Yes, afaik authentication is performed by applications at L7 and as such flows via Internet protocols like anything else.

All kinds of laws are applied to services provided via Internet. For example, once upon a time people said collecting sales tax was an insurmountable problem and a disaster for ecommerce. Time passes and what do you know, people figured out ways to comply with laws.