Ory
Ory is an open-source identity and authentication platform that provides login, registration, and access control infrastructure. Its scripts manage authentication flows, set session cookies and OAuth tokens, and handle multi-factor authentication. Ory makes network requests to its identity servers to validate credentials.
Overview
Ory is an open-source identity infrastructure platform that provides authentication, authorization, and session management services. Site operators self-host Ory components or use Ory Network (the cloud offering) to handle login flows, OAuth 2.0 and OpenID Connect, and multi-factor authentication. Its scripts appear on web properties wherever the operator has integrated Ory for user account management rather than building authentication in-house.
What This Script Does
Ory browser scripts perform several authentication functions. During login and registration, the SDK renders form UI and communicates with the Ory identity server to validate credentials. Session management relies on ory_session cookies (typically persistent for the duration configured by the operator, commonly 24 hours to 30 days) that are set on the application domain to maintain authenticated state across page loads. OAuth flows involve short-lived ory_oauth2_* state cookies used during the authorization code exchange, which expire after the flow completes. For CSRF protection, Ory sets a csrf_token cookie per-session. Scripts make network requests to the Ory API endpoint (either self-hosted or *.projects.oryapis.com for cloud deployments) to verify tokens and refresh sessions. MFA flows may involve additional device-trust cookies. The scripts do not perform behavioral analytics or cross-site tracking; all data handling is scoped to identity verification for the operating site.
Consent & Compliance
Authentication cookies that are strictly necessary to provide a service explicitly requested by the user fall within the ePrivacy Directive's exemption for technically necessary cookies. Under GDPR Article 6(1)(b), processing required to perform a contract with the user (i.e., providing account access) is lawful without consent. Ory's session and CSRF cookies qualify as essential under this framework. The IAB TCF purposes framework does not apply. For CCPA/CPRA, authentication data is not sold or shared for cross-context behavioral advertising, so opt-out obligations do not apply. Ory Network (cloud) is a US-based service; cross-border data transfers to Ory's infrastructure require standard contractual clauses or equivalent mechanisms for EU operators. Consent category: essential/functional.
Should You Block This Without Consent?
No. Ory handles authentication — blocking it would prevent users from logging in, registering, or accessing protected content. Session and CSRF cookies are technically necessary for the service to function. Apply privacy-by-design by ensuring Ory is configured to minimize data retention and limit scopes to what the application requires, rather than blocking the scripts.
Is Ory GDPR compliant?
Ory typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Ory can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Ory, not on Ory itself.
Consent Categories
Also Known As
Industries
Tracked Domains (1)
ory.comEssentialory.com is an essential domain operated by Ory, used to keep the site working, including security, load balancing, and sessions.
Frequently Asked Questions
Related Vendors
Manage consent for Ory
ConsentStack automatically detects and manages Ory trackers so your site stays compliant with global privacy regulations.