Ory

Overview

Ory is an open-source identity infrastructure platform that provides authentication, authorization, and session management services. Site operators self-host Ory components or use Ory Network (the cloud offering) to handle login flows, OAuth 2.0 and OpenID Connect, and multi-factor authentication. Its scripts appear on web properties wherever the operator has integrated Ory for user account management rather than building authentication in-house.

What This Script Does

Ory browser scripts perform several authentication functions. During login and registration, the SDK renders form UI and communicates with the Ory identity server to validate credentials. Session management relies on ory_session cookies (typically persistent for the duration configured by the operator, commonly 24 hours to 30 days) that are set on the application domain to maintain authenticated state across page loads. OAuth flows involve short-lived ory_oauth2_* state cookies used during the authorization code exchange, which expire after the flow completes. For CSRF protection, Ory sets a csrf_token cookie per-session. Scripts make network requests to the Ory API endpoint (either self-hosted or *.projects.oryapis.com for cloud deployments) to verify tokens and refresh sessions. MFA flows may involve additional device-trust cookies. The scripts do not perform behavioral analytics or cross-site tracking; all data handling is scoped to identity verification for the operating site.

Consent & Compliance

Authentication cookies that are strictly necessary to provide a service explicitly requested by the user fall within the ePrivacy Directive's exemption for technically necessary cookies. Under GDPR Article 6(1)(b), processing required to perform a contract with the user (i.e., providing account access) is lawful without consent. Ory's session and CSRF cookies qualify as essential under this framework. The IAB TCF purposes framework does not apply. For CCPA/CPRA, authentication data is not sold or shared for cross-context behavioral advertising, so opt-out obligations do not apply. Ory Network (cloud) is a US-based service; cross-border data transfers to Ory's infrastructure require standard contractual clauses or equivalent mechanisms for EU operators. Consent category: essential/functional.

Should You Block This Without Consent?

No. Ory handles authentication — blocking it would prevent users from logging in, registering, or accessing protected content. Session and CSRF cookies are technically necessary for the service to function. Apply privacy-by-design by ensuring Ory is configured to minimize data retention and limit scopes to what the application requires, rather than blocking the scripts.