Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
MadKudu is a United States based predictive lead scoring and marketing intelligence platform used by sales and marketing teams to identify and prioritise their best visitors and leads. Its JavaScript tag tracks website visitor behaviour, reads lead identifiers such as email, and enriches and scores each person before feeding the result into tools such as Salesforce, Marketo and HubSpot. Because this reads and writes cookies and localStorage on the visitor device and profiles identifiable people, MadKudu must load only after the visitor has given consent.
MadKudu is a predictive lead scoring and marketing intelligence platform based in the United States. It helps sales and marketing teams find and prioritise their most promising visitors and leads by combining website behaviour with enrichment data and machine learning. MadKudu runs as a JavaScript tag that loads its code from MadKudu servers, observes what visitors do on the site and calls the MadKudu API to return a score that is pushed into connected sales and marketing tools.
When the tag runs, MadKudu records visitor behaviour such as pages viewed, actions taken and session activity, and it reads lead identifiers such as an email address where a form is submitted or passed from a connected tool. It stores first party identifiers in cookies and browser localStorage, including mkjs_user_id, mkjs_group_id and mkjs_anonymous_id, so a returning visitor can be recognised and their activity attributed to a single profile. MadKudu then enriches that profile with firmographic and behavioural attributes and calculates a predictive score, which it forwards to tools such as Salesforce, Marketo, HubSpot and Segment.
The behavioural data, identifiers, enrichment attributes and scores that MadKudu processes are personal data under the GDPR, because they relate to an identifiable visitor. Building a score to evaluate and prioritise a person is profiling, so Article 22 GDPR on automated individual decision making and profiling must be considered alongside the general rules. Storing and reading identifiers on the visitor device also falls within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is required before the MadKudu tag loads, because tracking behaviour and profiling visitors is not strictly necessary to deliver the content of the page. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the MadKudu tag should not run, no cookies or localStorage entries should be written and no data should be sent to the MadKudu API for enrichment or scoring.
MadKudu, Inc. processes data on United States infrastructure, so European visitor data is transferred outside the European Economic Area. Such transfers require the EU Standard Contractual Clauses 2021/914 within the MadKudu Data Processing Addendum and a documented Transfer Impact Assessment that considers United States surveillance law, in line with the Schrems II ruling and the guidance of the European Data Protection Board.
Gate the MadKudu tag behind your consent management platform so it fires only after the analytics or marketing category is accepted. Describe MadKudu clearly in your cookie policy, including the identifiers it sets and their lifetime, the profiling it performs and the United States transfer. Sign the MadKudu Data Processing Addendum, complete a Transfer Impact Assessment and, where the scoring evaluates people at scale, carry out a Data Protection Impact Assessment. Limit the data fed into scoring to what is necessary and apply the shortest workable retention on lead records.
Websites using MadKudu must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is advisable, and often required, because MadKudu carries out systematic profiling of identifiable visitors to evaluate and prioritise them. Document the behavioural data collected by the tag, the first party identifiers stored in cookies and localStorage, the enrichment attributes and predictive scores generated, the syncing of this data into CRM and marketing tools such as Salesforce, Marketo or HubSpot, the transfer of data to the United States and the retention period applied to lead records. Assess the logic and effects of the scoring under Article 22 GDPR, configure the tag so that it loads only after consent and limit the data fed into scoring to what is strictly necessary.
Sample consent text
We use MadKudu, a predictive lead scoring service operated by MadKudu, Inc. (United States), to understand how you interact with our site and to score and prioritise leads. MadKudu records your behaviour, stores identifiers in cookies and localStorage on your device and enriches and scores your profile. This data may be transferred to the United States under the EU Standard Contractual Clauses. MadKudu will only load if you click Accept.
Third-party domains contacted
madkudu.comcdn.madkudu.comapi.madkudu.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mkjs_user_id | HTTP cookie (first party) | 12 months | Stores the MadKudu identifier for a known visitor or lead so that behaviour, enrichment and scoring can be attributed to a single person across visits. |
| mkjs_anonymous_id | HTTP cookie (first party) | 12 months | Holds an anonymous identifier assigned before a visitor is known, so that early behaviour can be linked to the person once they are identified. |
| mkjs_group_id | HTTP cookie (first party) | 12 months | Stores the account or company identifier associated with the visitor so that behaviour can be grouped and scored at the account level. |
| mkjs_user_traits | localStorage | Persistent (until cleared) | Caches the visitor traits and attributes used by MadKudu for enrichment and predictive scoring. |
| mkjs_group_properties | localStorage | Persistent (until cleared) | Caches the account or company properties used by MadKudu for account level enrichment and scoring. |
MadKudu places tracking cookies for advertising — comply with GDPR using FlowConsent.
MadKudu sets first party identifiers such as mkjs_user_id, mkjs_anonymous_id and mkjs_group_id, which persist for about twelve months, and it caches visitor and account traits in browser localStorage. Together they let MadKudu recognise a returning visitor and attribute behaviour, enrichment and scoring to a single profile.
Yes. MadKudu performs non essential behavioural tracking, writes identifiers to the visitor device and profiles people, so under the ePrivacy rules you must obtain prior consent before the tag loads. The tag should stay blocked until the visitor accepts.
The only valid legal basis is consent under Article 6(1)(a) GDPR, combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Because the scoring profiles people, Article 22 GDPR must also be assessed. Legitimate interest cannot be used for this kind of non essential tracking and profiling.
Yes. MadKudu, Inc. hosts its platform on United States infrastructure, so European visitor data is transferred there. You need the EU Standard Contractual Clauses 2021/914 in the MadKudu Data Processing Addendum and a Transfer Impact Assessment to cover the transfer.
A Data Protection Impact Assessment is recommended, and often required, because MadKudu carries out systematic profiling of identifiable visitors. Assess the behavioural tracking, the identifiers stored on the device, the enrichment and scoring logic under Article 22 GDPR and the United States transfer.
Load the tag only through your consent management platform after the relevant category is accepted, describe MadKudu in your cookie policy, sign the Data Processing Addendum and complete a Transfer Impact Assessment. Limit the data fed into scoring, disable enrichment where it is not needed and apply a short retention period.
Alternatives include HubSpot predictive scoring, Salesforce Einstein, 6sense, Breadcrumbs and Infer style tools. They raise similar consent, cookie, profiling and transfer questions, so evaluate their hosting location and data processing terms before assuming any of them is lighter on privacy.
Add a dedicated entry that names MadKudu as the provider, lists the mkjs identifiers with their lifetimes, explains the behavioural tracking, enrichment and predictive scoring, and discloses the United States transfer and its safeguard. Keep the entry in step with your consent categories.