Know exactly who's visiting your site — person-level ID in 174+ countries. Start free, no card needed.
Start free trial →
GDPR-safe website visitor identification: the 16-point checklist
You want to know who visits your site. Your legal team wants to sleep at night. Run these 16 checks in one afternoon and you can answer both.
- Written for B2B SaaS teams and agencies
- Each point has a 2-minute "how to check"
- Plain language you can forward to your team
Email me the checklist
Get a copy in your inbox to share with your team.
Free. Unsubscribe in one click. We use your email to send the checklist and three short follow-ups, see our privacy policy.
Sent. Check your inbox.
The full checklist is below too. Want to see who visits your own site while you work through it?
Start your free trialThis is not legal advice. It is what we see across the businesses that use Happierleads. Your lawyer has the final word on your setup.
Consent and cookies
Block trackers until the visitor says yes
In the EU and EEA, marketing and analytics tags wait for consent. Strictly necessary cookies can run.
How to check: open your site in a private window from an EU location. Before you click anything, look at DevTools → Application → Cookies. Only necessary cookies should be there.
Make "Reject" as easy as "Accept"
Both buttons on the first layer of the banner, same size, same weight. Regulators have fined large sites for hiding Reject in the settings.
How to check: count the clicks. Rejecting should take one click, like accepting.
Never pre-tick a box
Consent boxes start empty, in the banner and in your forms. A box that ticks itself is not consent.
How to check: open every form and banner category. Every optional box should be empty until the visitor ticks it.
Keep marketing consent separate
Agreeing to your terms is one thing. Agreeing to newsletters or SMS is another, with its own box.
How to check: your signup form has a separate, optional box for marketing messages.
Record who agreed, to what, and when
If someone asks, you can show the date and the version they agreed to.
How to check: pick one user and find their consent date in your database or CRM.
Your policy and the data you keep
Publish a privacy policy people can read
Who you are, what you collect, why, who you share it with, and how to contact you. Link it from the banner and the footer.
How to check: your visitor identification tool is named in it, next to your analytics tools.
Collect only what you need
Every form field needs a reason. If you never call people, don't ask for a phone number.
How to check: for each field on your forms, write down what you use it for. Drop the ones without an answer.
Get a parent's okay before collecting kids' data
B2B products should say in the policy that they are not for children and that you don't knowingly collect their data.
How to check: search your privacy policy for "children" or an age.
Write one retention sentence
How long you keep data, in one sentence. For example: "We keep your data while your account is active and delete it on request."
How to check: your privacy or cookie policy has that sentence.
People's rights
Let people download their data
Anyone can ask for a copy of what you hold about them, in a format they can use.
How to check: you can export one person's record to CSV in a few minutes.
Delete everything when they ask
From your app, your CRM, your email tool and your enrichment tools. You have one month.
How to check: write down every tool that holds a contact's data. That list is your deletion runbook.
Delete old data on a schedule
Data you no longer use is risk without value. Set auto-delete where your tools allow it.
How to check: pick your oldest leads. Do you still need them?
Vendors, transfers and security
List your sub-processors
Every vendor that touches personal data on your behalf, named in your policy or DPA.
How to check: ask each vendor for their sub-processor list. A good vendor answers in one link.
Sign a DPA with every vendor
A Data Processing Agreement says what the vendor may do with your data. Most vendors let you sign it online.
How to check: keep a folder with one signed DPA per vendor.
Use approved terms when data leaves the EU, and encrypt it
Data that goes to the US or elsewhere needs Standard Contractual Clauses (and the UK Addendum for UK data). Encrypt it in transit and at rest.
How to check: each DPA mentions SCCs, and your site and app run on HTTPS only.
Report a breach within 72 hours
You tell the regulator within 72 hours of finding a breach. Your vendors have to tell you fast enough to make that possible.
How to check: write down who decides, who tells the regulator, and the email you would send. Keep it where the team can find it.
Where Happierleads fits in
Happierleads, a UK-based company, identifies the people visiting your website. Here is how it lines up with the checklist.
- EU and EEA visitors: we identify the company, not the individual, and suggest the right contact there based on the job titles you target.
- 174 countries, the US and UK included: we identify the exact visitor, with name, work email, phone and LinkedIn.
- Your cookie banner: put our script in the Marketing category. Visitors who decline are not identified. Setup guide
- Sub-processors: Amazon Web Services (AWS), MongoDB Atlas and Anthropic. That is the full list.
- DPA: sign it online on the Compliance page of your dashboard in two minutes, with Standard Contractual Clauses built in.
- Your privacy policy: our guide gives you the paragraph to add. Is it legal?
Questions
Is website visitor identification legal under GDPR?
Yes, when it is set up right. In the EU and EEA we identify the company, not the individual visitor. Put the script in your banner's Marketing category, add a paragraph to your privacy policy and sign our DPA.
Do I need a cookie banner to use Happierleads?
In the EU and EEA a banner is standard and our script goes in its Marketing category. In the US and most of the world a privacy-policy line and an opt-out link are enough.
Who are your sub-processors?
Amazon Web Services (AWS) for hosting, MongoDB Atlas for the database and Anthropic for AI processing. They are listed in the DPA.
Is this legal advice?
No. It is a plain-language checklist from what we see across the businesses using Happierleads. Ask your own lawyer about your situation.
Join the live session
30 seconds — then you're in the room.