Auth0
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Okta/Auth0 collects lots of marketing and device data, shares for ads with an opt-out, and can close site accounts without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Contact and work info, device and usage data, cookies, location, and sometimes event photos or recordings.
Read the exact line
Privacy policy
“Like most websites, applications, and software across the Internet, Okta collects certain Personal Data when you access and use our websites, applications, software, and products and services”
Training
They use it to run the business, send marketing, improve products, and show ads across the web.
Read the exact line
Privacy policy
“We use targeting and advertising cookies to help us understand our marketing efforts and to reach potential customers across the web.”
Sharing
Service providers, partners, affiliates, and third-party ad networks can get your data.
Read the exact line
Privacy policy
“We share your Personal Data, such as metadata, location, device type, behavior information such as pages visited or viewed, time spent, specific actions taken”
Kept
They keep it as long as they need it for the original purpose, legal rules, or disputes.
Read the exact line
Privacy policy
“We will retain your Personal Data for a period of time that is consistent with the original purpose of the data collection, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.”
Controls
You can unsubscribe from marketing, manage cookies, and request access or deletion via a form.
Read the exact line
Privacy policy
“If you would like to make a request and exercise your rights described above or have questions or concerns, please complete our online form or reach out to us using the contact information below.”
Fine print
They can change site rules without notice, close accounts anytime, and you must cover their legal costs if you break the rules.
Read the exact line
Terms of service
“Okta reserves the right to modify these Terms at any time without prior notice. Continued use of the Site after the “Last Updated Date” constitutes acceptance of the modified Terms.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of sale or sharing for ads
“Your Privacy Choices” link at the bottom of okta.com
Turn off non-essential and ad cookies
Cookies Settings OneTrust preference center or Auth0 by Okta Cookie Settings
Unsubscribe from marketing email
Unsubscribe link in emails or Okta Subscription Center
Request access or deletion
Online form or privacy@okta.com
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If you post on their site, they can use that content forever, anywhere, and let others use it too.
Read the exact line
Terms of service
“By posting content, reviews, or materials (“Submissions”), you grant Okta an , , worldwide, , license to use, reproduce, modify, and distribute your content in any media.”
For example, a comment you leave on a community page could be reused in their marketing without paying you.
If your posts or use of the site get them sued, you may have to pay their lawyers.
Read the exact line
Terms of service
“You agree to , and Okta, its officers, directors, and employees from any third-party claims, losses, damages, or expenses (including attorneys' fees) arising out of your violation of these Terms or your Submissions.”
For example, if you post someone else’s photo and they sue Okta, you could be on the hook for legal bills.
They can shut your website account without warning.
Read the exact line
Terms of service
“Okta reserves the right to suspend or terminate your account at any time, for any lawful reason, without notice.”
For example, your community login could disappear overnight with no email first.
They admit some ad sharing can count as selling personal data under California law.
Read the exact line
Privacy policy
“This may be considered “sharing” or a “sale” under the .”
For example, your email or browsing on their site may be used so Okta ads follow you on other sites.
Outside ad companies can track you across sites and emails.
Read the exact line
Privacy policy
“We contract with third-party advertising networks (e.g., Google) that may track your activity overtime and across different channels, including our websites, email activity, and other websites and applications that display advertisements.”
For example, visiting an Okta page could later show you Okta ads on YouTube.
They can change the rules and keeping using the site means you agree.
Read the exact line
Terms of service
“Okta reserves the right to modify these Terms at any time without prior notice. Continued use of the Site after the “Last Updated Date” constitutes acceptance of the modified Terms.”
For example, new limits could appear and still bind you if you visit the next day.
Exact GPS location is supposed to need your consent.
Read the exact line
Privacy policy
“If we collect your precise geolocation data, we will do so only with your consent.”
For example, they should not grab precise GPS unless you agree in a prompt.
They do not get your actual face or fingerprint data from the phone unlock.
Read the exact line
Privacy policy
“If you authenticate using Touch ID, Face ID, Face Unlock or Fingerprint Unlock, we are only notified as to whether the authentication was successful and cannot access the Face ID, Touch ID, Face Unlock, or Fingerprint Unlock.”
For example, unlocking Okta Verify with Face ID only tells them pass or fail.
There is a website link to opt out of sale or sharing for ads.
Read the exact line
Privacy policy
“You may opt out by clicking the "Your Privacy Choices" link at the bottom of our website and selecting your preferences on that page.”
For example, a California user can open Your Privacy Choices and turn off ad sharing.
They say the sites are not for kids under 16.
Read the exact line
Privacy policy
“We do not knowingly collect Personal Data from children under the age of 16.”
For example, a parent can ask them to delete data if a child signed up.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
How we got here · grade D · score 34/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect contact and work data plus device IDs, usage logs, cookies, location, installed-app details, and third-party marketing lists—more than needed just to log in.
Does it record your voice, face or body, and what happens to that?
They say they cannot access Face ID or fingerprint data; they only learn if unlock succeeded. Event photos or recordings are separate marketing uses.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use targeting cookies and third-party ad networks such as Google that track activity across sites and email.
Do they sell or share your data, and can you opt out?
They share with partners and ad companies and say this may be a CCPA “sale,” with an opt-out via Your Privacy Choices.
What rights do they take over what you type and what the AI makes?
Posts and materials you submit get an irrevocable, perpetual, worldwide, sublicensable license.
How long do they keep your data after you delete it, and can you delete it in the app?
Deletion is by request (form or email). They keep data for the original purpose and legal needs, with no short in-app wipe timeline.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe a written security program with administrative, technical, and physical safeguards, but no independent audit in this text.
Is there a real age gate, and are teens protected?
Site accounts must be 18+. They say they do not knowingly collect from children under 16, with no strong age check described.
Will they tell you when the rules change, and is the policy specific?
Website terms can change at any time without prior notice; continued use means you accept. Privacy updates may get extra notice if material.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate a site account at any time, for any lawful reason, without notice.
If something goes wrong, who pays?
The site is “as is” with no liability for damages, and you must indemnify Okta for claims from your use or posts.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 10,437 words at a college graduate level (Flesch reading ease 34.1); the terms are 1,113 words at a fairly hard level.
