Does Frontegg require cookie consent on my website?

No. Frontegg is an authentication platform categorized as essential. Its session token cookies are strictly necessary for users to access the application. The ePrivacy Directive exempts technically necessary authentication cookies, and GDPR Article 6(1)(b) covers processing under contract performance.

What cookies does Frontegg set?

Frontegg stores authentication session tokens (JWTs) in cookies or browser localStorage after login. Session cookies expire when the browser closes; refresh token cookies persist longer depending on application configuration. Cookie names vary by deployment. No advertising or behavioral tracking cookies are set.

How does ConsentStack categorize Frontegg?

ConsentStack categorizes Frontegg as essential and never blocks its scripts. ConsentStack detects Frontegg by its authentication SDK patterns and session token cookie signatures. Because Frontegg is required for user login and access control, it remains active regardless of visitor consent choices.

What tracker domains does Frontegg use?

ConsentStack has catalogued tracker domains for Frontegg including frontegg.com. These are the network destinations Frontegg's scripts contact, which a consent platform blocks until a visitor agrees.

Frontegg - User Authentication & Login Consent Controls

Back to Vendor Library

Is Frontegg GDPR compliant?

ConsentStack classifies Frontegg's trackers as essential (strictly necessary), so its banner does not block them. That is our classification, not a legal ruling. The exemption from prior consent comes from the ePrivacy Directive (Article 5(3)) and covers only what is strictly necessary for a service the visitor asked for, and the GDPR still governs any personal data, such as an IP address, sent to Frontegg. List Frontegg in your cookie policy and privacy notice so visitors know it is there.

Consent required: Generally exempt, classified strictly necessary
Consent category: essential
Tracker domain: frontegg.com

Overview

Frontegg is a developer-focused user management platform that provides pre-built authentication and user lifecycle components that product teams embed into their web applications. Rather than requiring developers to build login pages, multi-factor authentication, and user settings interfaces from scratch, Frontegg supplies hosted or self-hosted UI components that handle these flows. Its primary audience is B2B SaaS companies building multi-tenant applications where user management complexity is high.

What This Script Does

Frontegg scripts load on pages requiring authentication or user management functionality within a web application. Client-side behavior includes:

Authentication flows: The Frontegg SDK renders login, registration, and MFA screens. These may load as embedded components within the application's own pages or as redirects to Frontegg-hosted login pages. Scripts make requests to Frontegg's authentication API to validate credentials and exchange tokens.

Session token management: Frontegg manages authentication session state using cookies and/or browser local storage. Session tokens (JWTs) are stored client-side and transmitted with API requests to verify user identity. Cookie names and expiry depend on the application's configuration — session cookies expire when the browser closes, while remember-me tokens may persist for days or weeks.

Single sign-on (SSO): For applications using Frontegg's SSO feature, the SDK handles SAML or OIDC redirects to enterprise identity providers. This involves browser redirects and token exchanges with third-party identity providers configured by the operator.

Multi-factor authentication: Frontegg's MFA flows verify TOTP codes, SMS one-time passwords, or hardware keys client-side before completing authentication. Verification requests go to Frontegg's API.

User portal: Frontegg provides an embedded user settings portal where authenticated users manage their profile, security settings, and API tokens. This component makes requests to Frontegg's management API.

Consent & Compliance

GDPR and ePrivacy Directive: Frontegg's authentication cookies and session tokens are strictly necessary for providing the authenticated application service. Users cannot access the application without these mechanisms functioning. The ePrivacy Directive exempts technically necessary cookies from the consent requirement. Under GDPR, session management processing is lawful under contract performance (Article 6(1)(b)) — it is required to deliver the service the user has signed up for. Frontegg acts as a data processor; operators must have a Data Processing Agreement in place.

CCPA/CPRA: Authentication credentials and session tokens are personal information under CCPA. Processing by Frontegg as a service provider for authentication purposes does not constitute a sale or sharing of personal information.

Consent category: essential. Frontegg handles authentication and session management — functions that are technically necessary for the application to operate.

Should You Block This Without Consent?

No.

Frontegg scripts are essential to the application's authentication layer. Blocking them would prevent users from logging in, break session management, and make the application inaccessible. Authentication infrastructure is categorically exempt from consent requirements under the ePrivacy Directive's necessity exemption.

Visit website