Lead Forensics

What Lead Forensics is

Lead Forensics is a business to business website visitor identification service headquartered in Portsmouth, United Kingdom, with operations in the United States. It places a small tracking script on a customer website that records the IP address and browsing behaviour of every visitor, then matches that IP address against a proprietary business database to reveal the company that is browsing the site. The customer sees the identified organisation, along with contact suggestions, inside the Lead Forensics portal.

What data and cookies Lead Forensics collects

The tracking script captures the visitor IP address together with behavioural signals such as the pages viewed, the time spent on each page, the referring source and the journey through the site. The IP address is the core input: it is looked up against a business database so that the visiting company can be named. In its advanced configuration the script also sets a persistent first party cookie called Ifuuid, a random identifier that lasts about one year and improves the match rate by recognising returning devices. Because an IP address singles out an identifiable person or organisation under recital 30 of the GDPR, this is the systematic collection of personal data, carried out without the visitor being aware of it.

GDPR and ePrivacy implications

IP addresses are personal data, so capturing them and building a behavioural profile of a named company and its visitors is processing that falls squarely within the GDPR. Storing and reading the Ifuuid identifier on the visitor device also engages Article 5(3) of the ePrivacy Directive 2002/58/EC, enforced as the French TDDDG by the CNIL, as the German TDDDG, and through the Spanish LSSI CE by the AEPD, all of which require prior consent for any non essential tracker. Providers often present covert visitor identification as a legitimate interest, but European regulators contest that basis for profiling that the visitor cannot reasonably expect and cannot easily object to.

When consent is required

Consent is required before the Lead Forensics script loads, because the IP based identification and the Ifuuid cookie are not strictly necessary to deliver the page. That consent must be freely given, specific, informed and unambiguous under Article 6(1)(a) GDPR, and refusing must be as easy as accepting. Until the visitor accepts, the script must not run, the IP address must not be sent for matching and no cookie should be written. Transparency is essential: visitors should be told plainly that their company is being identified from their IP address.

Transfers of data to the United Kingdom and the United States

Lead Forensics processes visitor data on United Kingdom infrastructure, a transfer covered by the United Kingdom adequacy decision adopted by the European Commission, so no additional safeguard is needed for that flow. Its United States operations and subprocessors mean data can also reach the United States, which is not covered by adequacy here, so those transfers require the EU Standard Contractual Clauses 2021/914 within the Lead Forensics data processing agreement, supported by a Transfer Impact Assessment that weighs United States surveillance law in line with the Schrems II ruling.

Practical steps for compliant use

Gate the Lead Forensics script behind your consent management platform so it fires only after the visitor accepts the relevant category, and keep the IP address from being sent until then. Describe Lead Forensics in your cookie and privacy policy, naming the Ifuuid cookie, its lifetime and the IP based identification. Sign the data processing agreement, confirm the Standard Contractual Clauses for the United States element and complete a Transfer Impact Assessment. Carry out a Data Protection Impact Assessment before launch, apply a short retention period on visitor records and give visitors a clear way to object.