Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Act-On is a marketing automation platform for email campaigns, landing pages and lead management. It places a tracking beacon and cookies on the website that tie anonymous visitors to known leads, follow page views and email opens and feed lead scoring and profiling. Because it builds detailed marketing profiles, it is not strictly necessary for the website to function and involves significant personal data processing.
Act-On is a marketing automation platform used to run email campaigns, build landing pages and forms and manage leads. A core feature is a tracking beacon that organisations place on their website, which links website activity to contact records, follows page views and email opens and feeds lead scoring. Because it builds and updates detailed marketing profiles, it processes a significant amount of personal data.
Act-On sets cookies and uses its beacon to assign a visitor identifier, track the pages they view, the forms they submit and the emails they open and click, and to tie this activity to a known contact once they identify themselves. It processes IP addresses, online identifiers, behavioural data and the contact details leads provide, building a profile and a lead score. This is clearly personal data, and the scoring is profiling under the GDPR.
The Act-On beacon and cookies used for tracking, profiling and measurement are not strictly necessary to deliver the website, so under the ePrivacy Directive and national rules such as PECR they require prior consent before they are stored or read. The marketing emails sent through Act-On also generally require opt in consent. The organisation using Act-On is the data controller and Act-On acts as a processor, and the profiling raises transparency and data subject rights obligations.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain freely given, specific and informed consent through a consent banner before the Act-On beacon and cookies load, and visitors must be able to refuse and to withdraw consent easily. Act-On is a US based vendor, so personal data of EU visitors and leads is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Act-On is certified, or on Standard Contractual Clauses backed by a transfer impact assessment.
Sign a data processing agreement with Act-On, block the beacon and cookies until consent is given through your consent management platform, and use opt in for email marketing. Be transparent about the profiling and lead scoring, give individuals access and objection rights, conduct a DPIA, list the Act-On cookies in your cookie policy, document the lawful basis and transfer safeguards, and set clear retention periods.
Websites using Act-On must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended and may be required, because Act-On systematically tracks visitors, links them to lead profiles and applies lead scoring, which is profiling on a potentially large scale. Assess the tracking beacon, the combination of behavioural and email engagement data, the automated evaluation of individuals, retention periods and the transfer of personal data to the United States, and document appropriate safeguards.
Sample consent text
We use Act-On to manage our marketing and to understand how you interact with our site and emails. Act-On sets cookies and a tracking beacon that link your activity to your contact profile and inform our marketing. These run only after you accept marketing cookies, and you can withdraw your consent at any time.
Third-party domains contacted
actonsoftware.comactonservice.combeacon.actonservice.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| actonid | Marketing | 2 years | Assigns a unique visitor identifier used by the Act-On tracking beacon to follow activity and link it to a lead profile. |
| acton_visited | Marketing | 1 year | Records pages visited so Act-On can build the visitor history and feed lead scoring. |
| acton_session | Functionality | Session | Maintains session continuity for the Act-On beacon during the visit. |
Act-On places tracking cookies for advertising — comply with GDPR using FlowConsent.
Act-On uses a tracking beacon and sets first and third party cookies to assign a visitor identifier, follow page views and form submissions, track email opens and clicks and link this activity to a contact profile and lead score. These are tracking and marketing cookies, not strictly necessary ones.
Yes. The Act-On beacon and cookies are used for tracking, profiling and measurement and are not strictly necessary, so you need prior consent before they load. The email marketing sent through Act-On also generally requires opt in consent.
The legal basis is consent under Article 6(1)(a) of the GDPR, combined with ePrivacy consent for storing and reading information on the device and for electronic marketing. Given the profiling and lead scoring, consent is the appropriate basis rather than legitimate interest.
Yes. Act-On is a US based vendor, so personal data of EU visitors and leads is transferred to the United States. These transfers should rely on the EU US Data Privacy Framework where Act-On is certified, or on Standard Contractual Clauses with a transfer impact assessment.
A DPIA is recommended and may be required, because Act-On systematically tracks visitors, links them to lead profiles and applies lead scoring, which is profiling on a potentially large scale. Document the tracking, the automated evaluation, retention and the transfer of data to the United States.
Sign a data processing agreement, block the Act-On beacon and cookies until the visitor consents through your consent management platform, use opt in for email marketing, be transparent about profiling and lead scoring, conduct a DPIA and give individuals access and objection rights.
Alternatives include other marketing automation platforms such as HubSpot, Marketo, Salesforce Marketing Cloud, Brevo or ActiveCampaign. Any alternative that tracks visitors, profiles leads or sends electronic marketing raises the same consent, profiling and transfer questions, so assess each on its data practices.
List each Act-On cookie and the tracking beacon with their purpose and duration, classify them as tracking or marketing cookies, name Act-On as the processor, explain the profiling and lead scoring, mention the transfer of data to the United States and the safeguards used, and explain how visitors can withdraw consent.