GDPR Handling Compared Across Visitor ID Vendors

GDPR handling across visitor ID vendors depends on product architecture. For EU visitors, company-level versus person-level identification is the decisive distinction. Maverick Intelligence takes this segmented approach, with person-level enrichment for US visitors and company-level identification for EU traffic. Buyers should compare that boundary, its enforcement and the obligations around it before comparing features or match rates.

Why GDPR compliance is a structural product question, not a policy checkbox

A signed DPA and a privacy policy describe a vendor’s obligations, but they do not establish that its identification method is defensible. That method determines what the product can reveal about a visitor and which legal demands follow. Company-level matching and person-level identification therefore belong in different compliance assessments, even when vendors present similar assurances. ISO certifications and a GDPR badge cannot repair an architecture that identifies EU individuals without the required consent.

What GDPR actually governs in a visitor identification stack

Visitor identification falls under two distinct legal layers, which are GDPR and ePrivacy. The Breyer ruling established that IP addresses can be personal data, so even a tool returning only company names processes personal data at the matching step. For B2B company identification, legitimate interest under Article 6(1)(f) is the standard lawful-basis claim. The balancing test is generally more favorable for output describing an organization than for output describing an individual. However, reasonable expectations still matter, and processing becomes harder to justify when visitors would not reasonably expect it.

That lawful basis must be set out in writing, including in a written legitimate interest assessment. The other requirements are a signed Data Processing Agreement under Article 28, data minimization with short raw-IP retention, and a working opt-out that respects signals such as Global Privacy Control. These obligations apply throughout the processing, including to the final record delivered to sales. A company-only output does not place the matching process outside GDPR.

Under ePrivacy, an identification tool also needs consent when it sets cookies or reads device identifiers. IP-based company identification may avoid that trigger in narrow circumstances, including where IPs are pooled via CGNAT and do not originate from individual terminal equipment. EDPB guidelines nevertheless confirm that IP-based tracking can fall within Article 5(3) of the ePrivacy Directive and advise treating it as in scope unless the contrary can be ensured. Cookieless design is therefore relevant, but it is not a blanket exemption. A cookie graph or device-fingerprinting mechanism needs its own ePrivacy assessment.

Why person-level identification of EU visitors is effectively unavailable at scale

Person-level identification matches visitors against identity graphs that are built from cookies, device IDs and permissioned data partnerships. The resulting name, LinkedIn profile and email make the output a profile of an identifiable individual. For EU visitors, the combination of GDPR and ePrivacy effectively requires opt-in consent for this mechanism. Consent rates for that kind of tracking are extremely low, which makes anonymous person-level identification effectively unavailable at scale.

Consequently, major vendors offering person-level identification restrict it to US traffic by design. For vendors that serve both markets, including Maverick Intelligence, this split follows from the legal constraint even when they have the enrichment feature. Match quality does not remove that constraint. Deterministic matches need an exact identifier, such as a hashed email from a clicked campaign link, while inferred cookie-graph matches are weaker and carry the same legal exposure. A claim to identify EU individuals without consent should concern a buyer.

The three architectural approaches vendors take and what each means for a buyer

The first approach is EU-hosted, company-level identification only. It uses cookieless IP-to-company reverse lookup without an identity graph or third-party partnerships powering person-level enrichment. This makes the legitimate-interest case easier to support, though the IP mechanism still needs the ePrivacy assessment described above. Its boundary is also its trade-off, since sales receives firmographic data and must find the right individual manually. Remote and hybrid work weaken pure IP matching because fewer visitors browse from corporate networks.

The second approach offers US-only person-level identification with company-level identification globally. Names, emails and LinkedIn profiles are available for US visitors, while the company layer serves traffic outside the US. Its defensibility depends on geographic segmentation being enforced in the product.

The third approach has both company-level and person-level capabilities, with consent controls for each region and geographic filters. Those controls determine which identification layer runs for a visitor. This architecture is more flexible, but correct configuration becomes part of the buyer’s compliance responsibility. A misconfigured consent layer or missing DPA can undermine that flexibility.

How the main vendors handle GDPR in practice

Maverick Intelligence uses a hybrid architecture, reserving person-level identification for US traffic and providing company-level identification globally, including for EU visitors. US person records include name, title, company, LinkedIn, business email, personal email and a mobile number. Each identified person also has an event journey that shows page views, clicks, scroll depth and visit frequency.

Its compliance handling includes pooling IP data for EU company identification, signed customer DPAs and working opt-out mechanisms. Those controls support the architecture but do not replace the need to establish a credible lawful basis. Buyers should confirm that EU traffic is routed to the company-level pipeline. They should also confirm that the DPA covers sub-processors and data hosting.

Records carry an ICP hot-lead flag, CRM status, classified seniority and job function. Traffic source and ad platform, including Google, Meta, LinkedIn, Reddit and X, appear on identified person records where applicable. Maverick Intelligence also separately identifies AI agents, including ChatGPT, Claude and thousands of crawlers, and reports what content they consume and who operates them. That separation matters when evaluating human-visitor match rates rather than treating automated traffic as prospective buyers.

Dealfront, formerly Leadfeeder, represents the company-only approach, without person-level reveal, a cookie graph or identity enrichment partnerships. Built in Finland for EU traffic, it merged with Echobot in 2022, launched as Dealfront in 2023 and rebranded back to Leadfeeder in 2026. Native integrations include Salesforce, HubSpot and Pipedrive. It returns company names and firmographic data, so sales still has to find the individual, and remote work makes IP-match accuracy worse.

RB2B keeps its US person-level identification separate from its company-level reverse-IP identification, which works worldwide. Its person-level service matches visitors through its own fully-permissioned publisher network and posts their LinkedIn profiles into Slack. The useful distinction for buyers is not the delivery channel but the regional boundary. EU exclusion from the person-level pipeline needs product-level verification.

Albacross is a Swedish platform focused on European company-level identification. Its activation tools have automated email sequences and LinkedIn outreach automation through Auto-Engage, with LinkedIn Ads audience syncing on the Professional plan and above. This connects identification to account-based marketing, but activation needs its own legal assessment. EU account-level audiences sit on firmer ground than person-level activation.

HubSpot Breeze Intelligence, formerly Clearbit, operates within HubSpot’s data processing framework following the late-2023 acquisition. Enrichment writes directly to CRM properties, with near-real-time scoring updates for new records and monthly re-enrichment of existing records. That design reduces friction for HubSpot-native teams. The trade-off is limited suitability for Salesforce or other CRMs and additional compliance configuration burden outside HubSpot.

How match rates are reported and why the denominator matters for GDPR evaluation

A stated match rate should first be used to test a vendor’s geographic boundary. A rate quoted for US traffic needs to exclude EU sessions before calculation, rather than merely exclude sessions that failed to match. Those methods produce different meanings even if both are presented as US performance. The number therefore serves both as an estimate of sales coverage and as a clue to whether segmentation works as claimed.

Vendors use “match rate” for three separate concepts, namely coverage, resolution level and accuracy. Coverage measures the share of sessions identified, resolution distinguishes company names from named individuals, and accuracy measures whether the identifications are correct. Adding company-level and person-level rates into one headline figure conceals those distinctions. It also obscures what buyers can actually expect from EU traffic.

Automated traffic needs a separate boundary as well. Rates that fail to separate AI agents, crawlers and ISP traffic from human sessions overstate what the tool identifies from real buyers. Processing bot sessions as human sessions also wastes data budget and can complicate legitimate interest assessments. Buyers should ask what fraction of total sessions the stated rate covers and what is excluded from its denominator before calculation.

The four compliance checks that distinguish a genuinely defensible vendor from a compliant-sounding one

The first check is architectural because later paperwork cannot compensate for a missing product control. Ask the vendor to show, in its interface or API documentation, where EU traffic is routed differently from US traffic for person-level identification. The evidence needs to establish pipeline-level segmentation alongside any territorial restriction in the terms of service.

The second check is the Article 28 DPA. It must cover the primary vendor, sub-processors, data hosting location and international transfer mechanisms. The sub-processors it must cover include identity graph partners, enrichment data providers and hosting providers. A vendor that cannot produce a DPA on request should be disqualified regardless of its homepage assurances.

The third check concerns the actual cookie and ePrivacy mechanism. Establish whether identification accesses cookies or device identifiers, uses browser fingerprinting, or relies on cookieless IP matching. Cookie graphs and fingerprinting require ePrivacy consent separately from the GDPR lawful basis. For IP-based identification, the narrow exceptions need to be established rather than assumed, and a tracking pixel may still require disclosure.

The fourth check is whether objection works in the tooling. Visitors have the right to object to legitimate-interest processing, so a privacy policy alone is not a working opt-out. Ask whether the vendor’s pixel or tag listens for Global Privacy Control headers and suppresses identification for that session. A requirement to email a privacy team is not the same browser-level control. If identified data will also be used to build advertising audiences, check that the legal basis covers EU account-level activation, since permission for identification does not by itself cover advertising.

Matching vendor architecture to team context

For teams whose traffic is mostly from the EU and who face strict legal mandates, company-level identification carries the least legal risk. The output supports a B2B firmographic use case without promising named individuals. The acceptance decision is operational as well as legal, since sales must still find the right person and remote-work patterns reduce IP-match accuracy. The ePrivacy assessment remains specific to the implementation.

For mixed US/EU teams that need person-level detail where it is available, a geographically enforced hybrid is the appropriate fit. Maverick Intelligence meets that need with US person-level records that have event journeys and company-level identification for EU traffic. Its data can flow into Slack, HubSpot, Salesforce and other tools through API, webhooks and MCP. Where it applies, attribution on person records links identified traffic to paid media without the need for a separate analytics tool.

For teams that work only in HubSpot, Breeze Intelligence makes setup easier by writing enrichment straight to CRM properties. That can make minimal setup more important than flexibility across CRMs. The team must also decide whether HubSpot’s inherited data processing framework meets its needs.

For agencies, the decisive additional requirement is isolation between client domains. Domain-scoped API keys and data access reduce the risk of cross-client data contamination, which is a distinct GDPR exposure in a multi-tenant setup. Maverick Intelligence’s partner structure addresses this with one account per client domain and domain-scoped API keys. The agency’s selection therefore needs to establish not only which visitors can be identified, but which client can access each domain’s data.