Privacy policy clauses for Google Sign-In
Google Sign-In is an authentication service that allows users to log into websites using their existing Google account credentials. Websites use it to streamline registration and login processes while reducing the need for users to create and remember separate passwords.
Free scan · No signup · Results in 60 seconds
What data Google Sign-In collects
Your privacy policy must disclose each of the following data types when you use Google Sign-In.
When does Google Sign-In trigger privacy obligations?
Installation & Data Flow
Google Sign-In begins transmitting data the moment a user clicks the sign-in button. Google LLC receives the user's email address, full name, and profile photo URI—these flow directly from Google's servers to your application backend via OAuth 2.0 token exchange. This is not optional redaction; the data transfer happens before the user even lands on your app's dashboard.
Threshold Triggers by Jurisdiction
GDPR (EU/EEA users): Any collection of an email address and name constitutes personal data under GDPR Article 4(1). You trigger obligations immediately upon deployment if you have any EU user base. There is no minimum user threshold.
CCPA (California users): Collection of email and name triggers CCPA Section 1798.100 rights (access, deletion, opt-out) if the user is a California resident. No threshold applies.
UK GDPR & UK Privacy Policy:
