FusionAuth

Overview

FusionAuth is a developer-focused authentication and customer identity platform that organizations deploy either on-premises or in the cloud. Its client-side scripts appear on websites when FusionAuth is used to power login flows, user registration, OAuth consent screens, and multi-factor authentication. Unlike third-party identity providers that operate on separate domains, FusionAuth is typically self-hosted, meaning its scripts may load from the operator's own infrastructure.

What This Script Does

FusionAuth's browser-side scripts manage the complete authentication user experience. They render login and registration forms, handle OAuth and OpenID Connect (OIDC) authorization flows, and manage session tokens for authenticated users. Session state is maintained through cookies — typically a session identifier cookie and potentially an OIDC state parameter cookie used during the authorization code flow. These cookies are essential to the authentication process; without them, users cannot log in or maintain authenticated sessions. Scripts communicate with FusionAuth's API endpoints (either hosted at fusionauth.io cloud or self-hosted URLs) to validate credentials, exchange authorization codes for tokens, and manage refresh token lifecycle. No behavioral tracking or advertising data collection occurs through these scripts. The data transmitted is limited to authentication credentials, session identifiers, and user profile data necessary for identity management.

Consent & Compliance

FusionAuth falls into the essential and functional consent categories. Session cookies set by authentication scripts are strictly necessary for the service to function — a user cannot be logged in without a session identifier. Under GDPR's ePrivacy Directive, strictly necessary cookies do not require user consent. However, FusionAuth as an identity provider does process personal data (usernames, email addresses, authentication logs) on behalf of the site operator, making the operator a data controller and FusionAuth a data processor. A Data Processing Agreement (DPA) should be in place. For self-hosted deployments within the EU, data residency concerns are straightforward. For FusionAuth's cloud offering (US-hosted), EU-US data transfers require reliance on SCCs or the EU-US Data Privacy Framework. Under CCPA/CPRA, authentication data is personal information, but its processing for the purpose of enabling login is a service delivery function rather than sale or behavioral advertising. Consent categories: essential and functional.

Should You Block This Without Consent?

No. FusionAuth scripts perform authentication and session management — processing that is strictly necessary for users to access the service. Blocking these scripts prior to consent would prevent users from logging in. No consent is required to load authentication scripts under either GDPR/ePrivacy or CCPA frameworks.