Sign in with Apple

Overview

Sign in with Apple is an OAuth 2.0-based authentication service that lets users log into websites using their Apple ID. It is designed with privacy as a core feature, offering email relay (Hide My Email) so users can sign up for services without revealing their real email address. Sign in with Apple appears on websites as a branded login button alongside other social login options.

What This Script Does

Sign in with Apple loads the Apple ID authentication SDK from appleid.cdn-apple.com. The SDK renders the "Sign in with Apple" button and manages the OAuth 2.0 / OpenID Connect authentication flow.

When the user clicks the button, the SDK opens Apple's authentication page (either as a popup or redirect). The user authenticates with their Apple ID credentials and, on first use, chooses whether to share their real email or use Apple's email relay service. Apple then returns an authorization code and an identity token (JWT) to the website's callback URL.

The following data is involved:

• Authorization code: Single-use code exchanged server-side for access and refresh tokens
• Identity token (JWT): Contains the user's unique identifier, email (real or relayed), and name (if shared on first login)
• Session cookies: The website stores session tokens to maintain the authenticated state; these are first-party cookies set by the website, not by Apple

Apple's servers at appleid.apple.com are contacted during the authentication flow. After the initial authentication, ongoing session management is handled by the website's own cookies and tokens. Apple does not set persistent tracking cookies in the user's browser.

Sign in with Apple does not collect browsing behavior, build advertising profiles, or share data with third parties. Apple's email relay system actively prevents the website from learning the user's real email address unless the user explicitly chooses to share it.

Consent & Compliance

Sign in with Apple is classified as essential. It is an authentication mechanism — a core functional requirement for websites that offer Apple ID login as an access method.

Under the GDPR, processing user authentication data falls under contract performance (Article 6(1)(b)) when the user actively initiates a login. The user's explicit action of clicking "Sign in with Apple" and authenticating with their Apple ID constitutes a clear request for the service. Additionally, Apple's privacy-by-design approach (email relay, minimal data sharing) aligns well with GDPR's data minimization principle.

Under the ePrivacy Directive, any cookies or tokens stored during the authentication flow qualify as strictly necessary for a service explicitly requested by the user. Article 5(3) exempts such storage from consent requirements.

Under CCPA/CPRA, Sign in with Apple does not sell or share personal information. Apple acts as an identity provider, and its email relay feature specifically reduces the personal information exposed to the website. The service aligns with CPRA's data minimization requirements.

Should You Block This Without Consent?

No. Sign in with Apple is an authentication service that users explicitly invoke. It processes only the data necessary for login, sets no tracking cookies, and Apple's email relay feature actively protects user privacy. Blocking it behind a consent wall would prevent users from logging in, which defeats the purpose of the service.