Fastbase

What Fastbase is

Fastbase is a business to business website visitor identification and lead analytics service operated from the United States. It works alongside Google Analytics, reading the analytics data and matching visitor IP addresses against a large database of companies to reveal which organisations have visited a website.

Beyond company names, Fastbase can surface employee contact details such as names, job titles, email addresses and phone numbers, turning anonymous traffic into sales leads. For a European audience this enrichment makes Fastbase a comparatively intrusive tool that demands careful compliance.

What data and cookies it collects

Because Fastbase builds on Google Analytics, it relies on the Google Analytics cookies, typically named _ga and _gid, which store a client identifier and track behaviour across pages. Fastbase processes the visitor IP address, the pages viewed, referral source and session data, and may set its own identifiers to support the lead analytics dashboard.

The IP address and analytics signals are then matched to company and contact records. This creates personal data about identifiable individuals at the visiting organisation, even where the original analytics data was intended to be aggregate.

GDPR and ePrivacy implications

The analytics cookies that Fastbase depends on are not strictly necessary, so storing them requires prior consent under Article 5(3) of the ePrivacy Directive. The profiling and enrichment that follow are a substantial processing of personal data under the GDPR and need a clear legal basis, transparent information to visitors and respect for data subject rights.

Because the service identifies people and transfers data to the United States, it sits at the higher risk end of the scale and attracts close attention from European supervisory authorities.

Consent requirements

Valid prior consent should be obtained before the Google Analytics and Fastbase tags load and before any cookie is set. The consent must be freely given, specific, informed and unambiguous, presented through a banner that makes refusing as easy as accepting, and it must cover both the analytics tracking and the transfer of data to the United States.

International data transfers

Fastbase is a United States provider and processes data there, so using it involves a transfer of personal data outside the European Economic Area. The operator must put in place an appropriate transfer mechanism, such as the EU US Data Privacy Framework or standard contractual clauses with supplementary measures, and document a transfer impact assessment.

Practical compliance steps

Block the Fastbase and Google Analytics tags until consent is given, complete a data protection impact assessment, and sign a data processing agreement with appropriate transfer safeguards. Disclose the company identification and enrichment clearly in your privacy notice, honour access and objection requests, and review the lawfulness of the profiling regularly.