Zeotap

What Zeotap is

Zeotap is a Customer Data Platform that was built in Europe with privacy compliance as a core design goal. It helps brands collect, unify, enrich and activate customer data so that marketing teams can build audiences and improve customer intelligence. The platform resolves identities by matching first party identifiers, hashed email addresses, hashed phone numbers and mobile advertising IDs into a single customer view. It then activates those audiences across advertising and marketing channels while supporting cookieless universal identifiers. Because it centralises and enriches personal data at scale, it sits at the heart of a controller marketing stack and brings substantial data protection responsibilities.

Cookies and data collected

When deployed through a website tag, Zeotap can write a first party ID+ cookie that is unique to the browser, website and device, and it may use local storage to persist identifiers. The data collected typically includes online identifiers, hashed contact details, device and browser information, and behavioural events that describe how a visitor interacts with the site. These signals are used for identity resolution, audience building and profiling rather than for purely technical operation of the website. Zeotap also supports universal identifiers such as Zeotap ID+, ID5 and EUID, which can operate without third party cookies. Operators should document every identifier and storage item in their cookie inventory so that the real scope of collection is transparent.

GDPR and ePrivacy implications

Under the GDPR the data that Zeotap processes is personal data, and the matching of identifiers amounts to profiling. The ePrivacy Directive, transposed nationally through laws such as the German TTDSG and French CNIL guidance, requires consent before non essential identifiers are read from or written to a visitor device. Because audience building and identity resolution are not strictly necessary to deliver the website, they cannot rely on a technical exemption. The website operator usually acts as the data controller while Zeotap acts as a processor or as a joint controller depending on the activation use case. Clear roles, a data processing agreement and a lawful basis must be established before any collection begins.

Consent requirements and CMP integration

Valid consent must be obtained before Zeotap sets identifiers or builds profiles, and that consent has to be freely given, specific, informed and as easy to withdraw as it is to give. A consent management platform should gate the Zeotap tag so that nothing fires until the visitor opts in to marketing or profiling purposes. Zeotap supports the IAB Europe Transparency and Consent Framework, which lets a compliant consent signal flow to the platform and downstream partners. Operators should map Zeotap to the correct purpose category and confirm that withdrawing consent stops collection and propagates a signal to delete or stop using the data. Regular testing ensures that the tag genuinely respects the consent state rather than firing on page load.

International data transfers

Zeotap stores user data in data centres located in Germany, Belgium and the United Kingdom, which keeps core processing inside the EU and EEA. However, data may be shared with recipients or sub processors located outside the EEA, and such sharing can constitute a transfer to a third country. Zeotap enters into EU Standard Contractual Clauses with those recipients and applies supplementary safeguards to maintain an equivalent level of protection. Where personal data reaches the United States, operators should confirm whether a recipient relies on the EU US Data Privacy Framework or on Standard Contractual Clauses together with a transfer impact assessment. These transfer mechanisms should be recorded in the record of processing activities.

Practical compliance steps

Start by completing a Data Protection Impact Assessment because the profiling and identity resolution carried out by Zeotap usually meet the threshold for a mandatory assessment. Sign a data processing agreement, confirm the controller and processor roles, and record the transfer mechanisms that apply to non EEA recipients. Configure the consent management platform so the Zeotap tag is blocked until the visitor grants consent for marketing and profiling, and verify this with browser testing. Update the privacy notice and cookie policy to describe the first party identifier, the universal IDs and the enrichment activities in plain language. Finally, establish processes to honour access, objection and erasure requests, and review the configuration whenever new audiences or activation channels are added.