> Northbeam attribution platform: how it sets cookies, why consent is required and how to deploy it in a GDPR compliant way. > > Canonical: https://www.flowconsent.com/en/services/analytics/northbeam Analytics # Northbeam Analytics Northbeam is a US based marketing attribution and measurement platform that combines pixel data with server side ingestion to attribute ad spend across Meta, Google and TikTok. [Block Northbeam until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 5 - Third-party domains 4 - Servers United States (AWS us-east-1, us-west-2) Overview ## What does Northbeam do? ## **What is Northbeam?** Northbeam is a marketing attribution platform headquartered in the United States. It helps direct to consumer brands measure the performance of their advertising spend across Meta, Google, TikTok and other paid channels by combining browser pixel data with server side ingestion and click identifiers. ## **How does Northbeam process personal data?** Northbeam sets first party cookies prefixed with nb\_ on the publisher domain and may rely on third party cookies for cross site attribution. It collects IP addresses, click IDs such as fbclid and gclid, user agent strings, referrer URLs and conversion events. The data is sent to Northbeam servers in the United States, enriched and used to build attribution models. ## **Why does Northbeam require consent?** Because Northbeam reads and writes identifiers on the user terminal and processes personal data for marketing attribution, it falls under Article 5(3) of the ePrivacy Directive and Article 6 of the GDPR. Prior, informed and granular consent is required before the script is loaded or any server side event is sent. ## **International data transfers** Northbeam processes data in the United States, which is a third country under the GDPR. Transfers must be covered by Standard Contractual Clauses or, where Northbeam is certified, by the EU US Data Privacy Framework. A transfer impact assessment is recommended. ## **Compliance recommendations** Load Northbeam only after explicit opt in via a Consent Management Platform, document the legal basis in your record of processing activities, list Northbeam in your cookie policy and privacy notice, and configure server side conversions to respect the consent signal received from the user. Compliance ## Northbeam and the GDPR Northbeam is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis consent - Risk level high - Applicable regulations GDPR, ePrivacy Directive, CCPA/CPRA, UK GDPR ### Impact assessment (DPIA) A DPIA is recommended due to systematic monitoring of online behaviour, combination of pixel and server side data, processing of IP addresses and click identifiers, and transfers to the United States. ### Sample text for your banner > We use Northbeam to measure the performance of our advertising campaigns. Northbeam sets cookies and shares data with servers in the United States. Do you accept? Cookies and trackers ## What Northbeam sets and contacts - Tracking method first\_party\_and\_third\_party\_cookies\_plus\_server\_side - Server location United States (AWS us-east-1, us-west-2) - Data transferred outside the EU Data is processed and stored in the United States. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework where the vendor is certified. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------- | --------- | ---------- | --------------------------------------------------------------------------------------- | | nb\_session | marketing | 30 minutes | Identifies the current browsing session for attribution. | | nb\_user | marketing | 12 months | Persistent first party identifier used to link visits, conversions and ad clicks. | | nb\_click | marketing | 90 days | Stores the last click identifier (fbclid, gclid, ttclid) for cross channel attribution. | | \_nb\_visitor | marketing | 24 months | Long term visitor identifier used to deduplicate users across sessions. | | nb\_consent | necessary | 6 months | Stores the user consent state for Northbeam tracking. | ### Third-party domains contacted (4) - `northbeam.io` - `api.northbeam.io` - `j.northbeam.io` - `events.northbeam.io` Questions ## Frequently asked questions about Northbeam Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Northbeam set? Northbeam sets first party cookies on the publisher domain, typically prefixed with nb\_, to identify visitors and sessions. It may also rely on third party cookies for cross site attribution and processes click identifiers such as fbclid and gclid. Cookie lifetimes range from session only to several months, depending on the purpose. ### Is user consent required before loading Northbeam? Yes. Northbeam reads and writes identifiers on the user terminal and processes personal data for marketing attribution, which requires prior, informed and granular consent under the ePrivacy Directive and the GDPR. The script and any server side events must be blocked until the user opts in via a Consent Management Platform. ### What is the legal basis for processing personal data via Northbeam? The legal basis is the explicit consent of the data subject under Article 6(1)(a) of the GDPR. Legitimate interest is not appropriate because Northbeam performs cross site behavioural tracking and combines several data sources, which the EDPB has consistently considered to require consent. ### Does Northbeam transfer data outside the EU? Yes. Northbeam stores and processes data in the United States. Transfers must be covered by Standard Contractual Clauses and, where applicable, by the EU US Data Privacy Framework. A transfer impact assessment should be performed and documented. ### Is a DPIA required when using Northbeam? A DPIA is strongly recommended because Northbeam performs systematic monitoring of online behaviour, combines pixel and server side data, processes IP addresses and click identifiers, and transfers data to a third country. Many supervisory authorities consider this combination to be high risk. ### How do I implement Northbeam in a GDPR compliant way? Block the Northbeam script and server side events until consent is collected, use a Consent Management Platform that supports IAB TCF or Google Consent Mode, pass the consent signal to the server side endpoint, hash or remove direct identifiers where possible and keep an up to date record of processing activities. ### Are there privacy friendly alternatives to Northbeam? EU based attribution and analytics tools such as Piwik PRO, Matomo, AT Internet (Piano Analytics) or server side first party stacks may reduce transfer risk. Whichever solution you choose, the obligation to obtain consent for non strictly necessary tracking still applies. ### How should I update my cookie policy to mention Northbeam? List Northbeam as a third party marketing attribution processor, describe the categories of data collected (IP, click IDs, conversion events), specify cookie names and durations, mention storage in the United States and the safeguards in place, and provide a clear opt out path through your CMP. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Littledata](https://www.flowconsent.com/en/services/analytics/littledata) [Littledata is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Littledata integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Littledata helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/analytics/littledata) [Analytics](https://www.flowconsent.com/en/services/analytics/littledata) · ### [GoatCounter](https://www.flowconsent.com/en/services/analytics/goatcounter) [GoatCounter is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. GoatCounter supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, GoatCounter enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/goatcounter) [Analytics](https://www.flowconsent.com/en/services/analytics/goatcounter) · ### [Wufoo](https://www.flowconsent.com/en/services/analytics/wufoo) [Wufoo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Wufoo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Wufoo enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/wufoo) [Analytics](https://www.flowconsent.com/en/services/analytics/wufoo) · ### [Microsoft Power BI](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) [Microsoft Power BI is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Microsoft Power BI supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Microsoft Power BI enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) [Analytics](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) · ### [Nocodelytics](https://www.flowconsent.com/en/services/analytics/nocodelytics) [Nocodelytics is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Nocodelytics offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Nocodelytics empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/nocodelytics) [Analytics](https://www.flowconsent.com/en/services/analytics/nocodelytics) · ### [MySiteNow](https://www.flowconsent.com/en/services/analytics/mysitenow) [MySiteNow is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. MySiteNow supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, MySiteNow enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/mysitenow) [Analytics](https://www.flowconsent.com/en/services/analytics/mysitenow) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)