Do I need consent to use FusionAuth on my website?

No for authentication. FusionAuth scripts handle login flows, OAuth, OIDC session management, and registration. Session cookies are strictly necessary to maintain authenticated state and fall under the essential category exempt from consent requirements under GDPR and CCPA.

What cookies does FusionAuth set?

FusionAuth sets session cookies to maintain authenticated user state across page loads. These cookies store encrypted session tokens and expire when the browser session ends or after a configured timeout. They are required for login functionality to operate correctly.

How does ConsentStack handle FusionAuth authentication scripts?

ConsentStack classifies FusionAuth as an essential vendor. Authentication session management is a strictly necessary function, so ConsentStack allows FusionAuth scripts and cookies to load without user consent and excludes them from consent-gated blocking rules.

What tracker domains does FusionAuth use?

ConsentStack has catalogued tracker domains for FusionAuth including fusionauth.com. These are the network destinations FusionAuth's scripts contact, which a consent platform blocks until a visitor agrees.

FusionAuth - Authentication & Identity Consent

Back to Vendor Library

Overview

FusionAuth is a developer-focused authentication and customer identity platform that organizations deploy either on-premises or in the cloud. Its client-side scripts appear on websites when FusionAuth is used to power login flows, user registration, OAuth consent screens, and multi-factor authentication. Unlike third-party identity providers that operate on separate domains, FusionAuth is typically self-hosted, meaning its scripts may load from the operator's own infrastructure.

What This Script Does

FusionAuth's browser-side scripts manage the complete authentication user experience. They render login and registration forms, handle OAuth and OpenID Connect (OIDC) authorization flows, and manage session tokens for authenticated users. Session state is maintained through cookies — typically a session identifier cookie and potentially an OIDC state parameter cookie used during the authorization code flow. These cookies are essential to the authentication process; without them, users cannot log in or maintain authenticated sessions. Scripts communicate with FusionAuth's API endpoints (either hosted at fusionauth.io cloud or self-hosted URLs) to validate credentials, exchange authorization codes for tokens, and manage refresh token lifecycle. No behavioral tracking or advertising data collection occurs through these scripts. The data transmitted is limited to authentication credentials, session identifiers, and user profile data necessary for identity management.

Consent & Compliance

FusionAuth falls into the essential and functional consent categories. Session cookies set by authentication scripts are strictly necessary for the service to function — a user cannot be logged in without a session identifier. Under GDPR's ePrivacy Directive, strictly necessary cookies do not require user consent. However, FusionAuth as an identity provider does process personal data (usernames, email addresses, authentication logs) on behalf of the site operator, making the operator a data controller and FusionAuth a data processor. A Data Processing Agreement (DPA) should be in place. For self-hosted deployments within the EU, data residency concerns are straightforward. For FusionAuth's cloud offering (US-hosted), EU-US data transfers require reliance on SCCs or the EU-US Data Privacy Framework. Under CCPA/CPRA, authentication data is personal information, but its processing for the purpose of enabling login is a service delivery function rather than sale or behavioral advertising. Consent categories: essential and functional.

Should You Block This Without Consent?

No. FusionAuth scripts perform authentication and session management — processing that is strictly necessary for users to access the service. Blocking these scripts prior to consent would prevent users from logging in. No consent is required to load authentication scripts under either GDPR/ePrivacy or CCPA frameworks.

Is FusionAuth GDPR compliant?

FusionAuth typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So FusionAuth can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads FusionAuth, not on FusionAuth itself.

Visit website