Does Clerk require disclosure in our privacy policy?

Yes. Since Clerk collects and processes personal data on your behalf as a third-party processor, you must disclose its use in your privacy policy. Users have a right to know which services handle their information and how. Under GDPR and CCPA, failing to disclose third-party processors can result in regulatory violations and fines.

What specific data does Clerk collect?

Clerk collects email addresses, names, profile photos, OAuth tokens from connected social accounts, IP addresses, and device information. This data is processed to authenticate users, maintain session security, and prevent fraud. The extent of collection depends on your authentication configuration and whether users connect social media accounts.

Does Clerk use cookies or require a cookie consent banner?

Clerk does not use cookies for tracking or analytics. However, you should verify your specific implementation, as some authentication platforms use session management tools that may require disclosure. Review Clerk's current documentation to confirm cookie usage in your deployed version.

Who processes Clerk data and where is it stored?

Clerk Inc, based in the United States, is the data processor. User data is transferred to and stored in U.S. servers. Under GDPR, this international transfer requires appropriate safeguards such as Standard Contractual Clauses. Confirm data residency options with Clerk if your users are primarily in the EU or other regulated regions.

Authentication

Privacy policy clauses for Clerk

Clerk is an authentication platform that provides pre-built user sign-up and login components for websites and applications. It manages user identity verification, allowing visitors to create accounts and securely log in using email or OAuth providers without developers building authentication from scratch.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Clerk collects

Your privacy policy must disclose each of the following data types when you use Clerk.

Name

Profile photo

OAuth tokens

IP address

Device info

When does Clerk trigger privacy obligations?

Installation triggers immediate obligations

The moment you integrate Clerk into your application, you begin collecting email addresses, names, profile photos, OAuth tokens, IP addresses, and device information. This data collection is not conditional—it starts automatically as users authenticate, even before they interact with your core product.

Privacy policy clauses for Clerk

What data Clerk collects

When does Clerk trigger privacy obligations?

Installation triggers immediate obligations

Which regulations apply and why

First concrete step

Where data goes

Common compliance pitfalls

Pitfall 1: Omitting OAuth token collection from privacy disclosures

Pitfall 2: Treating Clerk as a "processor" when you have no DPA

Pitfall 3: Underestimating IP and device data collection for tracking disclosure

Sample privacy policy clause

What regulators look for

What auditors prioritize with Clerk

Frequently asked questions

Does Clerk require disclosure in our privacy policy?

What specific data does Clerk collect?

Does Clerk use cookies or require a cookie consent banner?

Who processes Clerk data and where is it stored?

Don't ship without Bandit.