FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

Auth0 Lock

EssentialOfficial website

Embeddable JavaScript login widget from Okta owned Auth0 that renders a configurable signup, login and MFA UI on top of an Auth0 tenant and sets authentication session cookies.

Block Auth0 Lock until consentScan my site
Overview

What does Auth0 Lock do?

What Auth0 Lock is

Auth0 Lock is the embeddable JavaScript widget from Auth0, now part of Okta, that renders a configurable signup, login and multi factor authentication UI inside a website or single page application. It connects to an Auth0 tenant through the OAuth 2.0 and OpenID Connect protocols and delegates the heavy lifting (credential storage, MFA, anomaly detection, social federation) to the Auth0 platform.

Cookies and data collected

Once a session is established, Auth0 sets several cookies on the tenant domain (auth0, did, did_compat, auth0_compat) and possibly state cookies on the application origin during the OAuth callback. The widget also collects device fingerprinting signals, IP, user agent and geolocation hints which feed Auth0 anomaly detection, brute force protection and bot detection.

GDPR and ePrivacy implications

Authentication cookies that are strictly necessary to deliver the login service requested by the user are exempt from consent under Art. 5(3) ePrivacy. Device fingerprinting, anomaly profiling and any persistent identifier set beyond the session length do, however, fall under the consent regime, and a transparent privacy notice describing each cookie is required.

International transfers

Auth0 tenants can be pinned to US, EU, AU or JP regions, but Okta Inc. remains a US sub processor that handles anomaly detection, telemetry and global support. Transfers rely on Standard Contractual Clauses, the EU US Data Privacy Framework, and binding corporate rules. A tenant configured in the EU region significantly reduces routine transfers but does not eliminate them.

Practical compliance steps

Pin the tenant to the EU region for European users, sign the Okta Data Processing Addendum, enable custom domains to keep cookies first party, disable optional Auth0 marketing analytics in the dashboard, document attack protection and anomaly detection in the privacy notice and the record of processing.

Compliance

Auth0 Lock and the GDPR

Auth0 Lock is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Authentication cookies and the session needed to deliver the login service the user requested are strictly necessary and exempt from consent. However, optional features such as analytics, marketing redirects, social login persistent identifiers beyond the session, and persistent cross device tracking through device fingerprinting require either consent (Art. 6(1)(a) GDPR) or a documented legitimate interest balancing test (Art. 6(1)(f) GDPR).
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), CCPA, HIPAA (with BAA), SOC 2

Impact assessment (DPIA)

A DPIA is recommended whenever Auth0 is used as the primary identity layer for a high traffic consumer service, when MFA collects biometrics or device telemetry, or when the tenant is set up in the US region while serving EU users. Assess anomaly detection profiling, log retention, attack protection signals and any social or enterprise connections that introduce additional processors.

Sample text for your banner

We use Auth0 Lock from Okta to manage account creation, login and multi factor authentication. Session cookies needed to keep you signed in are set automatically. With your consent, additional optional analytics and device fingerprinting signals are processed to detect suspicious activity and improve security.
Cookies and trackers

What Auth0 Lock sets and contacts

Tracking method
Embeddable JavaScript widget (auth0-lock and the related Auth0.js / auth0-spa-js libraries) that renders a configurable login and signup UI on top of an Auth0 tenant. The widget orchestrates redirect or popup flows to Auth0 hosted endpoints, sets authentication cookies in the Auth0 tenant domain (auth0, did, did_compat, auth0_compat) when a session is established, may set a state cookie at the application origin during the OAuth callback, and forwards device fingerprinting and bot detection signals to Auth0 anomaly detection.
Server location
United States (Okta, Inc., headquartered in San Francisco). Auth0 tenants can be provisioned in the US (default), EU (Frankfurt and Dublin), AU (Sydney), or JP (Tokyo) regions on AWS. Tenant region pins user database, session and log data, but anomaly detection, support, and product telemetry are processed centrally by Okta in the US.
Data transferred outside the EU
Even with an EU tenant, Okta Inc. (the parent company in the United States) acts as a sub processor for anomaly detection, telemetry, support and the unified Customer Identity Cloud back office. Auth0 relies on Standard Contractual Clauses, the EU US Data Privacy Framework, and binding corporate rules. Some integrations (Auth0 Marketplace add ons, social connections) may add further transfers.

Cookies set (6)

NameTypeDurationPurpose
auth0HTTP cookieSessionStores the Auth0 single sign on session for the tenant domain after a successful login.
didHTTP cookie1 yearDevice identifier used by Auth0 for attack protection, anomaly detection and bot detection.
did_compatHTTP cookie1 yearSame device identifier issued without the SameSite attribute for legacy browser compatibility.
auth0_compatHTTP cookieSessionLegacy SSO session cookie used by older browsers that do not handle SameSite=None correctly.
a0_stateHTTP cookie10 minutesStores the OAuth state and nonce values during the authorization code callback to prevent CSRF.
_legacy_auth0.is.authenticatedlocalStoragePersistentUsed by auth0-spa-js to mark a returning user as authenticated for silent token renewal flows.

Third-party domains contacted (6)

  • *.auth0.com
  • *.eu.auth0.com
  • *.us.auth0.com
  • cdn.auth0.com
  • cdn.eu.auth0.com
  • sentry.io
Questions

Frequently asked questions about Auth0 Lock

Can't find your question? Write to us, we answer fast.

Which cookies does Auth0 Lock set?

Auth0 sets session cookies on the tenant domain (auth0, did, did_compat, auth0_compat) plus optional state and nonce cookies on the application origin during OAuth callbacks. Custom domains let you keep these cookies first party on your own domain.

Is user consent required?

Session cookies that are strictly necessary to authenticate the user are exempt under Art. 5(3) ePrivacy. Device fingerprinting, anomaly profiling and persistent identifiers used for cross device analytics require consent.

What is the legal basis?

Contract performance (Art. 6(1)(b) GDPR) covers account creation and login itself. Anomaly detection and attack protection relies on legitimate interests (Art. 6(1)(f) GDPR) and any optional analytics requires consent (Art. 6(1)(a) GDPR).

Are there transfers to the US?

Yes. Even with an EU tenant, Okta Inc. in the United States acts as sub processor for anomaly detection, telemetry and support. Transfers rely on Standard Contractual Clauses, the EU US Data Privacy Framework and binding corporate rules.

Should we run a DPIA?

A DPIA is recommended for high traffic consumer services, biometric MFA, and any tenant pinned to the US region while serving EU users. Document profiling by anomaly detection, log retention, attack protection and any social or enterprise connection.

How do we deploy Auth0 Lock compliantly?

Choose the EU region, enable custom domains, sign the Okta DPA, integrate the widget after consent for any non essential cookies, configure log retention, and disable optional Auth0 marketing analytics in the tenant settings.

Are there alternatives?

EU based identity providers include Keycloak (self hosted, open source), Ory, FusionAuth (self hostable), Frontegg, and managed services like Microsoft Entra External ID or Curity hosted within the EU.

How should we update the cookie policy?

Add an entry for Auth0 Lock, list the session cookies (auth0, did, did_compat, auth0_compat), describe purposes (authentication, attack protection, anomaly detection), durations, US transfer details, and link to Okta's privacy notice and DPA.

Same category

More services: Security

See the whole category

ClickCease

ClickCease is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ClickCease integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ClickCease helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

ipbase

ipbase is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ipbase integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ipbase helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

FraudLabs Pro

FraudLabs Pro is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. FraudLabs Pro supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, FraudLabs Pro ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

AntiBot.Cloud

AntiBot.Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. AntiBot.Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, AntiBot.Cloud ensures optimal performance at scale.

Essential

IPinfo

IPinfo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IPinfo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IPinfo helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

JumpCloud

JumpCloud is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. JumpCloud offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, JumpCloud empowers organizations to optimize strategy and maximize return on investment.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site