I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Learn how to seamlessly integrate Auth0 into your newsletter sign-up process, ensuring compliance with GDPR regulations. This simple guide walks you through different methods to collect user consent for newsletter signups.

Engaging your users and keeping them informed about the latest features you deploy is crucial for any successful online business. However, it's equally important to ensure your communication efforts comply with users’ right to privacy and regulations like GDPR.

Thankfully, if you're already using Auth0 for user authentication, you have a powerful tool at your disposal to streamline the process of obtaining consent for email communications.

In this article, we'll delve into how you can leverage Auth0's capabilities to seamlessly integrate GDPR-friendly newsletter sign-ups directly into your existing user registration or onboarding flows. We'll cover best practices for obtaining explicit consent using two different approaches. By the end, you'll have a streamlined system that not only grows your email list but also fosters trust and transparency with your users.

## Method 1: Customize Signup and Login Prompts

Auth0's Universal Login feature provides a convenient way to add a newsletter sign-up option directly into your existing login or registration process. You can easily customize the Universal Login sign-up form to include an input checkbox for newsletter subscriptions.

When designing this checkbox, it's crucial to use clear and concise language that leaves no room for ambiguity. The checkbox should be unchecked by default, and the wording should explicitly state that the user is agreeing to receive marketing emails from your company.

Here's an example using Auth0 signup prompts for gathering consent:

![Example of Auth0 signup prompts for gathering consent for marketing purposes](https://images.ctfassets.net/23aumh6u8s0i/4n1CUQRKeGZDfnh4WaPoH/310a9792c14981c94634e94498d98b72/checkbox-consent-example.png)

Once the user submits the form, Auth0 can store their consent status as a custom field in their user profile. This allows you to easily track who has opted in to receive your newsletter and segment your audience accordingly.

The documentation provides great detail on [how to customize signup and login prompts](https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts), so I won't be covering the steps here, but I'll share some of the code I used to set up the example above.

To add the new field to the signup form, I made the following call to the management api:

```shell
curl -L -X PUT 'https://{auth0-domain}/api/v2/prompts/signup/partials' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer {access-token}' \
-d '{"signup":{"form-content-end":"<div class=\"ulp-field\"><input type=\"checkbox\" name=\"ulp-newsletter-consent\" id=\"newsletter-consent\"><label for=\"newsletter-consent\">I agree to receive information and commercial offers to my e-mail.</label></div>"}}'
```

Which will inject the following HTML after the login form.

```html
<div class="ulp-field">
    <input type="checkbox" name="ulp-newsletter-consent" id="newsletter-consent" />
    <label for="newsletter-consent">I agree to receive information and commercial offers in my e-mail.</label>
</div>
```

Then, I'm using Auth0 Actions to automatically sign up the user to my newsletter service. Here's the code for the action:

```javascript
exports.onExecutePreUserRegistration = async (event, api) => {
  const consent = event.request.body['ulp-newsletter-consent'];

  if(consent) {
    api.user.setUserMetadata("newsletter_consent", consent);
    api.user.setUserMetadata("newsletter_consent_date", Date.now());

    // Call the newsletter service API to subscribe the user
    await fetch(`https://newsletter-api.example.com/u/${event.user.email}`, {
      method: "POST"
    })
  }
};
```

You'll have to adapt the HTTP call to match your newsletter service API, or, what I prefer to do, is to add the email to a processing queue, which then triggers the newsletter subscription.

<include 
    src="LinkCard" 
    title="There's a lot more you can do with prompts" 
    link="https://auth0.com/docs/customize/login-pages/universal-login/customize-signup-and-login-prompts" 
    description="Explore the documentation to find out other use cases and examples for prompts." 
/>

### Key considerations for this approach:

- **Integrated with Sign-Up Form**: This method seamlessly blends the newsletter sign-up with the user's initial interaction.
- **Social Login & Passkeys**: Keep in mind that this approach won't work if your primary login methods are social logins (e.g., Google, Facebook) or passkeys.
- **Custom Domain and Custom Page Template Required**: To leverage this functionality, you'll need to have a custom domain set up for your Auth0 tenant.

## Method 2: Using Auth0 Forms for Dedicated Consent Collection Step

If you need a more comprehensive consent collection solution or want to gather additional information beyond a simple yes/no for the newsletter, [Auth0 Forms](https://auth0.com/docs/customize/forms) is the solution for you. This approach involves presenting users with a dedicated form during the authentication process, allowing for more detailed data collection and tailored consent options.

Auth0 Forms is a powerful visual editor that empowers you to create custom, dynamic forms that integrate seamlessly with your authentication flows. These forms can be, for example, used for:

- **Progressive profiling**: Collect user preferences, demographics, or any other data relevant to your business.
- **Enforce Policies**: Require users to accept updated terms and conditions or privacy policies before accessing your application.
- **Customize Authentication Flows**: Add steps to your login or sign-up processes, such as email or phone number verification, OTP, account linking, or consent collection.
- **Trigger Custom Actions**: Initiate backend processes or workflows based on user input.

### How Can Auth0 Forms Be Used for Consent?

Auth0 Forms provide a flexible framework for obtaining and managing user consent in various scenarios:

- **Newsletter Sign-Ups**:  Create a dedicated form with clear and concise language to request explicit consent for email communications.
- **Terms and Conditions Acceptance**:  Present updated terms or policies to users and require their acceptance before continuing.
- **Data Usage Consent**:  Seek permission for specific data processing activities, such as personalized advertising or data analytics.
- **Granular Permissions**:  Offer users fine-grained control over their data by allowing them to choose which types of communication they want to receive.

Here's an example of a form that collects information about the user and asks for marketing consent the second time the user logs into the application.

![Example of Auth0 Forms to collect user information and marketing consent](https://images.ctfassets.net/23aumh6u8s0i/74OX4QmLN20UuPpyIbglk4/acfcc586f1f472584b3aacea98974da3/auth0-forms-consent.png)

<include 
    src="LinkCard" 
    title="Auth0 Forms is a great resource to further customize your authentication flow." 
    link="https://auth0.com/docs/customize/forms" 
    description="Explore the documentation to find out how to build your own forms or use pre-defined templates for common use cases." 
/>

### Key considerations for this approach:

- **Universal Compatibility**: Auth0 Forms works seamlessly with all authentication methods, including social logins and passkeys, providing flexibility for your user base.
- **Additional Step**: Be aware that this method adds an extra step to the authentication flow, which, only for the purposes of asking consent, can potentially affect user experience. Consider balancing the need for comprehensive consent with the desire for a streamlined login process.
- **Versatile Usage**: Auth0 Forms aren't limited to just newsletter sign-ups. They can be used for a variety of scenarios, such as accepting terms and conditions, requesting permission for specific data usage, or collecting user preferences. This versatility makes Auth0 Forms a valuable tool for managing ongoing compliance and user engagement.

## Best Practices for Obtaining Explicit Consent

To ensure your newsletter sign-up process is fully GDPR-compliant, there are several best practices you should follow. First and foremost, use clear and concise language on your sign-up forms. Avoid legalese or confusing terminology, and be upfront about what the user is signing up for.

Additionally, consider offering granular consent options. Instead of just one checkbox for all types of communication, you could provide separate checkboxes for newsletters, product updates, or other types of emails. This gives users more control over the emails they receive and can improve engagement rates.

Another effective strategy is implementing a double opt-in process. This means that after a user submits their email address, they receive a confirmation email with a link they must click to verify their subscription. This extra step helps ensure that the email address is valid and that the user genuinely wants to receive your newsletter.

Finally, it makes it easy for users to manage their communication preferences. Provide a clear link in your emails where users can update their subscriptions or unsubscribe altogether. This demonstrates respect for their privacy and can help prevent spam complaints.

## Conclusion

By following the steps outlined in this article, you can seamlessly integrate GDPR-friendly newsletter sign-ups into your Auth0-powered website or application. This not only ensures compliance with data protection regulations but also builds trust with your users, leading to higher engagement and a more successful email marketing program.

Thanks for reading!

Using Auth0 to Collect Consent for Newsletter Signups

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How Startups and SMBs can balance compliance with growth



For startups and small and medium-sized businesses (SMBs), “Move fast and break things” is no longer a viable philosophy for data privacy. Today’s startups and SMBs face the same relentless pressure to innovate, grow, and scale as the Silicon Valley darlings of yesteryear but must contend with a slew of new laws demanding much greater care in how customer data is handled.

The rapidly shifting attitudes and regulations governing data privacy are putting executives in a challenging position. After all, customer data remains an essential asset in doing business, and tasking developers to build and maintain identity management tools is costly and time-consuming and pulls them away from working on your company’s core product.

Data privacy laws have existed in Europe, the Middle East, and Africa for some time, but we’re in the midst of a new wave of global laws, led by the EU and California. Given the threat of massive fines, and the genuine public interest in preventing data mismanagement, startup and SMB executives are having to give [data privacy](https://auth0.com/explore/data-privacy/) greater consideration than in the past.

In this piece, we’ll offer a primer on current and upcoming data privacy laws and discuss how outsourcing identity management can make you compliant without sacrificing growth.

## Catch up to (and get ahead of) the laws

The current data privacy laws differ in their specifics, but they operate from similar sets of principles. The most fundamental shared mandates concern the right of users to access and control their personal data and the obligation of companies to disclose a breach of such data.

To comply with these laws, companies must be transparent in communicating their data practices and offer users the means to control, export, and remove their data.

Looking at the two most prominent laws and the others they have inspired will give executives a sense of where these trends are heading.

![Illustration of data privacy separator 01](https://images.ctfassets.net/23aumh6u8s0i/4XkWjoyQ9J2SUHkUo63OzT/f3fc030e823110e367abe0179057b4b0/data-privacy-illustration-separator-01)

## General Data Protection Regulation ([GDPR](https://auth0.com/gdpr/))

The EU’s landmark privacy legislation set the standard for the new age of data privacy by emphasizing user consent and calling for transparency and accountability in data collection. The GDPR applies to any company (not just tech) that processes the data of EU residents, regardless of the company’s size or where they are headquartered.

Anyone who doubted the seriousness of this law has been proved wrong by the wave of GDPR fines issued in recent months, prompting one Gabe Morazan, director of product management at CrownPeak to dub 2019 the “[year of enforcement](https://digiday.com/media/2019-is-the-year-of-enforcement-gdpr-fines-have-begun/).”

While the fines levied against Google and other major corporations have grabbed headlines, smaller companies are far from exempt. [TechRepublic](https://www.techrepublic.com/article/gdpr-fines-levied-so-far-the-lessons-businesses-can-learn/) reports that in the past year, a Portuguese hospital, a Danish taxi company, and the German social media company Knuddels were all slapped with penalties for failing to adequately protect, delete, or anonymize data. As TechRepublic states: “It does not matter to the European data protection authorities whether violations of the provisions of the GDPR are unintentional mistakes stemming from neglect, laziness, sloppiness, or ignorance.”

## California Consumer Privacy Act ([CCPA](https://auth0.com/blog/yes-data-privacy-applies-to-you/))

California’s privacy law, which takes effect January 1, 2020, has a great deal of policy overlap with the GDPR, though there are also [substantive differences](http://bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA-GDPR-Chart.pdf). The CCPA applies to companies with customers in California, provided they:
- Have a gross revenue above $25 million
- Hold data on more than 50,000 consumers
- Earn at least half their revenue from selling personal data.

The [CCPA](https://auth0.com/ccpa/) allows for personal data to be collected, used, and sold, provided it is sufficiently deidentified. However, much like the GDPR, it requires that companies make their data collection policies available to customers and give them the ability to opt out of certain types of reselling. 

CCPA has also undergone several significant [amendments](https://www.adlawaccess.com/2019/09/articles/ccpa-update-legislature-amends-the-ccpa-to-exclude-employee-data-b2b-communications-for-one-year/) that require, among other things, for data brokers to register in California, for businesses to require at least two ways for customers to request information, and a one-year exemption on collecting employee data.

![Illustration of data privacy separator 02](https://images.ctfassets.net/23aumh6u8s0i/6qHnwuxvn5oC7kf9p7rIDj/f1bc4b28698f0c853632d08b1bd6f674/data-privacy-illustration-separator-02)

## Future (stricter) legislation

More laws are currently on the books or in the works that go much further than CCPA or the GDPR. However, in this environment, it’s easy for founders to be confused about which set of laws to tailor their product to. But generally, it’s a good rule of thumb to build on the principles laid out in the legislation discussed above, while still keeping an eye on the latest developments.

The [EU’s ePrivacy Regulation](https://iapp.org/news/a/eprivacy-regulation-continues-to-stall-but-theres-hope/) hasn’t passed yet, due to concerns that it’s too strict in prohibiting benign forms of tracking and cookies, but some form of it is likely to pass in the coming months.

In the United States, Maine's privacy law goes into effect in July 2020, and as the _[National Law Review](https://www.natlawreview.com/article/maine-s-new-internet-privacy-law-what-you-need-to-know)_ explains, it “requir[es] broadband internet service providers (ISPs) to obtain a customer’s express, affirmative consent before using their personal information, including browsing history.” Meanwhile, enforcement of Nevada’s [Senate Bill 220](https://www.infolawgroup.com/blog/2019/6/4/nevada-enacts-new-online-privacy-law-requiring-opt-out-rights-for-data-sales) became effective on October 1, 2019, and that law may be more aggressive than the CCPA in its requirements for letting consumers opt out of data sales.

Many of these laws have different definitions for crucial concepts, such as what constitutes personally identifiable information and how it should be anonymized. This patchwork of legislation presents a minefield that any company would struggle to navigate. Many observers think Congress is highly likely to pass unifying federal data-privacy legislation in the near future, but until then, whichever state passes the strictest laws effectively forces every company to play by its rules.

## Get control of your data

Like it or not, laws like GDPR and CCPA represent a huge paradigm shift in data privacy, and meeting their demands requires an immediate response. Of course, changing how your company handles data is a challenge for any team, and especially for startups and SMBs that are also trying to grow.

That’s why a [Wall Street Journal survey](https://www.wsj.com/articles/businesses-across-the-board-scramble-to-comply-with-california-data-privacy-law-11567947602) found that, even when faced with serious fines and a loss of public trust, only 52% of companies expect to be CCPA-compliant by the January 2020 deadline.

The unpleasant truth is that most companies don’t even have the ability to assess their current data privacy picture. User data is frequently siloed across applications, and companies frequently lack clear protocols for managing permissions.

You can’t tackle your data security until you have a holistic, high-level view of how it’s being accessed, and by whom, so getting this bird’s-eye view is the first step in getting compliant.

![The Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)

The [Auth0 dashboard](https://auth0.com/docs/dashboard) lets you manage all of your users, employees, and third parties, quickly enabling or revoking permissions as needed. This kind of intuitive, de-siloed interface will be critical in order for companies to comply with the legal mandate (shared by the CCPA and the GDPR) that users be able to access, delete, or change their data in a timely fashion.

Once you have an organized look at your users, the best way to minimize your company’s exposure to fines and scandal is to minimize your data’s exposure to breaches. Implementing [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) can give your company a huge boost in security, not just from cybercriminals using stolen user credentials but also from stolen admin or third-party contractor credentials, which can lead to massive data breaches.

As you restructure your company’s data privacy policy, keep in mind that it’s not enough to meet the legal requirements. Your company must also integrate well with other businesses, which are changing their attitudes and expectations around data privacy.

For example, Apple recently announced that any app on its platforms that allows for third-party sign-in options must also include [Sign In with Apple](https://auth0.com/blog/auth0-adds-sign-in-with-apple-as-ootb-integration/). This is considered a privacy-friendly option since Apple doesn’t share information on nearly the same scale as Facebook or many other social login providers.

[Auth0](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/) is already integrating it into [Universal Login](https://auth0.com/docs/universal-login) as an out-of-the-box option. This integration is a must for any company that wants access to the App Store, and with Auth0, you can do it by flipping a [single toggle](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/).

![Auth0 Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

## Shift your philosophy, not just your policy

These laws, and the public outcry that brought them into being, require that companies make data privacy a foundational principle woven into their entire operations. The legislators behind CCPA and GDPR have indicated that they will consider whether companies have acted “[in good faith](https://auth0.com/blog/data-privacy-2019-the-lowdown/)” when issuing fines. Proving good faith starts with aligning your company’s philosophy to the legal demands, and there are some actionable methods to put that into practice.

Changing your company culture around data privacy and security starts with getting internal alignment. [Develop employee training](https://www.vyond.com/resources/how-to-create-cybersecurity-training-videos-for-employees/) that educates your team on how to avoid social engineering attacks, such as phishing, and on the importance of following protocol in protecting data flow.

Embrace [transparency](https://auth0.com/blog/cybersecurity-shouldnt-be-a-secret/) in your cybersecurity and data collection policies to avoid appearing underhanded. Failing to explain how and why you’re collecting data leaves you vulnerable to scandal. Email startup [Superhuman](https://www.dailydot.com/debug/superhuman-email-privacy-scandal-explained/) became the most recent example of this phenomenon. Users learned the company collected location data via tracking pixels, and, despite a public apology, the damage to Superhuman’s credibility has been done. The backlash from this type of scandal can hurt even established companies, but the reputational damage is particularly devastating to startups and SMBs.

It’s hard to shift gears around data privacy overnight, and it’s even harder if you try to do it all yourself. For many startups and SMBs, off-loading identity management onto an IdaaS company like Auth0 is the most cost-effective way to shift your approach. If you’re rapidly scaling, and your team doesn’t have the bandwidth or expertise to address all of these issues, you can reap the benefits of Auth0’s accreditations and integrations without having to worry about constantly updating and maintaining identity to keep pace with the next set of laws — leaving you free to focus on your business processes and the core business driving your need for an identity solution.

<include src="TweetQuote" quoteText="It’s hard to shift gears around #CCPA or #GDPR overnight, and it’s even harder if you try to do it all yourself. How offloading #identity can help."/>

## Compliance doesn’t have to stall growth

Even if your company is under the minimum size for CCPA fines, you should still design your identity solution with growth in mind. You don’t want to lose out on landing a major customer because they aren’t confident your policies are up to their standards.

Conversely, you don’t want to slow your company’s growth by making your developers code for the complex and ever-changing demands of data privacy. For the vast majority of startups, off-loading identity management to experts is the smartest choice to allow you to focus on delivering your product. To learn more about your legal obligations and how our platform can meet your company’s needs, reach out to an Auth0 representative.

<include src="TweetQuote" quoteText="Even if your company is currently under the minimum size for #CCPA fines, why you should still design your identity solution with growth in mind."/>

<include src="asides/AboutAuth0" />

---


Data Privacy 101

Calif. AG’s independent report released last weekend project a total initial compliance spend of $55 billion



Last weekend, the State of Calif. Attorney General released an [_independent report_](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf) putting the estimated cost of [California Consumer Privacy Act (_CCPA_)](https://auth0.com/ccpa/) initial compliance for the world’s fifth-largest economy at [_$55 billion_](https://www.cnbc.com/2019/10/05/california-consumer-privacy-act-ccpa-could-cost-companies-55-billion.html). While much of the focus has been on larger companies like Google and Facebook, as Wired explained, the companies most likely to feel the sting aren’t operating at that scale. [_It’s the smaller companies that could take a larger percentage hit_](https://www.wired.com/story/why-californias-privacy-law-wont-hurt-facebook-or-google/)

![The smaller companies in California are most likely to feel the CCPA sting](https://images.ctfassets.net/23aumh6u8s0i/6nOzt9wsmyGnfsP6Z4DsdA/d71c4b8dc04f9b80daf6f5d05d25e72c/downtown-los-angeles-at-night)

## Which rights are granted?

[CCPA](https://auth0.com/ccpa/) builds on the state’s existing data privacy law, which has not kept up with the [evolving definition of Personal Information (PI)](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). The law affords consumers four key rights:

1. **Right to Know:** The right to be informed about how and why and when data is collected, what data or categories of data is collected, as well as the disclosure of use and sales of PI.
2. **Right to Delete:** The ability to request that businesses delete PI collected from the consumer and direct service providers to also delete (unless excepted).
3. **Right to Opt-Out:** Consumers can direct a business selling a consumer’s PI to stop. Minors from 13-16 may not have their PI sold without affirmative authorization. Under 13, that authorization must come from a parent or legal guardian.
4. **Right to Non-Discrimination:** No business may discriminate against a consumer for exercising any of these rights. They can’t deny goods or services, charge different prices or provide a different level or quality of service. But, a business can offer different rates or service if the value is reasonably related to the consumer’s data.

With 6 amendments waiting for a signature from the governor of the State of California by Oct. 13, 2019, the law is expected to go into effect on Jan. 1, 2020 with enforcement beginning on July 1, 2020. 

For those who remember the onset of EU’s data privacy regulation, GDPR (General Data Privacy Regulation), this may sound similarly stressful, but if you’re already GDPR compliant, you are part way there. Still, this is an untested law with some admittedly fuzzy language. How strictly it will be enforced remains to be seen. Based on the AG’s recent report, here’s what companies can expect in terms of cost.



## 4 categories of cost

The AG’s report outlines four main costs. As we saw with CCPA, thinking through the full impact of the law will require legal costs [_if you fall within the requirements_](https://auth0.com/explore/data-privacy/) and could include rethinking your business model.

1. **Legal costs:** You’ll need an attorney to evaluate your technical and business plans. No matter what you read online, your best source is the legal consultant you pay to interpret the law regarding your specific situation. 
2. **Operational:** You’ll need to establish some non-technical infrastructure and procedures for handling compliance.
3. **Technical:** Establishing the technologies to handle requests from large numbers of consumers and for things like establishing an [opt-out button on your home page](https://www.jdsupra.com/legalnews/the-ccpa-has-placed-a-mandatory-link-on-61019/) if you sell PI.
4. **Business:** The law may impact your business model or require renegotiations with service providers.

## Back of the napkin costs

So total compliance cost is going to vary. How much? The AG’s report expects that 75% of all California businesses will be expected to comply, with the total cost of efforts coming in at approximately $55 billion collectively, which is 1.8% of California’s 2018 Gross State Product.


![Back of the napkin costs](https://images.ctfassets.net/23aumh6u8s0i/6GpHGCRbM7AJlMje9mVpBZ/ed454437152884777d738933ca72947c/back-of-the-napking-costs)

*Source: *[*_Standardized Regulatory Impact Assessment: California Consumer Privacy Act of 2018 Regulations_*](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf)* *


Also important is that 83% of California’s businesses will be able to leverage their GDPR compliance. The laws aren’t perfectly aligned, which is why we are seeing [_CEOs like Apple’s Tim Cook and Satya Nadella call for a global data privacy law_](https://www.businessinsider.com/satya-nadella-on-gdpr-2019-1).

<include src="TweetQuote" quoteText="Back of the napkin estimates of how much your company might need to spend to become #CCPA compliant."/>


## Future-proofing

Compliance isn’t a one-and-done activity. It requires regular maintenance and monitoring, which will vary according to business model and company size. While the rapidly evolving data privacy landscape can seem daunting. Having gone through GDPR compliance, many Auth0 customers tell us that identity can be a good place to begin to [_properly clarify what data they need to retain to give their customer’s the experiences they expect_](https://auth0.com/explore/data-privacy/). If you’d like to learn more about how Auth0 can help you move towards CCPA identity compliance, reach out to [_an Auth0 expert_](mailto:%20sales@auth0.com).

![View of Bay Bridge and San Francisco from Treasure Island California](https://images.ctfassets.net/23aumh6u8s0i/1GtfAs85Q7o2WxEOXnhIhW/5177191cb38ed3a34a2530e67841e2c7/view-bay-bridge-san-francisco-from-treasure-island-california)

<include src="TweetQuote" quoteText="The State of Calif. AG estimates initial CCPA compliance costs at $55B. Find out what your company can expect to spend."/>

<include src="asides/AboutAuth0" />


How Much Will CCPA Cost Your Company?

GDPR and CCPA provide real motivation, but with rapid legislative shifts, it’s time to put your data house in order.


If you think General Data Privacy Regulation ([GDPR](https://auth0.com/gdpr/)) fines are only for big companies like Facebook, you're wrong.

Yes, their fines make big news. [Another €1M fine](https://techcrunch.com/2019/07/24/facebook-settles-with-ftc-5-billion-and-new-privacy-guarantees/) from Italy for Cambridge Analytica on top of [€10M](https://www.theguardian.com/technology/2018/dec/07/italian-regulator-fines-facebook-89m-for-misleading-users) for misleading sign-in practices and [€3M for What'sApp data](https://techcrunch.com/2016/08/25/whatsapp-to-share-user-data-with-facebook-for-ad-targeting-heres-how-to-opt-out/) plus a whole suite of investigations underway in Ireland makes for a lot of ink. Plus Facebook is a living test case for what is (and isn't) possible. (To say nothing of the [$5 billion in fines levied by the U.S.](https://www.wsj.com/articles/ftcs-5-billion-fine-alone-wont-get-facebook-out-of-crosshairs-11563043006)!)

The quieter fines don't see quite as much press, but that doesn't mean that they're not happening. Just ask the [Spanish soccer league La Liga](https://iapp.org/news/a/spanish-dpa-fines-la-liga-250k-euros-for-alleged-gdpr-violations/) or [Portuguese hospital Centro Hospitalar Barreiro Montijo](https://iapp.org/news/a/first-gdpr-fine-in-portugal-issued-against-hospital-for-three-violations/).

![Illustration of data privacy separator 01](https://images.ctfassets.net/23aumh6u8s0i/4XkWjoyQ9J2SUHkUo63OzT/f3fc030e823110e367abe0179057b4b0/data-privacy-illustration-separator-01)

## Motivation Intended (And Storing in Plain Text = Bad)

Data privacy fines also get a lot of ink and eyeballs because deterrents are viewed as great motivators, but a deeper look at Knuddels.de reveals that deterrents aren't the entire rationale behind the GDPR.

[The first GDPR fine from Germany](https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/) followed a hack of the chat app [Knuddels.de](https://www.knuddels.de/). In September of 2018, 808,000 email addresses and passwords were compromised, with 330,000 unique users exposed. The company reported within the 72-hour requirement, but after the Landesbeauftragter für den Datenschutz (LfDl) investigation revealed that the passwords had been stored in plain text, they received a relatively low €20,000 fine.

It's helpful to consider that GDPR didn't just pop up out of nowhere. It evolved from existing data privacy laws and the intent to alter company behavior.

The GDPR report cited Knuddels.de's "exemplary cooperation" and, as LfDl Head Stefan Brink told the International Association of Privacy Professionals ([IAPP](https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/)), "As a DPA it is not important for the LfDI to compete for the highest possible fines. What counts in the end is the improvement of data protection and data security for the users concerned."

SIDE NOTE: If you're currently storing your passwords in plain text and feeling somewhat relieved because [Facebook](https://www.wired.com/story/facebook-passwords-plaintext-change-yours/) and [Twitter](https://www.zdnet.com/article/twitter-says-bug-exposed-passwords-in-plaintext/) have also done so, please stop. Not everyone is as forgiving as the LfDl and they might become less forgiving over time. We can also help you with [more secure storage](https://auth0.com/docs/connections/database) --- and it will be relatively painless. The key takeaways from above are that cooperation matters and the end goal isn't torturing tech companies --- the end goal is the improvement of data protection and security.

![Illustration of data privacy separator 03](https://images.ctfassets.net/23aumh6u8s0i/2IcNXJTVFVawhlPPlYTTzh/74524d2abaec83a0e56adbc3fe92b040/data-privacy-illustration-separator-03)

## U.S Patchwork - New York Indicator

The recently failed [New York Privacy Act](https://www.govtech.com/policy/NYs-Data-Privacy-Bill-Failed-Is-There-Hope-Next-Session.html) would have required businesses to act as "data fiduciaries," meaning that companies would be required to put the interest of their people whose data they protect ahead of their own financial interests, much the way that doctors or lawyers are required to protect data (more on that in this [Atlantic](https://www.theatlantic.com/technology/archive/2016/10/information-fiduciary/502346/) article.)

The bill would also allow "private right of action," which means private parties could bring lawsuits and it would apply to companies of any size. It also would have applied to businesses of any size.

Although a comprehensive New York Privacy Act looks unlikely, don't be lulled by the fact that this act recently failed. Parts of it could come back to life in the next session &mdash; and it's not the only U.S. state addressing data privacy.

[Nevada recently updated their law to include opt-out rights for data sales](https://www.infolawgroup.com/blog/2019/6/4/nevada-enacts-new-online-privacy-law-requiring-opt-out-rights-for-data-sales)--- and it goes into effect October 2019. [Maine also passed a law reportedly tougher than CCPA](https://thehill.com/policy/technology/447824-maine-shakes-up-debate-with-tough-internet-privacy-law), which will require users to opt-in before companies can sell data. It goes into effect on Jan. 1, 2020, and [more are on the books](https://iapp.org/news/a/us-state-comprehensive-privacy-law-comparison/).

![Illustration of data privacy separator 02](https://images.ctfassets.net/23aumh6u8s0i/6qHnwuxvn5oC7kf9p7rIDj/f1bc4b28698f0c853632d08b1bd6f674/data-privacy-illustration-separator-02)

##  Get Ahead of the Patchwork of Legislation

Many are already complaining about the disruptive impact of the patchwork of U.S. state data privacy laws. The U.S. Congress is working on putting something together before [CCPA](https://auth0.com/ccpa/) goes into effect.

And if that's not enough to convince you to put your data house in order, [India](https://economictimes.indiatimes.com/news/economy/policy/data-protection-aadhaar-bills-listed-for-budget-session/articleshow/69920880.cms), [China](https://iapp.org/news/a/more-positive-progress-on-chinese-data-protection-regime-in-2019/), and the [UAE](https://www.techradar.com/news/uae-data-protection-law-similar-to-gdpr-likely-landing-this-year) have data privacy regulation in motion.

By this time next year it's unlikely that anyone will forgive you for storing passwords in plain text.

Identity can be a great way to start getting your data house in order. You can [learn more here](https://auth0.com/blog/breaking-down-master-data-management/) about why our customers often begin with authentication or reach out to an [Auth0 resource](mailto: sales@auth0.com) for info on how we can help with your specific needs.

<include src="asides/AboutAuth0" />


Yes, Data Privacy Applies to You

What Companies Can Expect from GDPR and Developing Data Privacy Regulations



If you want attention, you could do worse than getting big names like [Google](https://www.google.com/intl/en/about/?fg=1&utm_source=google-US&utm_medium=referral&utm_campaign=hp-header), [Amazon](https://www.aboutamazon.com/), [Apple](https://www.apple.com/music/), and [Netflix](https://www.netflix.com/) into headlines. 

We’ve seen France’s data authority, [CNIL](https://www.cnil.fr/), [level €50 million in fines at Google](https://www.bbc.com/news/technology-46944696) for violating the General Data Protection Regulation (GDPR) thanks to a Not Your Own Business ([NOYB](https://noyb.eu/)) and [La Quadrature du Net](https://www.laquadrature.net/en/) filing. NOYB, the nonprofit European center for digital rights, [filed a fresh suit against eight major tech players](https://www.darkreading.com/privacy/gdpr-suit-filed-against-amazon-apple/d/d-id/1333690?_mc=NL_DR_EDT_DR_daily_20190119&cid=NL_DR_EDT_DR_daily_20190119&elq_mid=88915&elq_cid=25956827) (see chart below). [Max Shrems, NOYB Director, also sank the U.S. Safe Harbor law](https://www.theregister.co.uk/2015/10/06/safe_harbour_walls_come_tumbling_down/) and challenged Privacy Shield and still has [additional projects](https://noyb.eu/projects-2/) in play. While not every company is a Google or an Amazon, these fines establish precedence that can easily be applied to other organizations.

Every day plenty of scare tactics and odd products ([like GDPR shredders and recycling bins marked “confidential”](https://www.theregister.co.uk/2019/01/22/gdpr_compliant_shredder_book/)) likely land in your inbox under the guise of GDPR compliance. But now that we’re seeing major fines, we thought it was time to take a realistic look at data privacy impacts companies can expect as they move through 2019 and prep for 2020.

![Response to Access Requests](https://images.ctfassets.net/23aumh6u8s0i/7mbI7mXcQxmrqnK4yGsJwE/726184ad6408e3bb07103a4f2c644b58/access-requests)

<include src="TweetQuote" quoteText="A realistic look at data privacy impacts companies can expect as they move through 2019 and prep for 2020."/>

## What's Coming

_EDITOR’S NOTE: Each regulation/law has minimum sizes for impacted organizations. Please check each for specific details._

* **Brexit Possible ‘No Deal’ (March 29, 2019)**: The proposed withdrawal agreement would have protected data transfers between the UK and the EU through December 2020. If the UK leaves the EU without a deal in place — and this seems likely, see the next paragraph — this leaves international data flows in jeopardy, with an inadequacy ruling for the UK. 
<br/><br/>
[ComputerWeekly](https://www.computerweekly.com/news/252456093/Prepare-for-no-deal-Brexit-says-ICO) reports that the Jonathan Bamford, director of strategic policy at the Information Commissioner’s Office told a Westminster eForum event on GDPR in London that the UK government and the EU believe a “magic adequacy agreement” is unlikely. “So you need to think about what the situation will be if there isn’t an implementation period as the result of a withdrawal agreement — a no-deal Brexit — and you need to prepare for that.”
Organizations may find this [IAPP article on impacts of a ‘No Deal’](https://iapp.org/news/a/brexit-a-data-protection-action-plan/) useful.
<br/><br/>
**Impacts**: Companies transferring data from, to, or through the UK.

* [ePrivacy (late 2019 possible)](https://iapp.org/resources/article/eprivacy-regulation-october-2018-draft/): Data privacy is covered under GDPR, but also under upcoming ePrivacy regulations, expected to come into force sometime during 2019. The tech industry continues to express concerns that the regulation replaces the EU directive on telecommunications, but also includes digital communications, [is much too strict](https://www.nytimes.com/2018/05/27/technology/europe-eprivacy-regulation-battle.html). Cookies, consent, data collection should sound familiar to anyone having dealt with GDPR, however, ePrivacy reportedly places electronic communications under a stricter set of rules than other personal communication, [reports IAPP](https://iapp.org/news/a/consent-remains-major-eprivacy-sticking-point-for-eu-bodies/). Once a final draft is accepted, organizations doing business with the EU will need to revisit data privacy policies.
<br/><br/>
**Impacts**: Organizations doing business with the EU and/or EU citizens

* [California Consumer Privacy Act (CCPA)](https://www.caprivacy.org/) (six months after publication of the Calif. Attorney General's implementing regulations, or July 1, 2020, whichever comes first): “Nobody should assume that being GDPR compliant makes them CCPA compliant,” says Lydia de la Torre, CIPP/US in a [Privacy Tracker Post on CCPA and GDPR for IAPP](https://iapp.org/news/a/gdpr-matchup-california-consumer-privacy-act/). She also notes that the CCPA definition of personal data is broader than that of GDPR. “As the first U.S. attempt at a comprehensive data protection law, the CCPA has the potential to become as consequential as the GDPR. After all, California is the fifth largest economy in the world, the home of many technology titans, and traditionally a trend-setting state for data protection and privacy in the U.S.” The rapid adoption of the law, which was [passed after only a week of debate](https://www.jdsupra.com/legalnews/california-passes-landmark-consumer-87324/) indicates that legislators are looking to show action in the face of increasing [mega-breaches](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/). 
<br/><br/>
**Impacts**: Companies doing business with California citizens. Also, the law is frequently put forth as a potential model for a U.S. data privacy law.

* [Cross-Border Data Transfer Pact/Privacy Shield](https://www.bna.com/new-euus-data-n57982090596/): GDPR compliance has reportedly diminished the value of the EU-US Privacy Shield, which is a cross-border data transfer pact that allows the flow of data between participating EU countries and the U.S. [Threatened over the summer](https://techcrunch.com/2018/07/05/eu-parliament-calls-for-privacy-shield-to-be-pulled-until-us-complies/), the voluntary program got a recent boost with the news that [DocuSign’s former CEO Keith Krach](https://www.whitehouse.gov/presidential-actions/president-donald-j-trump-announces-intent-nominate-individual-key-administration-posts/) may come on as ombudsperson for the pact. Shrems (the guy who brought down Safe Harbor and runs NOYB), is also challenging [Privacy Shield](https://www.theregister.co.uk/2018/08/01/irish_supreme_court_makes_surprise_decision_to_hear_facebooks_appeal_in_schrems_ii/) for the way that personal data is transferred from the EU to the U.S. How the ruling plays out will have implications for the thousands of companies that rely on trans-Atlantic data transfers. Most recently, the Irish Supreme Court [agreed to hear Facebook’s appeal](https://www.theregister.co.uk/2018/08/01/irish_supreme_court_makes_surprise_decision_to_hear_facebooks_appeal_in_schrems_ii/) after acknowledging the complexity of the law. [At publication, the court had yet to rule](https://www.irishexaminer.com/breakingnews/business/facebook-appeal-wraps-up-in-the-supreme-court-ruling-to-happen-on-later-date-899564.html). 
<br/><br/>
**Impacts**: U.S. companies transferring data across the Atlantic.

* **EU Data Protection Supervisors Management Strategy (2019 Priorities)**: EU’s Data Protection Supervisor, [Giovanni Buttarelli](https://edps.europa.eu/about-edps/members-mission/supervisors/giovanni-buttarelli_en), listed several priorities for 2019 while responding to the news that the U.S. had put forth an ombudsperson for Privacy Shield, including “digital ethics, better cooperation with national Data Protection Authorities (DPAs), identifying Artificial Intelligence threats to society, and finding closer alignments between consumer law, data protection and competition rules,” reports [Euractiv](https://www.euractiv.com/section/data-protection/news/this-is-not-a-concession-says-eu-data-chief-on-privacy-shield-ombudsman/).
<br/><br/>
**Impacts**: Companies with EU customers and/or doing business in the EU + possibility that these new standards could influence data privacy in other regions.

* **Plus a reminder**: Canada - [Personal Information Protection and Electronic Documents Act (PIPEDA)](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) (November 2018). This data law update includes [new consent guidelines](https://www.lexology.com/library/detail.aspx?g=354a398d-f2cd-4ccc-a68c-f91b23be2feb) that went into effect in November of 2018.

<include src="TweetQuote" quoteText="The shift from legal to technical data privacy compliance — and how you can mitigate increasing consequences."/>

## What is Acting in ‘Good Faith?’

GDPR and other data privacy fines aren’t leveled automatically with each violation. The bodies have leeway to weigh whether or not an organization was “acting in good faith.” Whether or not the deciding bodies have an understanding of all that goes into being compliant can be debated, but they do get that, for many organizations, compliance can be a massive undertaking.

As legislators move towards [increasing consequences for putting personal data at risk](https://auth0.com/blog/gdpr-effect/), what does “acting in good faith” look like? As we moved toward the deadline for GDPR in 2018, many companies handed GDPR to their legal teams to interpret the regulation in the absence of precedence, taking a “wait-and-see” approach by making the minimal necessary tech investments towards compliance. 

Meanwhile, 2018 saw [breaches from a host of big brands](http://fortune.com/2019/01/04/worst-data-breaches-of-2018/) and lots of talk about the need for additional data privacy laws. Comments from Forrester on the Marriott Mega-Breach lend insight into why the global public and legislators are losing patience: “As the case has been for nearly every other mega-breach in recent history, the methods that the attackers used to exploit this system weren’t magic or exceedingly advanced. Basic database security protocols, good authentication, minimization of lateral movement, and an understanding of how to apply technology strategically would have made a big difference.”

Paralleling the breach consequences of missing the basics are companies that are perceived to be taking advantage of their customers. CNIL’s €50 million GDPR fine against Google wasn’t for a minor violation. The finding cited Google’s violation of transparency, information, and consent. “The violations are continuous breaches of the Regulation as they are still observed to date. It is not a one-off, time-limited, infringement,” CNIL wrote in the [filing](https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc).

And older data laws can have current implications. Illinois’ [Biometric Information Privacy Act](http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57) (BIPA) says that individuals have the right to control their biometric information: fingerprints, iris scans, etc. A lawsuit started in 2014 found that [Six Flags Amusement Park cannot collect thumbprints without consent](https://newschannel20.com/news/local/illinois-supreme-court-rules-six-flags-cant-collect-thumbprint-data-without-consent), upholding what [Gizmodo](https://gizmodo.com/six-flags-biometric-case-could-turn-one-of-the-toughest-1830656685) called one of the most “rigorous” data laws in the United States.

A Federal data law for the United States is looking increasingly likely. U.S. Senator Marco Rubio (R-Fla.) recently introduced a [Federal bill](https://techbizweb.com/marco-rubio-proposes-new-federal-data-privacy-bill/) designed to provide national data privacy legislation. Backing legislative interest is [Apple CEO Tim Cook](https://www.prnewsonline.com/apple-tim-cook-communicators-us-gdpr)’s earlier proposal for a U.S. privacy law and Microsoft CEO Satya Nadella’s recent statement that privacy is a “human right” while calling for “global GDPR.” Meanwhile, U.S. Senators Elizabeth Warren (D-MA) and Mark Warner (D-VA) are seeking the power to penalize breached entities under [Data Breach Prevention and Compensation Act](https://www.recode.net/2018/1/10/16871928/equifax-elizabeth-warren-mark-warner-fine-bill).

## Evaluating Risk

In this current environment of consequences, moving from legal-focused compliance to addressing the legacy technical challenges involves assessing risk and deciding how to manage it.

In 2018, [Ponemon](https://newsroom.ibm.com/2018-07-10-IBM-Study-Hidden-Costs-of-Data-Breaches-Increase-Expenses-for-Businesses) reported that [data breaches](https://auth0.com/blog/what-is-a-data-breach/) averaged $3.86 million with mega-breaches (defined as greater than 1 million records) costing companies nearly $40 million. But that was before GDPR and its 72-hour reporting requirement. Calculating the potential cost of a breach has become more complex (Although recent news that [Twitter is being investigated regarding its Jan. 8, 2019 breach notification](https://www.jpost.com/Breaking-News/Irish-data-protection-body-says-it-is-investigating-Twitter-GDPR-breach-578686) may set precedence.

Now says Ian Thornton-Trump, head of cybersecurity, AMTrust International, speaking with [Bank Info Security](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226), we’re seeing a body with broad authority level fines. The ICO can refer companies for potential criminal charges if they notice something during their full access to company records during an investigation. Shorthand? Breaches are likely to become more expensive.

And there’s some question over whether or not English law permits insurance companies to cover fines leveled under GDPR because in some instances, the breach/lack of compliance may prove to be “quasi-criminal,” says [The National Law Review](https://www.natlawreview.com/article/can-english-law-insurance-policies-cover-fines-imposed-under-gdpr).

## What You Can Do About It

Investigations from a variety of regulatory agencies and insurance companies and class-action lawsuits can mean that a company may see financial and brand impacts from five or six investigations, says Thornton-Trump, but it may take years to play out. Meanwhile, your company’s tech team will likely have moved through multiple tech lifecycles. 

Ransomware, breaches, compliance issues all add complexity to an already challenging process, but they also provide concrete reasons to justify preventative measures as well as cleanup costs. Merck, for example, says Thornton-Trump, [rebuilt their entire network](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226) for $250 million after facing down WannaCry Ransomware. 

For ongoing regulatory action, proving “due diligence” is critical. “Being compliant is not good enough. Maintaining compliance is really the key,” Thornton-Trump told [Bank Info Security](https://www.bankinfosecurity.com/interviews/life-under-gdpr-sizing-up-long-term-costs-i-4226). And maintenance requires ongoing action.

If you’d like to learn how streamlining identity can help support your ongoing data privacy efforts, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />

---


Data Privacy 2019 - The Lowdown

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn about 3 tools to make the GDPR compliance process as efficient as possible.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR has arrived. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

The deadline to comply with GDPR has passed (5/25/18). As most know, if your business is audited and found to be irresponsible with its customer data, according to [GDPR regulations](https://www.gdpreu.org/compliance/fines-and-penalties/), fines are up to €20 million, or four percent of worldwide annual revenue. Moreover, GDPR does not just apply to EU companies; it extends to all those that process the data of EU residents.

The regulation is no joke. Activist groups, already outraged by how many companies have misused personal information, have [called out giants like Facebook and Google](https://www.cnet.com/news/gdpr-google-and-facebook-face-up-to-9-3-billion-in-fines-on-first-day-of-new-privacy-law/) for not creating tight enough protocol. If these titans, with cutting-edge resources at their fingertips, are struggling to adhere to the new law, how can small and medium-sized teams make sure their operations are efficient, secure, and worthy of their customers? 

Amid a variety of strategies to bring your company into compliance, specific tools can make this process less arduous and complicated by targeting several pain points at once. 

## Start With a Checklist

Before diving into tools to help you comply with specific parts of GDPR, it's important to keep the overall picture in mind.  
A team from Belgium created a handy [checklist](https://gdprchecklist.io/) that you can use as a guide throughout the process. It covers outlining the type of data your company holds, where, and why; the creation of a clear accountability and management policy for it, including your contracts with sub-processors; making the data clearly accessible to customers; new consent guidelines; and understanding what to do in special cases with high-risk data. 

For example, a breakdown of the level of detail that the checklist goes into to make sure you account for each important part of the regulation is below in its first section, “Your Data.”

![Your Data](https://images.ctfassets.net/23aumh6u8s0i/4cy7PCaaHybQN3fDwhredV/a9a14208bb378a8ff6d2b88d2facd5d1/gdpr-yourdata)

The list is interactive, so you can check off each task once it's completed in the circle on the left. If you're looking for more information on a particular bullet, you can use the drop down arrows for a longer description and links to further resources.

## 1. Improve Your Data Collection with Social Login

[Social login](https://auth0.com/learn/social-login/) is a single sign-on for end users that relies on existing information from a social network provider like Facebook, Google, or LinkedIn. This not only makes the registration process smoother for the customer, reducing onboarding friction and keeping them coming back over time, but also adds an additional layer of security to the information they provide. 

A customer will see this screen when they log in to your app:

![Social login with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3I1mh7IrVMQlLTdjqD0sc9/260b1c263f685e4d684ab1e0d99791dc/what-is-social-login)

Whichever social provider you've selected for the app will appear as an option for the customer up top, often along with the chance to choose email sign-in.

On the back end with [Auth0's social login feature](https://auth0.com/learn/social-login/), your team is able to choose from over thirty providers.

![Auth0 social login](https://images.ctfassets.net/23aumh6u8s0i/UCeigts6u0MM59HIJNcO2/e450315b596ef072144c4ec19e1c03fe/auth0-social)

If you're an e-commerce site, you might offer the chance to sign in with payment apps like PayPal, while a career platform might select LinkedIn. In each case, your team has the opportunity to view the public information that your customers have already shared on these apps. Since, in most instances, these apps have authenticated their users, incorporating social login into your operations helps ensure that the information you're pulling is authentic and up-to-date. 

Social login keeps your customer data organized in a single location from the start. This is key to all other facets of aligning with GDPR regulation. Being able to quickly recall and make changes to this data will set you up for success going forward.

## 2. Manage Your Users With Auth0's User Dashboard

[Auth0's user dashboard](https://auth0.com/gdpr) is a centralized view that clarifies in real-time who is accessing your customers' information, how, from where, and using what device.

![Auth0 user dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Lne57D8kZ3KFBrPQ4TKNm/f5ca63090985effaaee7c75ca0912bdc/auth0-users)

Administrators can rapidly scroll through current users for context (name, picture, and outside affiliation if they are a consultant or third party). 

Clicking on a particular user will enlarge their profile to provide an even richer view of details, including: their contact information; which sites they are working on; which devices they are using to do so; and a history of all prior activity in your system.

![Auth0 user info](https://images.ctfassets.net/23aumh6u8s0i/7298YiBzOtDvD9QFBA2iOH/8bfbfd2ba3a105676a479281e28f2084/auth0-user)

From here, it's simple to block anyone that is suspicious or not acting appropriately. It's difficult to understand how important this tool can be if you are assessed for GDPR compliance. It gives you a comprehensive understanding and clearly documented approach to track and control anyone touching the data of your end users. The user dashboard is more advanced than the manual methods that many teams are currently using to track this, such as adding information to spreadsheets.

The dashboard can help a team understand trends, set clear policies for its users, quickly communicate its process to customers, and facilitate customers that wish to access, modify, move, or delete their data.

## 3. Manage Your Workflow With Airtable

To organize your team, it could be useful to move your GDPR checklist into a workflow tool like [Airtable](https://airtable.com/) to track who will complete each task, by when, and note additional important details. 

For any major project like this, you can assign portions to individual teammates, set due dates, and customize it with notes.

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/5Fj4MbjwUEtUC8lVe81EAD/d167dab8d74fb4e45ac99984b0f191b6/pm)
_([Source](https://guide.airtable.com/project-management/))_

Airtable is far more than a black-and-white spreadsheet; it allows people who are more visual to upload photos for a multi-dimensional view. For example, if administrators are working through particular use cases, they can add screenshots to better explain processes or highlight any issues as they arise. 

The comprehensive abilities of Airtable allow for a clarity and depth of understanding of the nuances of complex projects like an operations overhaul or revamping IT policies to align with GDPR. Having everything specifically documented in this tool can allow you to quickly pull and analyze information in preparation for an audit.   

Other workflow tools that could help include [Asana](https://asana.com/guide/examples/project-management/project-management) (particularly helpful if a great calendar view is needed) and [Trello](https://trello.com/) (better for hitting the major points if your team is expert and well versed in GDPR details).

## It's Not Too Late to Comply!

Despite being past the deadline, your team still has time and tools at your fingertips to quickly get up to speed. Taking advantage of the tools above will make the transformation more efficient, transparent, and potentially even enjoyable as you uncover ways to better support your customers (e.g., creating a smoother onboarding experience) in addition to providing exceptional security.




"regulations"