Okta Verify

"We may collect information about your location when you use our websites, mobile applications, and products and services. Your location can be determined with varying degrees of accuracy by your IP address and information about things near your device, such as Bluetooth-enabled devices. The types of location data we collect and how long we store it depend in part on your device and settings."

Okta collects location data not only via IP address but also by detecting nearby Bluetooth-enabled devices, enabling passive proximity-based location tracking beyond what most users would expect from an identity management service.

"Some of our products and services may collect data about the applications that are installed on your device. Collectively, we refer to this data as 'Ancillary Data'. ... In addition to the categories of Personal Data listed above, we may collect certain categories of Sensitive Personal Data from you... biometric information for the purpose of unique identification."

Okta collects data about applications installed on your device and may collect biometric information, going beyond what's needed for core identity management functionality.

"We may disclose your Personal Data, such as contact information, business details, and content interest and activity details, to our partners and resellers for business purposes, such as to carry out our business or for joint marketing efforts to reach our customers and prospective customers. ... We share your Personal Data, such as metadata, location, device type, behavior information such as pages visited or viewed, time spent, specific actions taken... with third-party advertising and marketing providers."

Okta shares personal data broadly with partners, resellers, event sponsors, and advertising providers, including behavioral data like pages visited, time spent, and specific actions taken.

"We contract with third-party advertising networks (e.g., Google) that may track your activity over time and across different channels, including our websites, email activity, and other websites and applications that display advertisements. They may use this tracking information to understand and predict your interests, to display an advertisement for Okta on another website (e.g., Google inventory including Google Display Network, RLSA, YouTube and Performance Max)."

Okta uses third-party advertising networks that track user activity across multiple websites, email, and applications over time, building cross-channel profiles to predict interests and serve targeted ads.

"We will retain your Personal Data for a period of time that is consistent with the original purpose of the data collection, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We determine the appropriate retention period for Personal Data by considering the amount, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorized use or disclosure of your Personal Data and whether we can achieve the purposes of the processing through other means."

Okta provides no specific retention timelines and uses vague criteria like 'consistent with the original purpose' and 'reasonably necessary,' giving them broad discretion to retain data indefinitely.

"This Privacy Policy may be updated from time to time, to reflect changes in our practices, technologies, additional factors, and to be consistent with applicable data protection and privacy laws and principles, and other legal requirements. If we do make updates, we will update the 'effective date' at the top of this Privacy Policy webpage. If we make a materially significant update, we may provide you with notice prior to the update taking effect."

Okta reserves the right to update the privacy policy at any time, with only optional notice for material changes ('may provide you with notice') and no requirement for user consent before changes take effect.