Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Fastbase is a US based B2B website visitor identification tool that uses Google Analytics data to reveal which companies visit your site and to enrich them with contact details.
Fastbase is a business to business website visitor identification and lead analytics service operated from the United States. It works alongside Google Analytics, reading the analytics data and matching visitor IP addresses against a large database of companies to reveal which organisations have visited a website.
Beyond company names, Fastbase can surface employee contact details such as names, job titles, email addresses and phone numbers, turning anonymous traffic into sales leads. For a European audience this enrichment makes Fastbase a comparatively intrusive tool that demands careful compliance.
Because Fastbase builds on Google Analytics, it relies on the Google Analytics cookies, typically named _ga and _gid, which store a client identifier and track behaviour across pages. Fastbase processes the visitor IP address, the pages viewed, referral source and session data, and may set its own identifiers to support the lead analytics dashboard.
The IP address and analytics signals are then matched to company and contact records. This creates personal data about identifiable individuals at the visiting organisation, even where the original analytics data was intended to be aggregate.
The analytics cookies that Fastbase depends on are not strictly necessary, so storing them requires prior consent under Article 5(3) of the ePrivacy Directive. The profiling and enrichment that follow are a substantial processing of personal data under the GDPR and need a clear legal basis, transparent information to visitors and respect for data subject rights.
Because the service identifies people and transfers data to the United States, it sits at the higher risk end of the scale and attracts close attention from European supervisory authorities.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Valid prior consent should be obtained before the Google Analytics and Fastbase tags load and before any cookie is set. The consent must be freely given, specific, informed and unambiguous, presented through a banner that makes refusing as easy as accepting, and it must cover both the analytics tracking and the transfer of data to the United States.
Fastbase is a United States provider and processes data there, so using it involves a transfer of personal data outside the European Economic Area. The operator must put in place an appropriate transfer mechanism, such as the EU US Data Privacy Framework or standard contractual clauses with supplementary measures, and document a transfer impact assessment.
Block the Fastbase and Google Analytics tags until consent is given, complete a data protection impact assessment, and sign a data processing agreement with appropriate transfer safeguards. Disclose the company identification and enrichment clearly in your privacy notice, honour access and objection requests, and review the lawfulness of the profiling regularly.
Websites using Fastbase must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is strongly recommended and likely mandatory for Fastbase. It identifies and profiles website visitors at scale, links them to named individuals and companies, and transfers data to the United States. This combination of systematic monitoring, enrichment and third country transfer triggers the high risk criteria of Article 35 of the GDPR.
Sample consent text
With your consent we use Fastbase together with Google Analytics to recognise the company you visit from and to analyse how our site is used. This involves cookies and the transfer of your data, including your IP address, to the United States. You can refuse or withdraw consent at any time in the cookie settings.
Third-party domains contacted
fastbase.comanalytics.fastbase.comgoogle-analytics.comgoogletagmanager.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ga | Analytics | 2 years | Google Analytics cookie that Fastbase relies on. Stores a randomly generated client identifier used to distinguish visitors across sessions. Requires prior consent. |
| _gid | Analytics | 24 hours | Google Analytics cookie that distinguishes visitors within a 24 hour window and feeds session data used by Fastbase. Requires prior consent. |
| _gat | Analytics | 1 minute | Google Analytics throttling cookie used to limit the rate of requests. Part of the analytics stack that Fastbase depends on. Requires prior consent. |
| fb_visitor | Analytics | 1 year | Fastbase identifier used to recognise a returning visitor session and associate it with the company identification and lead analytics dashboard. Requires prior consent. |
Fastbase collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Fastbase relies on the Google Analytics cookies _ga, _gid and _gat, which store identifiers and track behaviour, and it may set its own visitor identifier. None of these are strictly necessary, so all of them require prior consent before they are placed on the device.
Yes. The analytics cookies Fastbase depends on require prior consent under Article 5(3) of the ePrivacy Directive, and the profiling and US transfer mean consent is the most defensible basis. The tags must not load until the visitor has actively accepted.
Consent under Article 6(1)(a) of the GDPR is the primary basis because non essential cookies and profiling are involved. Some operators argue legitimate interest under Article 6(1)(f) for the business level company matching, but this requires a documented balancing test and does not remove the cookie consent obligation.
Yes. Fastbase is a United States provider and processes data there, and it relies on Google Analytics infrastructure. The visitor IP address and analytics data are transferred to the United States, which requires a valid mechanism such as the EU US Data Privacy Framework or standard contractual clauses.
Yes, a DPIA is strongly recommended and likely mandatory. Fastbase carries out large scale identification and profiling of visitors and transfers data to a third country, which meets several high risk criteria under Article 35 of the GDPR.
Block the tags behind a consent banner, complete a DPIA, and sign a data processing agreement with valid transfer safeguards. Explain the company identification and contact enrichment in your privacy notice, provide an easy way to object, and review the profiling regularly.
Privacy friendly alternatives include EU hosted analytics such as Matomo or Plausible, and EU based visitor identification providers that keep data within the EEA. Choosing a tool that avoids US transfers and limits enrichment substantially reduces the compliance burden.
List the Google Analytics cookies and any Fastbase identifier with their purpose, duration and the fact that data is sent to the United States. Note that the company identification builds on these cookies, and update the policy whenever the analytics or Fastbase configuration changes.