance on identity providers, Spanish LOPDGDD
Impact assessment (DPIA)
A DPIA is recommended when Cognito is used for large scale authentication, when it processes sensitive categories (health, public sector identity), when it federates with multiple third party identity providers, or when advanced security features perform risk based profiling of user devices and IP addresses.
Sample text for your banner
We use Amazon Cognito (Amazon Web Services) to manage user accounts, sign in and authentication. Authentication cookies and tokens are strictly necessary to keep you signed in. If you choose to log in with a third party provider (Google, Facebook, Apple), those providers may receive your identifiers under their own terms.
What Amazon Cognito sets and contacts
- Tracking method
- OAuth 2.0 / OpenID Connect authentication tokens (JWT), session cookies, identity tokens, optional federation cookies
- Server location
- Configurable AWS region (EU regions available: eu-west-1 Ireland, eu-central-1 Frankfurt, eu-west-3 Paris, eu-south-1 Milan, eu-north-1 Stockholm, eu-west-2 London)
- Data transferred outside the EU
- Amazon Cognito is operated by Amazon Web Services, Inc., a US based company. Customer data stays in the AWS region you select, but administrative metadata, support requests and operational telemetry can be processed in the United States. AWS provides Standard Contractual Clauses and is self certified under the EU US Data Privacy Framework.
Cookies set (7)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| XSRF-TOKEN | http | Session | CSRF protection for the Cognito Hosted UI login forms. |
| cognito-fl | http | Session | Flag cookie used by the Hosted UI to track multi step login flows. |
| csrf-state | http | 10 minutes | Stores the state parameter used during OAuth and federation flows to prevent replay attacks. |
| CognitoIdentityServiceProvider.<clientId>.<sub>.idToken | http | 1 hour (configurable) | Stores the OpenID Connect ID token issued to the authenticated user. |
| CognitoIdentityServiceProvider.<clientId>.<sub>.accessToken | http | 1 hour (configurable) | Stores the OAuth 2.0 access token used to call protected APIs. |
| CognitoIdentityServiceProvider.<clientId>.<sub>.refreshToken | http | 30 days (configurable, up to 10 years) | Allows the client to obtain new access and ID tokens without re authentication. |
| CognitoIdentityServiceProvider.<clientId>.LastAuthUser | http | Persistent | Stores the username of the last user signed in on this device. |
Third-party domains contacted (5)
auth.<region>.amazoncognito.comcognito-idp.<region>.amazonaws.comcognito-identity.<region>.amazonaws.comamazoncognito.comamazonaws.com
Frequently asked questions about Amazon Cognito
Can't find your question? Write to us, we answer fast.
Which cookies does Amazon Cognito set?
The Hosted UI sets XSRF-TOKEN, csrf-state and a flow cookie on its own auth.<region>.amazoncognito.com domain. Once authenticated the client app stores ID, access and refresh tokens, typically as CognitoIdentityServiceProvider.* cookies or browser storage entries.
Do I need consent to use Cognito?
No for authentication itself: session cookies and tokens are strictly necessary. Yes for any social login button that loads Google, Facebook or Apple SDKs that set their own tracking cookies, and yes if advanced security features build a behavioural profile beyond what is required for security.
What is the legal basis for processing identity data?
Article 6(1)(b) GDPR (contract performance) covers account creation, login and password management. Article 6(1)(f) (legitimate interest) covers fraud prevention, abuse mitigation and security audit logs. Consent (Article 6(1)(a)) is needed for optional federation that exposes data to third parties.
Does Cognito transfer data to the United States?
Customer data stays in the AWS region you select. Administrative metadata, support requests, and operational telemetry can be processed in the United States by AWS staff, under Standard Contractual Clauses and the EU US Data Privacy Framework as described in the AWS DPA.
Do I need a DPIA?
A DPIA is recommended (and may be mandatory under Article 35 GDPR) for large scale identity processing, public sector identity, sensitive sectors (health, finance), or when adaptive authentication and risk based profiling are enabled.
How do I implement Cognito compliantly?
Pick an EU AWS region, sign the AWS DPA, enforce MFA, restrict token lifetimes, manage admin access via IAM roles, log via CloudTrail, expose data subject rights flows (export and AdminDeleteUser), and limit the user attributes collected to what is strictly required.
What are the alternatives?
Other identity providers include Auth0, Okta Customer Identity, Microsoft Entra External ID, Keycloak (self hosted), FusionAuth, Ory Hydra/Kratos, Clerk, WorkOS and Supabase Auth. Each has its own residency, pricing and integration model that must be evaluated separately.
How do I update the cookie policy?
Run a cookie scan focused on the auth and callback pages, list the strictly necessary Cognito cookies (XSRF-TOKEN, csrf-state, token storage), note that they are first party on your auth domain, and document any third party social login cookies that are loaded on user action.
Radar
Radar is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Radar integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Radar helps organizations maintain robust websites that meet user expectations and technical requirements.
WWPass
WWPass is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. WWPass supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, WWPass enables informed decisions that improve experience and drive results.
Socure
Socure is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Socure offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Socure empowers organizations to optimize strategy and maximize return on investment.
Login with Amazon
Login with Amazon is an identity and authentication platform providing secure login, single sign-on (SSO), and multi-factor authentication for websites and applications. It supports social login, passwordless authentication, and user management with enterprise-grade security. Login with Amazon simplifies identity implementation for developers while ensuring compliance. With adaptive authentication and anomaly detection, Login with Amazon protects user accounts while maintaining a frictionless experience.
Sift
Sift is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sift integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sift helps organizations maintain robust websites that meet user expectations and technical requirements.
Authy
Authy is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Authy supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Authy enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.