Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Excel Impact is a US performance marketing network that operates pay per call campaigns and online lead generation for verticals such as insurance, home services, education and consumer finance. It drops tracking pixels and call routing scripts on publisher sites, captures consumer identifiers and form data, scores leads in real time and sells qualified calls and form submissions to advertisers in the United States.
Excel Impact, LLC is a performance marketing network headquartered in the United States. It connects publishers, comparison sites and lead generation landing pages with advertisers operating in insurance, Medicare, home services, solar, education and consumer finance. When a publisher integrates Excel Impact, a JavaScript tag, a server postback endpoint or a dynamic call routing snippet is placed on the page. As a visitor interacts with the funnel, Excel Impact collects technical identifiers such as IP address, device fingerprint signals, click identifiers and referrer URLs, together with lead form fields like full name, postal address, email, phone number, date of birth and self declared eligibility data. For pay per call campaigns the platform also handles inbound phone numbers, call duration, IVR responses and call recordings.
This data flows in near real time to advertisers and to scoring partners that decide whether the lead is sellable and at what price. Excel Impact therefore acts both as a data controller for its own network and ad selection logic, and as a processor or joint controller when leads are delivered to specific advertisers under buyer agreements.
On a typical deployment, Excel Impact reads or writes several first party and third party cookies, including a persistent visitor identifier, a click identifier used to reconcile postbacks, a session identifier and one or more partner sync cookies. Local storage entries hold the funnel state and an anti fraud signal. The platform also collects server side signals: User Agent, language, approximate geolocation derived from IP, page URL, UTM parameters and the consent string passed by the website CMP. Phone numbers, addresses and date of birth are personal data under Article 4(1) GDPR; combined with an interest in a financial or health adjacent product, they can fall close to special category data and must be handled with elevated care.
Article 5(3) of the ePrivacy Directive, transposed into national law (for example Article 82 of the French Data Protection Act enforced by the CNIL, Section 25 TTDSG in Germany enforced by the Datenschutzkonferenz, and PECR enforced by the ICO in the United Kingdom), requires prior, informed and freely given consent before any non essential cookie or similar identifier is stored on or read from the user device. Excel Impact tracking and lead capture tags are non essential. The publisher must therefore obtain Article 6(1)(a) GDPR consent for both the storage of identifiers and the downstream processing of personal data for marketing and lead brokerage. Legitimate interests under Article 6(1)(f) is not a viable substitute, given the EDPB Guidelines 8/2020 on the targeting of social media users and the cumulative risk profile.
Consent must be specific, granular and as easy to refuse as to accept. The IAB TCF signal alone is not sufficient; a clear mention of the US transfer and of the lead brokerage purpose is required in the consent layer.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Excel Impact processes data in the United States. Transfers from the EEA must rely on a Chapter V GDPR mechanism. In practice, the controller will execute the 2021 Standard Contractual Clauses, generally Module Two for controller to processor and Module Three for processor to processor delivery to advertisers, supplemented by the UK International Data Transfer Addendum and the Swiss FDPIC amendments. A transfer impact assessment is mandatory under Schrems II and the EDPB Recommendations 01/2020. If Excel Impact has self certified under the EU US Data Privacy Framework adopted by Commission Decision (EU) 2023/1795, the DPF can be relied on as long as the certification remains active and the entity is listed for the relevant data categories on the official DPF list.
Before deploying Excel Impact, document a DPIA covering the funnel, the categories of data, the retention windows, the recipients (Excel Impact, downstream advertisers, call centres) and the SCC plus TIA package. Gate every Excel Impact script behind a consent management platform that enforces the IAB TCF or a custom signal, and only fire the pixel after an explicit Accept. Maintain an Article 30 record listing Excel Impact as a recipient and the US as the destination country. Provide a Do Not Sell or Share link for visitors located in the United States to satisfy CCPA, CPRA and similar state laws. For inbound calls, configure call recording disclosure messages compliant with both EU member state recording rules and US two party consent states.
If consent rates are too low or the US transfer risk is unacceptable, alternatives include EU based lead generation networks that process within the EEA, direct integrations with insurance carriers that use server to server APIs without cookies, and contextual advertising on comparison content. To exit Excel Impact cleanly, remove the JavaScript tag and call routing snippet, ask Excel Impact for written confirmation of deletion of historical lead records beyond the agreed retention period, revoke API keys and update the cookie register and privacy notice accordingly.
Websites using Excel Impact must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment under Article 35 GDPR is strongly recommended before deploying Excel Impact in production. The processing combines systematic online tracking, profiling for lead scoring, sensitive context data (insurance, finance, health adjacent education) and large scale transfers to the United States, which the EDPB lists as factors triggering a mandatory DPIA. The assessment should describe the lead funnel, document the SCCs and transfer impact assessment, evaluate FISA 702 risk for routed call recordings, and define measures such as IP truncation, suppression of special category fields and a strict consent gate.
Sample consent text
We use Excel Impact, a US partner, to display performance marketing offers, route requests to advertisers and process lead and call data in the United States. This involves cookies and identifiers that are not strictly necessary and transfers of your personal data outside the European Economic Area under Standard Contractual Clauses. We will only enable Excel Impact if you click Accept. You can change your choice at any time from the cookie settings link in the footer.
Third-party domains contacted
excelimpact.comcdn.excelimpact.comtrack.excelimpact.compixel.excelimpact.comleads.excelimpact.comcalls.excelimpact.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ei_visitor | http_cookie | 12 months | Persistent visitor identifier used to recognise returning users across Excel Impact campaigns and to attribute lead form submissions and inbound calls to the original click. |
| _ei_click | http_cookie | 90 days | Click identifier (clickID) written when a visitor lands from a publisher source; it allows Excel Impact to match server side postbacks with the original click and to credit the publisher. |
| _ei_session | http_cookie | 30 minutes | Short lived session identifier used to bind successive page views and form steps within a single lead generation funnel. |
| _ei_partner | http_cookie | 6 months | Partner synchronisation cookie used to share an Excel Impact ID with downstream advertisers and call buyers so they can deduplicate leads. |
| _ei_state | local_storage | 12 months | Local storage entry that stores the current state of the lead funnel (step, declared eligibility flags, anti fraud token) between page reloads. |
| _ei_call | http_cookie | 6 months | Call tracking cookie used to associate a dynamically displayed phone number with the visitor, enabling Excel Impact to route the inbound call and attribute it to the correct campaign. |
| _ei_consent | http_cookie | 6 months | Records the consent decision captured by the publisher CMP and forwarded to Excel Impact, so that the pixel only fires when consent is present. |
Excel Impact places tracking cookies for advertising — comply with GDPR using FlowConsent.
A typical Excel Impact deployment writes a persistent visitor cookie (around twelve months), a click identifier cookie used to reconcile postbacks (usually thirty to ninety days), a session cookie, one or more partner sync cookies and local storage entries that store the funnel state and an anti fraud signal. The exact list depends on the campaign template and on the downstream advertisers integrated into the call flow, so you should audit the actual deployment with a fresh browser profile and reflect the result in your cookie register.
Yes. Excel Impact tracking pixels, call routing scripts and lead capture tags are not strictly necessary to provide the service requested by the user. Article 5(3) of the ePrivacy Directive (transposed for example as Article 82 of the French Data Protection Act, Section 25 TTDSG in Germany or PECR in the United Kingdom) therefore requires prior, freely given, specific, informed and unambiguous consent before any of these technologies fires. The pixel must remain blocked until the visitor clicks Accept in the consent management platform.
The lawful basis is Article 6(1)(a) consent, both for the storage of identifiers on the device and for the subsequent processing of personal data for performance marketing and lead brokerage. Legitimate interests under Article 6(1)(f) is not a viable substitute because the EDPB Guidelines 8/2020 and the EDPB Opinion 28/2024 on legitimate interest treat online tracking, profiling and onward sale of personal data as outside the reasonable expectations of users.
Excel Impact processes data in the United States, so a Chapter V GDPR transfer mechanism is mandatory. In practice the controller signs the 2021 Standard Contractual Clauses (Module Two and Module Three), adds the UK International Data Transfer Addendum where applicable and conducts a transfer impact assessment under Schrems II and the EDPB Recommendations 01/2020. If Excel Impact is listed under the EU US Data Privacy Framework adopted by Commission Decision (EU) 2023/1795, the DPF can be invoked while the certification remains active.
Yes, a DPIA under Article 35 GDPR is strongly indicated. The processing meets several criteria from the WP29 Guidelines on DPIA and from national lists published by the CNIL, the AEPD and the German DSK: systematic online monitoring, profiling for lead scoring, sensitive financial or health adjacent contexts, large scale data and transfers to a third country without an automatic adequacy decision. The DPIA should describe the funnel, the recipients, the SCC and TIA package, and concrete mitigation measures.
Load the Excel Impact tag, postback endpoint and call routing snippet through a tag manager that respects the CMP signal. Keep the pixel blocked until the visitor has actively accepted marketing cookies. Pass the IAB TCF string or your custom consent signal to Excel Impact at firing time. Configure server side IP truncation where supported, disable enrichment with special category data, and store call recordings only with a documented recording disclosure that meets two party consent rules.
Alternatives include EU based lead generation networks that host data within the EEA, direct server to server integrations with insurance carriers or comparison platforms via secure APIs, and contextual advertising on editorial comparison content without behavioural tracking. Each option carries different commercial and data protection trade offs, but all reduce the volume of personal data sent to the United States.
Add Excel Impact to the third party recipients list in your privacy notice, with the purpose (performance marketing and lead generation), the country of destination (United States), the legal basis (consent) and the transfer mechanism (SCCs or DPF). In the cookie policy, list the Excel Impact cookies with their name, duration, type and purpose, and mirror this list in the CMP cookie register. Refresh the documentation every time the campaign template or the downstream advertisers change.