Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Leadinfo is a Dutch B2B website visitor identification service that uses reverse-IP lookup to identify the companies visiting your website, even when those visitors have not filled in a form. Its JavaScript tracking script logs visitor IP addresses and enriches them against Leadinfo's proprietary company database, showing marketers which companies are browsing their site. Because the CJEU ruled in Breyer that dynamic IP addresses constitute personal data, and because the script sets cookies, Leadinfo requires visitor consent under both GDPR and the ePrivacy Directive despite its B2B focus.
Leadinfo is a B2B website visitor identification platform founded in Rotterdam, Netherlands. It enables sales and marketing teams to see which companies are visiting their website, even when those visitors have not submitted a contact form or identified themselves. The service works by loading a small JavaScript snippet from cdn.leadinfo.net onto the publisher's website. This script captures the visitor's IP address and sends it to Leadinfo's servers, where it is matched against Leadinfo's proprietary company database using reverse-IP lookup. The result is a feed in the Leadinfo dashboard showing company names, industries, company sizes, LinkedIn pages and the specific pages visited, enabling outbound sales outreach to businesses that showed website interest. Despite being marketed as a B2B tool that identifies companies rather than individuals, Leadinfo processes personal data under EU law.
The key legal question for Leadinfo is whether IP addresses constitute personal data. In its 2016 judgment in Breyer v Bundesrepublik Deutschland (C-582/14), the Court of Justice of the European Union ruled that dynamic IP addresses are personal data for a website operator that has the legal means to obtain the identity of the person behind the IP address. Leadinfo links IP addresses to companies and, through company employee databases and LinkedIn data, potentially to individual employees. This makes the processing personal data processing even in a B2B context. The employees who visited the publisher's website are natural persons whose browsing behaviour is being recorded without their knowledge, making GDPR fully applicable to Leadinfo's operation.
Leadinfo sets cookies via its tracking script (served from cdn.leadinfo.net and ipv4.leadinfo.net) that store a session identifier and visitor fingerprint. Under the Dutch Telecommunicatiewet Art. 11.7a, which implements the ePrivacy Directive, storing or accessing information on a user's device requires prior informed consent unless the cookie is strictly necessary for a service explicitly requested by the user. Leadinfo cookies are not strictly necessary for the publisher's service, meaning consent is legally required regardless of whether one accepts that IP addresses constitute personal data. The Autoriteit Persoonsgegevens (Dutch DPA) and the EDPB have both indicated that consent is the appropriate legal basis for non-essential tracking, including IP-based tracking tools.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Some Leadinfo users have attempted to use legitimate interests (Art. 6(1)(f) GDPR) as the legal basis for IP-based visitor identification, arguing that B2B prospecting is a legitimate commercial interest that overrides the privacy interests of employees browsing in their professional capacity. However, the EDPB's guidance on the use of legitimate interests is restrictive, and the Breyer personal-data characterisation means employees retain full GDPR rights including the right to object. The safest legal basis is consent under Art. 6(1)(a), particularly given the CNIL's enforcement approach and the Dutch Telecommunicatiewet's explicit consent requirement for non-essential cookies. Controllers relying on legitimate interests should conduct and document a thorough balancing test.
The Leadinfo tracking script must be gated behind a CMP consent layer so that cdn.leadinfo.net resources are not loaded until the visitor has actively opted in to analytics or marketing cookies. The CMP must present Leadinfo as a specifically named vendor and describe the IP-address reverse lookup purpose. Leadinfo itself provides a global opt-out mechanism at leadinfo.com/en/opt-out, which sets an opt-out cookie; this should be linked from the publisher's cookie policy. Publishers should also consider implementing a server-side suppression list that prevents Leadinfo from processing IP addresses of users who have opted out, since client-side opt-outs can be cleared by users deleting cookies.
Publishers using Leadinfo should: (1) gate the Leadinfo script behind CMP consent, listing Leadinfo by name; (2) add Leadinfo to the cookie policy with a description of the IP reverse-lookup purpose and a link to leadinfo.com/en/opt-out; (3) sign Leadinfo's DPA available from their dashboard; (4) conduct a DPIA documenting the Breyer personal-data analysis, the Dutch Telecommunicatiewet obligations and the chosen legal basis; (5) if relying on legitimate interests, document a detailed balancing test addressing employees' right to privacy while browsing in a professional context; (6) set a data retention period for Leadinfo lead records and configure automatic deletion in the Leadinfo dashboard; and (7) update the privacy notice to disclose Leadinfo as a data processor, describe the IP-based processing, confirm EU data residency and describe the opt-out mechanism.
Websites using Leadinfo must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is recommended before deploying Leadinfo, particularly for organisations that process a high volume of website traffic or operate in regulated sectors. Key considerations include: (1) IP address processing: following the CJEU Breyer ruling (C-582/14), dynamic IP addresses are personal data when the controller has the legal means to identify the natural person behind them; Leadinfo's ability to link IPs to company records and then to individual employees who may have visited the site creates a clear personal-data-processing chain; (2) the EDPB and French CNIL have both indicated that IP-address-based tracking requires consent, making the legitimate-interests basis legally uncertain; (3) Leadinfo sets cookies via cdn.leadinfo.net and ipv4.leadinfo.net that are non-essential under the Dutch Telecommunicatiewet Art. 11.7a, requiring prior informed consent regardless of the personal-data question; (4) data enrichment: Leadinfo enriches IP data with company and employee information from its own database, which may include contact names obtained from publicly available sources, potentially widening the scope of personal data processed; (5) the DPIA must map the data flow from IP capture to CRM export, assess the proportionality of B2B identification against visitor privacy, document the Dutch UAVG and Telecommunicatiewet obligations, and define retention periods for IP logs.
Sample consent text
We use Leadinfo, a B2B website visitor identification service operated by Leadinfo B.V. (Rotterdam, Netherlands). Leadinfo's tracking script records the IP addresses of visitors to this website and matches them against a company database to identify which businesses are visiting our site. This process involves storing cookies on your device and processing your IP address, which constitutes personal data under EU law. All processing takes place within the EU. We use this information for B2B sales and marketing purposes. You can opt out of Leadinfo tracking at any time via the cookie settings below or by visiting leadinfo.com/en/opt-out.
Third-party domains contacted
leadinfo.comcdn.leadinfo.netipv4.leadinfo.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| li_session | functional | Session | Session identifier cookie set by cdn.leadinfo.net that maintains the current visitor session state and links page views within a single browsing session to a Leadinfo visitor record for cross-page journey tracking. |
| li_visitor | analytics | 1 year | Persistent visitor fingerprint cookie from ipv4.leadinfo.net that identifies returning visitors across sessions, allowing Leadinfo to attribute multiple visits from the same browser to a single company record and build a cumulative visit history. |
| leadinfo_optout | functional | 1 year | Opt-out cookie set when a visitor clicks the Leadinfo opt-out link at leadinfo.com/en/opt-out. Its presence signals to the Leadinfo script that the visitor has objected to tracking and suppresses IP logging and cookie-setting for that device. |
| li_ab | analytics | 30 days | A/B variant assignment cookie used by Leadinfo to test different widget configurations and dashboard data presentation formats across publisher integrations, measuring engagement with the Leadinfo reporting interface. |
Leadinfo collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Leadinfo sets cookies via its JavaScript snippet served from cdn.leadinfo.net and ipv4.leadinfo.net. The primary cookies are a session identifier that links the current browser session to a Leadinfo visitor record, and a persistent visitor fingerprint cookie that allows Leadinfo to recognise returning visitors and stitch together cross-session visit histories for the same company. These cookies are not strictly necessary for the publisher's own service and therefore require prior consent under the ePrivacy Directive (implemented in Dutch law as Telecommunicatiewet Art. 11.7a) regardless of whether IP addresses are treated as personal data.
Yes. Consent is required on two separate grounds: first, under the ePrivacy Directive and Dutch Telecommunicatiewet, the non-essential cookies that Leadinfo sets require an affirmative opt-in before being placed. Second, following the CJEU Breyer ruling, IP address processing constitutes personal data processing, and the EDPB and CNIL have indicated that consent is the appropriate legal basis for IP-based behavioural tracking. Some operators claim legitimate interests, but this is legally uncertain and increasingly challenged by data protection authorities, particularly in France and the Netherlands.
Consent (Art. 6(1)(a) GDPR) is the safest and most broadly accepted legal basis for Leadinfo given the EDPB's restrictive position on legitimate interests for tracking, the Dutch Telecommunicatiewet's consent requirement for non-essential cookies, and the CNIL's enforcement precedents on IP-based tracking. Legitimate interests (Art. 6(1)(f)) can be argued in a strict B2B context where the individuals tracked are acting in their professional capacity, but a thorough and documented balancing test is required, and the result may not be defensible in all EU jurisdictions. Controllers should document their chosen basis and review it following any new EDPB or national DPA guidance.
Leadinfo is headquartered in Rotterdam, Netherlands, and processes data within the EU. Its infrastructure uses AWS Frankfurt (eu-west-1) for CDN delivery and API services. As of current knowledge, Leadinfo does not routinely transfer personal data outside the EEA. However, controllers should review Leadinfo's current DPA and sub-processor list to confirm EU data residency before relying on this assessment. This is one of Leadinfo's key privacy advantages over US-based competitor tools such as Clearbit or ZoomInfo.
A DPIA is strongly recommended. Leadinfo meets several Art. 35 GDPR triggers: systematic monitoring of individuals (employees) browsing behaviour, large-scale processing of location-derived data (IP-to-company matching), and processing that involves profiling. The DPIA must analyse the Breyer personal-data characterisation, document the legal basis, assess the proportionality of company-level identification against the privacy of individual employees who browse on corporate networks, and define data retention periods for Leadinfo lead records. The Dutch UAVG and Telecommunicatiewet obligations must also be addressed in the DPIA.
Load the Leadinfo script only after the visitor has given valid consent via your CMP, with Leadinfo named as a specific vendor. Add Leadinfo to your cookie policy listing the session and fingerprint cookies with their purpose, duration and legal basis. Link to leadinfo.com/en/opt-out in your cookie policy. Sign the Leadinfo DPA from your dashboard. Conduct and document a DPIA before going live. Configure Leadinfo's data retention settings to delete old lead records after a defined period. Update your privacy notice to describe the IP reverse-lookup process, confirm EU data processing, and explain the opt-out right. If relying on legitimate interests, document a balanced interest test and build in a suppression mechanism for users who exercise their right to object.
Privacy-friendlier approaches include: (1) first-party intent signals via gated content and CRM form submissions, which rely on consent by design; (2) Google Analytics 4 combined with company-level segments using GA4's B2B features (lower resolution but no additional tracking layer); (3) self-hosted analytics tools like Matomo with IP anonymisation that provide traffic data without reverse-IP enrichment; and (4) LinkedIn Insight Tag for LinkedIn-authenticated B2B visitor identification. None of these fully replicate Leadinfo's company-identification capability, but they avoid the IP-processing and cookie consent complexity.
In your cookie policy, add a Leadinfo row listing the session cookie (functional, session duration, served from cdn.leadinfo.net), the visitor fingerprint cookie (analytics/marketing, 1 year, ipv4.leadinfo.net), and describe the reverse-IP lookup purpose. Link to the Leadinfo opt-out page at leadinfo.com/en/opt-out. In your privacy notice, add a section identifying Leadinfo B.V. (Rotterdam, Netherlands) as a data processor, describe the IP-address capture and company enrichment processing, confirm EU data residency, state the legal basis (consent or legitimate interests with documented balancing test), the retention period and the visitor's right to opt out or object. Review both documents whenever Leadinfo updates its DPA or processing terms.