But as others have pointed out, the law is extremely technology-agnostic. Sticking the same information in a JWT makes no difference either way.