Clerk

Overview

Clerk is an authentication-as-a-service platform used by Next.js, React, and other JavaScript framework developers who want to delegate identity management. It handles the full authentication lifecycle — sign-up, sign-in, multi-factor authentication, session management, and user profile storage. Because Clerk manages active user sessions, its scripts and cookies are present on every authenticated page of any application built with it, making it a ubiquitous essential service in the sites that use it.

What This Script Does

Clerk loads its frontend SDK from clerk.browser.js or via the @clerk/nextjs / @clerk/clerk-react packages compiled into the host application. The script communicates with the Clerk Frontend API at clerk.[yourdomain].com (custom domain) or [app-slug].clerk.accounts.dev (shared infrastructure).

Session cookies: Clerk sets __session (a JWT containing the active session) and __client (a persistent client identifier) cookies on the host domain. The __session cookie is short-lived (typically 1 minute); the __client cookie persists for the browser session or longer depending on "remember me" configuration. Clerk also uses __client_uat (a Unix timestamp for session freshness detection) as a non-HttpOnly cookie readable by client-side code.

Local storage: Clerk stores additional session metadata in localStorage under clerk-[publishable-key] prefixed keys for active token caching and client state.

Network requests: On every page load, Clerk's script calls the Frontend API to validate and refresh the active session token. These requests transmit the session JWT and return updated tokens. No third-party advertising or analytics data is collected.

Authentication flows: Sign-in and sign-up use Clerk-hosted or embedded UI components that communicate exclusively with Clerk's authentication infrastructure.

Consent & Compliance

GDPR and ePrivacy Directive: Clerk's session cookies are strictly necessary for the authenticated application to function. A user cannot access a protected resource without a valid session token. Under the ePrivacy Directive, strictly necessary cookies are exempt from the consent requirement. No consent is required to set Clerk's authentication cookies for logged-in users. The __client persistent identifier cookie may warrant disclosure in the privacy policy as it persists beyond individual sessions.

CCPA/CPRA: Authentication session data constitutes personal information under CCPA. Clerk acts as a service provider processing identity data on behalf of the application operator. Clerk does not sell user identity data to third parties. The application operator remains the data controller for user account information stored in Clerk.

The consent category is essential. Authentication is a functional necessity with no marketing or analytics purpose.

Should You Block This Without Consent?

No.

Clerk scripts are strictly necessary for authenticated application functionality. Blocking them would prevent users from signing in or accessing any protected features. No consent is required before loading Clerk in applications that require authentication. Disclose Clerk's session cookie use in your privacy policy, but do not gate it behind a consent prompt.