> How Okta handles authentication data, which cookies it sets, when consent is required and how EU customers comply with GDPR, eIDAS, NIS2 and ePrivacy. > > Canonical: https://www.flowconsent.com/en/services/security/okta Security # Okta Essential · [Official website](https://developer.okta.com) Okta is one of the leading identity and access management platforms, used by enterprises worldwide for single sign on, multi factor authentication, user lifecycle management, federation and customer identity (through the Auth0 brand also operated by Okta). It is built on a hosted authentication flow that issues session cookies and OAuth/OIDC tokens. Okta tenants can be deployed in EU cells (Frankfurt, Dublin), but Okta, Inc. remains a US controller for the platform. [Block Okta until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Required - Documented cookies 7 - Third-party domains 8 - Servers Region selected by the customer at tenant provisioning: EU (Frankfurt, Dublin), US, AU, IN, JP cells. Okta, Inc. is headquartered in San Francisco; the Auth0 product line is operated by Okta and inherited the Auth0 EU and US regions. Overview ## What does Okta do? ## **What is Okta** Okta is a global identity and access management platform operated by Okta, Inc., headquartered in San Francisco. Its Workforce Identity Cloud is used to give employees single sign on, multi factor authentication, lifecycle management and access reviews across hundreds of business applications. Its Customer Identity Cloud, which includes Auth0 acquired by Okta in 2021, secures sign in for consumer and B2B apps with social login, passwordless, brute force protection, anomaly detection and adaptive MFA. Both products are delivered through a hosted authentication flow on okta.com or auth0.com sub domains and a wide range of SDKs. ## **What data and cookies Okta collects** Okta collects username, password (hashed and never stored in clear text), email, phone, MFA factors (OTP secrets, WebAuthn keys), device fingerprint, IP address, User Agent, country, audit log of every authentication, session and configuration change, and any custom claim configured in the directory. On the visitor side, the hosted sign in flow sets a sid session cookie and several technical cookies for CSRF protection (DT, JSESSIONID, t). Auth0 adds its own auth0 cookie and optional anomaly detection signals. ## **GDPR and ePrivacy implications** The Okta authentication cookies are strictly necessary for the user to sign in to the requested service and are exempt from the consent requirement of Article 5(3) ePrivacy. The processing of credentials, MFA and audit logs is grounded on contract performance (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) for security and accounting retention) and legitimate interest in fraud prevention. Anomaly detection or behavioural risk scoring that goes beyond what is strictly necessary should be assessed individually. The privacy policy must list Okta or Auth0 as a processor. ## **Is consent required** No for the strictly necessary authentication cookies and security tokens. Yes for any optional features that go beyond authentication: analytics on the login page, marketing widgets, social login providers that themselves require consent, or persistent device recognition for marketing purposes. The user must always be informed that Okta or Auth0 is involved in the sign in flow. ## **Data transfers and recipients** With an EU cell (Frankfurt or Dublin) selected at tenant provisioning, persistent data stays in the EU. Okta, Inc. (USA) remains the controller of the platform and accesses data for support, security and incident response. Okta is certified under the EU US Data Privacy Framework, offers EU SCCs through the Okta Master Subscription Agreement and the Okta DPA, and publishes a regularly updated sub processor list. Auth0 follows the same regime under the Okta umbrella. For regulated industries, Okta provides FedRAMP, ISO 27001, ISO 27018, SOC 2 Type II and HIPAA attestations. ## **Practical compliance steps** Choose an EU cell at tenant provisioning, sign the Okta DPA with the SCCs annex, list Okta, Inc. and Auth0 as recipients in the privacy policy with the transfer mechanism (DPF and SCC), configure audit log retention to the minimum that satisfies your security and legal obligations, restrict admin access via SSO and MFA, and consider customer managed keys (Bring Your Own Key) for sensitive tenants. Document the integration in the Article 30 record. Compliance ## Okta and the GDPR Okta is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract (Art. 6(1)(b) GDPR) for authenticating the user into the customer's application, legal obligation (Art. 6(1)(c)) for security and audit logs, legitimate interest (Art. 6(1)(f)) for fraud and bot detection; consent (Art. 6(1)(a) and Art. 5(3) ePrivacy) for any optional analytics, marketing or persistent recognition features - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, eIDAS for strong customer authentication scenarios, NIS2 for essential operators, TTDSG, LIL, DORA for regulated financial entities ### Impact assessment (DPIA) Okta processes credentials, MFA factors, audit logs and (with Auth0 hooks) optional behavioural attributes. A DPIA is recommended for customer identity deployments at scale (B2C apps with millions of users, public administration, regulated industries) and should cover the choice of cell, the EU US transfer mechanism, the retention of audit logs and the sub processor list. ### Sample text for your banner > We use Okta to sign you in to our application. Authentication cookies and security tokens are set by Okta on your behalf. Okta is operated by Okta, Inc. (USA) with our tenant data hosted in the EU cell. Cookies and trackers ## What Okta sets and contacts - Tracking method Hosted authentication flow (Okta Identity Engine) with redirect or embedded widget (Okta Sign In Widget), OAuth 2.0 / OpenID Connect tokens, SAML 2.0 federation, SCIM provisioning, optional Auth0 (Okta Customer Identity) JavaScript SDKs and Universal Login - Server location Region selected by the customer at tenant provisioning: EU (Frankfurt, Dublin), US, AU, IN, JP cells. Okta, Inc. is headquartered in San Francisco; the Auth0 product line is operated by Okta and inherited the Auth0 EU and US regions. - Data transferred outside the EU Customer data persists in the chosen Okta cell. Okta, Inc. (USA) operates the service globally and accesses tenant data for support, security and incident response. Okta is self certified under the EU US Data Privacy Framework, lists EU sub processors with their regions in the Okta Trust portal, and offers EU Standard Contractual Clauses through the Okta Master Subscription Agreement. ### Cookies set (7) | Name | Type | Duration | Purpose | | ---------------- | ----------- | -------- | -------------------------------------------------------------------------------------------------------------------------------- | | sid | third party | Session | Okta authenticated session cookie set after successful sign in; strictly necessary for the authenticated experience. | | DT | third party | 1 year | Device token used by Okta to recognise a known device during sign in and to power device based MFA policies. | | JSESSIONID | third party | Session | Back end application server session cookie for the Okta sign in service. | | t | third party | Session | CSRF protection token used during the Okta sign in flow. | | proximity\_<...> | third party | 30 days | Optional Okta cookie used by Okta FastPass and proximity based authentication features. | | auth0 | third party | Session | Auth0 session cookie set on the Auth0 hosted login page (.auth0.com) for the duration of an authentication session. | | auth0\_compat | third party | Session | Compatibility session cookie used by older Auth0 SDKs when the SameSite=None policy cannot be enforced on the main auth0 cookie. | ### Third-party domains contacted (8) - `okta.com` - `.okta.com` - `.oktapreview.com` - `okta-emea.com` - `oktacdn.com` - `auth0.com` - `.eu.auth0.com` - `.us.auth0.com` Questions ## Frequently asked questions about Okta Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Okta set? Okta sets sid (session cookie), DT (device token), JSESSIONID (back end session) and t (CSRF protection) on its hosted authentication domain. These cookies are strictly necessary for sign in and exempt from the consent requirement. Auth0 adds auth0 and auth0\_compat session cookies. ### Do I need consent for Okta? Not for the authentication cookies and tokens themselves, since they are strictly necessary. Yes for any optional analytics or marketing widgets on the login page and for behavioural risk features that go beyond strictly necessary security. ### What is the legal basis for Okta? Contract performance (Art. 6(1)(b) GDPR) for the authentication service, legal obligation (Art. 6(1)(c)) for audit log retention required by security frameworks (ISO 27001, NIS2, eIDAS), and legitimate interest (Art. 6(1)(f)) for fraud and bot prevention. ### Are personal data transferred outside the EU? With an EU cell, persistent data stays in the EU. Okta, Inc. (USA) still has support and security access. Transfers rely on the EU US Data Privacy Framework certification, EU SCCs in the Okta DPA and a public list of sub processors. ### Do I need a DPIA before deploying Okta? For workforce identity on a small workforce, a lightweight DPIA usually suffices. For customer identity at scale, public administration or regulated industries, conduct a full DPIA covering the cell, transfers, audit logs and any custom risk signals. ### How do I deploy Okta compliantly? Pick an EU cell, sign the Okta DPA, configure SSO and MFA for admin access, limit audit log retention to what your obligations require, mention Okta and Auth0 as processors in the privacy policy, and disable optional behavioural risk features that you have not assessed. ### What are the alternatives to Okta? EU based alternatives: Ory (Germany), FusionAuth (open source US, but self hostable in the EU), Keycloak (open source, Red Hat), Microsoft Entra ID (with EU region) and OpenID Connect implementations on top of WSO2 or Authentik. For consumer identity, Auth0 itself is the most direct competitor to its parent Okta, with Auth0 EU regions. ### How should the cookie policy describe Okta? List the Okta cookies (sid, DT, JSESSIONID, t) under Strictly Necessary with provider Okta, Inc. (USA), the purpose (authentication and session management), the retention (session to a few hours) and the transfer mechanism (Data Privacy Framework and SCCs). Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [Blankshield](https://www.flowconsent.com/en/services/security/blankshield) [Blankshield is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Blankshield integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Blankshield helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/blankshield) [Essential](https://www.flowconsent.com/en/services/security/blankshield) · ### [Feroot](https://www.flowconsent.com/en/services/security/feroot) [Feroot is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Feroot integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Feroot helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/feroot) [Essential](https://www.flowconsent.com/en/services/security/feroot) · ### [ClickCease](https://www.flowconsent.com/en/services/security/clickcease) [ClickCease is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ClickCease integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ClickCease helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/clickcease) [Essential](https://www.flowconsent.com/en/services/security/clickcease) · ### [Sardine](https://www.flowconsent.com/en/services/security/sardine) [Sardine is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Sardine integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Sardine makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/security/sardine) [Essential](https://www.flowconsent.com/en/services/security/sardine) · ### [WWPass](https://www.flowconsent.com/en/services/security/wwpass) [WWPass is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. WWPass supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, WWPass enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/wwpass) [Essential](https://www.flowconsent.com/en/services/security/wwpass) · ### [Forter](https://www.flowconsent.com/en/services/security/forter) [Forter is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Forter supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Forter ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/forter) [Essential](https://www.flowconsent.com/en/services/security/forter) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)