Does Keycloak require cookie consent?

No. Keycloak is an open-source identity and access management platform that sets session and authentication cookies strictly necessary for login and session continuity. These are essential for a service explicitly requested by the user and are exempt from consent requirements under GDPR and ePrivacy.

What cookies does Keycloak set?

Keycloak sets authentication session cookies including 'KEYCLOAK_SESSION' and 'KEYCLOAK_IDENTITY' to maintain logged-in state, plus 'KC_RESTART' for login flow resumption. OAuth tokens may also be stored as HttpOnly, Secure cookies. Expiry ranges from session-scoped to several hours depending on realm configuration.

How does ConsentStack handle Keycloak on a website?

ConsentStack detects Keycloak scripts and classifies them as essential and functional. Because Keycloak cookies are required for authentication, ConsentStack does not block them even when non-essential consent is withheld. They are surfaced in your consent audit as exempt, strictly necessary cookies.

What tracker domains does Keycloak use?

ConsentStack has catalogued tracker domains for Keycloak including keycloak.org. These are the network destinations Keycloak's scripts contact, which a consent platform blocks until a visitor agrees.

Keycloak (keycloak.org) - Open Source Identity Management Consent

Back to Vendor Library

Overview

Keycloak is an open-source identity and access management platform, primarily maintained by Red Hat and widely deployed by enterprises and developers as a self-hosted or cloud-managed SSO solution. When a web application integrates Keycloak for authentication, the Keycloak JavaScript adapter runs in the browser to manage login flows, session state, and token lifecycle. Its presence on a website indicates that Keycloak is the identity provider for that application.

What This Script Does

Keycloak's browser-side adapter (keycloak.js or keycloak.min.js), served from the Keycloak server domain, handles OpenID Connect and OAuth 2.0 flows in the browser. It manages redirect-based login sequences, receives authorization codes and tokens after authentication, and stores tokens in memory or sessionStorage / localStorage depending on configuration.

Keycloak sets several cookies at the authentication server domain:

KEYCLOAK_SESSION — a session identifier cookie, HttpOnly, scoped to the Keycloak server domain, with expiry matching the SSO session lifetime (typically hours to days)
KEYCLOAK_IDENTITY — an identity token cookie, similarly scoped and HttpOnly
AUTH_SESSION_ID — used during the login flow to maintain state across redirects; typically session-scoped

These cookies are set on the Keycloak server's domain (e.g., auth.example.com), not the application domain directly. The adapter makes requests to Keycloak's token and userinfo endpoints to validate sessions and refresh access tokens transparently.

No advertising data, behavioral analytics, or third-party sharing occurs. The adapter's sole purpose is authentication and session maintenance for the specific application.

Consent & Compliance

Keycloak falls squarely in the essential category. Authentication cookies are explicitly exempt from ePrivacy consent requirements under the "strictly necessary" exception — they are required to deliver the service the user has actively requested (logging in). Without these cookies and the associated script, the user cannot authenticate.

Under GDPR, the lawful basis for processing authentication data is contract (Article 6(1)(b)) — processing is necessary to perform the service the user has signed up for. No separate consent is needed for authentication session management.

Under CCPA/CPRA, authentication data is generally not subject to opt-out rights because it is not sold or shared and is necessary for service delivery. Operators deploying self-hosted Keycloak process data on their own infrastructure; those using cloud-hosted Keycloak (e.g., Red Hat SSO or third-party Keycloak hosting) should execute a DPA with the hosting provider.

Should You Block This Without Consent?

No. Keycloak scripts and cookies are strictly necessary authentication infrastructure. Blocking them would prevent users from logging into the application — a functional outcome that violates the basic service contract. They are exempt from ePrivacy consent requirements and should be categorized as essential, always-on scripts.

Is Keycloak GDPR compliant?

Keycloak typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Keycloak can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Keycloak, not on Keycloak itself.

Visit website