GDPR is the single most frequently misunderstood subject in B2B website visitor identification. Vendors claim wildly different things about what's permitted, founders get conflicting advice, and many marketing teams either over-restrict (and miss legitimate pipeline) or under-restrict (and expose themselves to regulatory risk). Here is a plain-English, current-as-of-2026 guide to what's actually legal in the EU.
Note: This is general guidance, not legal advice. Specific cases should be reviewed with a Data Protection Officer or qualified counsel.
The two-tier model: company-level vs person-level
GDPR applies to personal data — information about identified or identifiable natural persons. The crucial distinction for visitor identification is therefore not where the traffic comes from, but what you're identifying:
- Company-level identification (you know it's Acme Corp, not which employee) is generally not personal data under GDPR and can be processed under legitimate interest with appropriate notice.
- Person-level identification (named individual, email, role) is personal data and requires a lawful basis — almost always consent for cold acquisition use cases.
Related: Evaluating Website Visitor ID Software: A Buyer's Checklist
What you can do without consent
Across EU jurisdictions in 2026, the following activities are generally permissible under legitimate interest, provided your privacy notice transparently describes them:
- Identify the company a visitor is browsing from via reverse IP lookup.
- Show that company name and firmographic data (industry, size, location) inside your CRM.
- Score the visit against your ICP.
- Notify your sales team that a target account visited.
- Send cold B2B outreach to publicly available business contact details at that company, provided the recipient has a clear opt-out and the message has reasonable relevance to their role.
What you cannot do without consent
- Identify a specific named individual behind an EU visit through cross-site identity networks without their prior consent.
- Place tracking cookies or similar identifiers on an EU visitor's device before they consent (covered by ePrivacy / cookie law, separate from GDPR but practically aligned).
- Build behavioural profiles tied to a named individual without consent.
- Combine identifying data with sensitive categories (health, religion, political opinion, etc) without explicit consent.
Related: Best Website Visitor Identification Tools 2026
ePrivacy and the cookie banner question
ePrivacy (the EU cookie law) is what governs whether you need consent for the tracking pixel itself, separate from what GDPR says about the resulting data. The current consensus from EU regulators in 2026:
- Server-side reverse IP lookup with no cookie placed on the device generally does not require prior consent under ePrivacy.
- Client-side pixels that store identifiers on the device (cookies, localStorage) for non-essential purposes generally do require prior consent.
- Analytics-style measurement with adequate anonymisation is a narrow exception some regulators recognise; others do not.
How Happierleads handles EU traffic
Our default configuration for EU traffic is company-level identification only, with no person-level identifiers stored before consent. This means EU visits surface in the dashboard with company, industry, size, page journey, and ICP score — but not a named contact. Customers who want person-level identification on EU traffic can configure a consent flow that gates the identification until the visitor accepts.
Full details are on our GDPR-compliant tracking page.
Cold outbound to identified companies — what's permitted
Cold B2B outreach to publicly available business contact details at an identified company is generally permitted under GDPR in most EU member states, subject to four conditions:
- Relevance. The message must plausibly relate to the recipient's role and the company's interests.
- Opt-out. Every message must contain a clear and easy mechanism to unsubscribe.
- Source disclosure. If asked, you must be able to explain where you obtained the recipient's details and that they came from a publicly available source.
- Country-specific rules. Some member states (notably Germany under UWG) have stricter rules requiring prior business relationship or explicit interest signals. Local advice matters.
Common mistakes EU B2B teams make
- Assuming all EU tracking requires consent. Company-level reverse IP doesn't, in most cases.
- Assuming a US-headquartered tool is automatically compliant. What matters is the data processing activity, not where the vendor is.
- Storing personal data longer than necessary. Identified visit data has retention limits — keep it as long as legitimately useful, then delete.
- Failing to handle data subject rights. Identified EU individuals can request access, correction, and deletion. Your visitor identification tool must support these requests.
Frequently asked questions
Is reverse IP lookup legal in the EU?
Reverse IP lookup that identifies a company (not a named individual) is generally permitted in the EU under legitimate interest, provided your privacy notice describes the activity transparently. It does not normally require prior consent.
Can I send cold emails to EU contacts?
Cold B2B email to publicly available business contact details is generally permitted in most EU member states, subject to relevance, opt-out, source disclosure, and any country-specific rules. Germany has the strictest national rules.
Do I need a cookie banner for visitor identification?
If your visitor identification works purely server-side via IP lookup with no cookie set, you generally do not need a banner for that processing activity alone. If you set tracking cookies or store identifiers on the device, ePrivacy generally requires prior consent.
What if a visitor exercises a GDPR data subject request?
Your visitor identification tool must support access, correction, and deletion requests. Happierleads provides a built-in flow for handling these — including bulk redaction across all identified records tied to a specific email or company.
Want to identify your EU traffic the right way? Start a free Happierleads trial — our default EU configuration is company-level identification under legitimate interest, no banner required for the identification activity itself.
