internet international
Do I need to ask for permission to use tokens?
<p>I know that you need to ask the user for permission to use cookies. However I use OAuth from Google Firebase. OAuth works with tokens instead of cookie-authentication, however, for the user it makes no difference. She/he gets authenticated across pages. Since I didn't find anything regarding "permission for tokens", I assume that I don't need it. Is this right? Any legal proof would be awesome.</p>

<p>Yes, in order to be compliant with regulations and laws such as the GDPR, you should be asking for permission to use any identifier which is sent between the client and the server with any request, if that identifier allows you to track an individual user.</p>

<p>The <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">actual text of the GDPR</a> contains the following definition:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, <strong><em>an identification number</em></strong>, location data, <strong><em>an online identifier</em></strong> or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>

<p>This includes:</p>

<ul>
<li><strong>Cookies</strong> (the most obvious one)</li>
<li><strong>ETag</strong> (if you are not using an etag value across multiple users, it can be used to identify a single user and thus counts as an online identifier)</li>
<li><strong>Bearer tokens</strong> (issued to individual users, so obviously is an online identifier)</li>
</ul>

<p>amongst many other things.</p>

<p>So yes, you should be asking for consent, and you should be highlighting this in your privacy policy, including how you are using the tokens and what information the token contains (see the website <a href="https://jwt.io" rel="nofollow noreferrer">jwt.io</a> to see what information most OAuth tokens have the potential to leak).</p>

<p>You cannot prove a negative. There is no legal requirement client permission for using OAuth tokens. If there was any legal proof available, it would be to prove, it was required. Since such proof does not exist, you do not need to ask the client permission to use OAuth tokents.</p>

<h2>The issue doesn’t arise</h2>

<p>It’s inherent in the oauth system that permission is asked and if it’s not given, the service doesn’t work.</p>
