Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Demandbase is a B2B account based marketing platform. It de-anonymizes website visitors by resolving their IP address to company firmographic data, then tags and tracks accounts to target advertising and sales outreach. Because it processes IP addresses and behaviour and may set non essential cookies, it raises GDPR and ePrivacy obligations including consent for cookies.
Demandbase is a business to business account based marketing platform. Its distinctive feature is de-anonymization, it resolves a visitor IP address to the company or organisation behind the visit using firmographic data, then tags and tracks those accounts to power targeted advertising, sales intelligence and personalized web experiences. The focus is on identifying organisations and the people acting on their behalf rather than anonymous traffic measurement.
Demandbase collects the visitor IP address, which it matches against firmographic databases to infer the company, industry, size and location. It also records on site behaviour such as pages viewed and content downloaded, and it may set cookies and tags to recognise returning visitors and accounts. IP addresses and behavioural data linked to identifiable accounts and individuals are personal data under the GDPR, even in a business context.
Any non essential cookies or tags that Demandbase sets require consent under Article 5(3) of the ePrivacy Directive. The firmographic processing of IP and behaviour needs a lawful basis under the GDPR. In a B2B setting many organisations rely on legitimate interest under Article 6(1)(f), but this requires a documented balancing test, transparency and an easy way to object. De-anonymization is intrusive, so the assessment must take the visitor expectations into account.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Where consent is the basis, for example for non essential cookies, it must be freely given, specific and informed, and the tags should load only after acceptance. Demandbase is a United States vendor, so IP addresses and behavioural data are transferred to the United States. These transfers require Standard Contractual Clauses or reliance on the EU US Data Privacy Framework, supported by a transfer risk assessment.
Gate any non essential Demandbase cookies behind a consent management platform, complete and document a legitimate interest balancing test for the firmographic processing, and update your privacy notice to explain IP de-anonymization. Sign a data processing agreement, verify the United States transfer safeguards, offer a right to object, and consider a Data Protection Impact Assessment given the intrusive nature of the tracking.
Websites using Demandbase must obtain user consent under GDPR regulations.
DPIA considerations
Demandbase processes IP addresses and behaviour to identify the company behind a visit and to track accounts at scale. A Data Protection Impact Assessment is recommended because IP de-anonymization, profiling and combining with third party firmographic data can be intrusive. Assess the balancing test for legitimate interest, transfers to the United States and the rights of individuals.
Sample consent text
We use Demandbase to recognise the organisation visiting our site and to tailor B2B marketing. This may involve cookies and processing of your IP address. Do you consent to marketing analytics powered by Demandbase?
Third-party domains contacted
demandbase.comcompany-target.comapi.company-target.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _db_visitor | HTTP cookie | Persistent (up to 1 year) | Stores a visitor identifier used to recognise returning visitors and associate them with an identified account for account based marketing. |
| _db_session | HTTP cookie | Session | Maintains session state during a visit for account tagging and behavioural tracking. |
Demandbase collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Demandbase may set cookies and tags through its JavaScript tag to recognise returning visitors and link them to identified accounts. It also relies on IP based detection, so even without a cookie it processes the visitor IP address to determine the company behind the visit.
Consent is required for any non essential cookies under Article 5(3) ePrivacy. For the firmographic processing of IP and behaviour, some organisations rely on legitimate interest, but if non essential cookies are used you must obtain consent before they load.
For non essential cookies the basis is consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. For B2B firmographic processing of IP and account data, legitimate interest under Article 6(1)(f) may apply, subject to a documented balancing test and a right to object.
Yes. Demandbase is a United States vendor, so IP addresses and behavioural data are transferred to the United States. Such transfers require Standard Contractual Clauses or reliance on the EU US Data Privacy Framework, supported by a transfer risk assessment.
A Data Protection Impact Assessment is recommended because IP de-anonymization, profiling and combining visits with third party firmographic data can be intrusive and large scale. Assess the balancing test, transfers and the impact on individuals to decide whether a DPIA is mandatory.
Gate any non essential cookies behind a consent management platform, document a legitimate interest balancing test for the firmographic processing, update your privacy notice to explain IP de-anonymization, sign a data processing agreement, verify United States transfer safeguards and offer a right to object.
Alternatives include other account based marketing and visitor identification platforms, and first party approaches that rely on directly provided business contact data. Any IP de-anonymization tool raises similar consent, legitimate interest and transfer questions.
List any Demandbase cookies and tags, describe their account identification purpose, state their duration, explain the IP based de-anonymization in your privacy notice, name Demandbase as a processor and disclose transfers to the United States with the safeguards used.