PII Data in id_token

[thatroger421]

Is it a security risk to include sensitive PII such as date of birth, email address, and phone number directly in an OpenID Connect ID token (id_token)? My development team insists this aligns with industry standards and is mitigated by controls like ensuring the token never leaves the user’s device and implementing TLS for all communications— but I’m concerned about PII etc, is it acceptable approach.