Gigya

Overview

Gigya (now SAP Customer Data Cloud) is an enterprise customer identity and access management (CIAM) platform. It provides social login, user registration, progressive profiling, consent management, and identity federation for large consumer-facing brands. Gigya processes hundreds of millions of consumer identity records globally and serves as a consent repository for GDPR and CCPA compliance workflows.

What This Script Does

Gigya's client-side SDK is a comprehensive identity management library that handles the full user authentication lifecycle.

Script Files and Domains

• gigya.js — Primary SDK (~300–500KB). Loaded from cdns.gigya.com. Provides all client-side identity functionality including social login buttons, screen-sets, and API methods.
• gigya-cs.js — Companion script for screen-set rendering and UI customization.
• API calls to datacenter-specific endpoints: accounts.us1.gigya.com, accounts.eu1.gigya.com, accounts.eu2.gigya.com, accounts.au1.gigya.com (varies by deployment region).
• Social login redirects go through socialize.{datacenter}.gigya.com for token exchange with Google, Facebook, and Apple.

Cookies Set

• gig_bootstrap_{apiKey} — Authentication flow state cookie. Short-lived (session-scoped). Stores the current authentication step and prevents CSRF during login.
• gig_canary — Canary deployment cookie for A/B testing of Gigya SDK versions. Persists for up to 6 months.
• gig_login — Set after successful authentication on some deployments. Contains an encrypted session reference. Persists for the configured SSO session duration.
• glt_{apiKey} — Gigya Login Token. First-party cookie containing the authenticated session token. Persists according to the site's SSO session policy (typically 2 weeks to 1 year for "remember me" flows).
• Social platform third-party cookies: When social login is initiated, Facebook sets _fbp, Google sets SAPISID/HSID during the OAuth flow.

Data Collected Per Interaction

• Social profile data returned by the identity provider (name, email, profile picture, social UID) — scope is configurable
• User-entered registration fields (configurable; may include name, email, date of birth, phone number, custom fields)
• Consent preferences: which policies were accepted, version of policy accepted, timestamp, and IP address of consent
• Progressive profiling data: additional fields collected across multiple sessions
• Login events: timestamp, login method, IP address, device type
• Account activity: profile updates, consent changes, social account connections

Consent Management Features Gigya includes its own consent management module (now branded as SAP Customer Data Cloud Consent Management) that records granular consent preferences per user, per purpose, and per version of privacy policies. This makes Gigya itself a consent repository — it stores the consent records that your GDPR compliance depends on.

Analytics Module When Gigya Analytics is enabled, behavioral events (login frequency, social login usage, registration funnel drop-off) are sent to Gigya's analytics infrastructure.

Consent & Compliance

Consent category: Functional / Analytics (split by module)

• GDPR/ePrivacy: The core authentication functionality operates under Article 6(1)(b) (contract performance) for sites requiring accounts, or Article 6(1)(f) (legitimate interest) for sites where login is optional but beneficial. Progressive profiling and analytics features require explicit consent under Article 6(1)(a). The glt_ session token cookie is strictly necessary for maintaining authenticated state. The Gigya Analytics module requires consent.
• CCPA/CPRA: Identity data (name, email, social profiles) is personal information subject to access and deletion rights under CCPA. Gigya provides APIs to fulfill DSARs (data subject access requests) and deletion requests.
• EU data residency: Gigya offers EU datacenter options (eu1, eu2, eu5). Organizations processing EU resident data should configure their Gigya deployment to use EU datacenters to avoid cross-border transfer concerns.
• EU-US Data Privacy Framework: For US deployments, SAP (as Gigya's parent) participates in the DPF. SCCs are available as an alternative transfer mechanism.
• DPA enforcement history: The Irish DPA (DPC) has investigated social login consent practices. Ensure that Gigya's social login implementation presents clear, affirmative consent prompts before initiating OAuth flows that share data with social platforms.

Should You Block This Without Consent?

Conditional. Gigya's core authentication is functional and cannot be blocked without preventing users from logging in. However, the analytics module and progressive profiling features should be disabled or blocked until functional/analytics consent is obtained. Social login buttons that trigger OAuth flows to Facebook and Google should not be rendered until the user has acknowledged data sharing with those platforms — many DPAs consider rendering social login buttons as implicit data transfer initiation.