Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
ZoomInfo Chat identifies visiting companies via reverse IP lookup and enriches visitor profiles with third party data broker information. It is highly privacy sensitive and requires explicit consent and careful GDPR assessment before deployment.
ZoomInfo Chat (formerly Insent) is a B2B conversational marketing chatbot. When a visitor lands on your site the widget captures their IP address and performs a reverse IP lookup against the ZoomInfo data graph to identify their company. It then enriches the visitor record with company and, where available, contact information from ZoomInfo's data broker database. High value visitors are automatically routed to sales representatives for live chat engagement.
ZoomInfo Chat sets cookies to identify and track visitors. The zi_session or visitorid cookie (up to one year) persists a unique visitor identifier for enrichment and routing. A chat session cookie manages the active conversation. An enrichment or routing cookie stores the company identification result and routing decision. Beyond cookies, the widget transmits the visitor IP address to ZoomInfo servers and receives back enriched company and contact data drawn from ZoomInfo's data broker records.
ZoomInfo Chat presents elevated GDPR risks on multiple fronts. The reverse IP identification processes personal data (IP addresses and inferred identities) without the visitor providing that data directly, raising serious transparency and fairness concerns under Article 5 GDPR. The enrichment with third party data broker information constitutes profiling under Article 4(4) GDPR and may trigger the enhanced rights in Article 22 if automated decisions significantly affect individuals. Because the visitor has not interacted with ZoomInfo directly, you carry the full transparency obligation and must provide the Article 14 information notice. The cookies require prior consent under the ePrivacy Directive.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Explicit opt in consent is required before the ZoomInfo Chat widget loads and before any IP address is sent to ZoomInfo for reverse lookup. The consent request must clearly describe the reverse IP identification, the enrichment with ZoomInfo data broker records and the routing to sales. Passive browsing or continuing to use the site does not constitute valid consent for this type of processing. Visitors who decline must not be tracked or identified.
Visitor IP, behavioural and enriched data are processed by ZoomInfo in the United States under the EU US Data Privacy Framework and standard contractual clauses. Given the sensitive nature of the enrichment data, you should carefully review ZoomInfo's transfer impact assessment and subprocessor disclosures as part of your DPIA.
Complete a mandatory DPIA before deploying ZoomInfo Chat. Gate the widget behind explicit consent in your consent management platform. Prepare an Article 14 privacy notice describing the enrichment processing and make it available on your site. Sign a Data Processing Agreement with ZoomInfo. Update your privacy policy to describe reverse IP identification, data broker enrichment, US transfers and visitor rights including the right to object to profiling. Monitor ZoomInfo's subprocessor and data source disclosures for changes that affect your compliance position.
Websites using ZoomInfo Chat must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is mandatory for ZoomInfo Chat given the high risk rating, the systematic profiling of visitors using reverse IP identification and enrichment from a third party data broker. The DPIA must assess the lawfulness of processing data subjects who have not directly interacted with your organisation, the transparency obligations towards enriched individuals, the proportionality of profiling for sales routing purposes and the risk of inaccurate enrichment data affecting individuals unfairly. Document mitigation measures and obtain legal sign off before deploying.
Sample consent text
I consent to ZoomInfo Chat identifying my company from my IP address, tracking my browsing behaviour on this site and enriching my profile with information from the ZoomInfo database. I understand this data is processed by ZoomInfo in the United States under standard contractual clauses and may be used to route my visit to a sales representative. I can withdraw consent at any time.
Third-party domains contacted
chat.zoominfo.comws.zoominfo.comcdn.zoominfo.comjs.zi-scripts.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| zi_session | Marketing | Up to 1 year | Persistent visitor identifier used by ZoomInfo Chat for reverse IP company identification and cross session behaviour tracking |
| _zi_chat_session | Functional | Session | Manages the active ZoomInfo Chat conversation state and routing decision for the current browser session |
| _zi_enrichment | Marketing | Short term | Stores the result of the reverse IP company identification and visitor routing score for sales team use |
ZoomInfo Chat uses cookies for user preferences — inform visitors with a consent banner.
ZoomInfo Chat sets at least three cookies. The zi_session or visitorid cookie (up to one year) stores a persistent unique visitor identifier that enables the reverse IP identification to link repeat visits from the same browser and track behaviour across sessions. A chat session cookie manages the active conversation and stores the chat state. An enrichment or routing cookie stores the result of the company identification lookup and any routing decision made for that visitor. All are non essential and require prior opt in consent.
Yes, explicit opt in consent is required before the ZoomInfo Chat widget loads. The widget performs reverse IP identification and enrichment the moment it activates, which constitutes profiling under GDPR. Passive browsing, continuing to use the site or clicking accept to terms of service are not valid forms of consent for this processing. You must obtain clear affirmative consent that specifically describes the reverse IP lookup, enrichment with ZoomInfo data and sales routing before activating the widget.
The legal basis is consent under Article 6(1)(a) GDPR. The profiling nature of the processing (reverse IP identification, enrichment with third party data broker records, sales routing) means that legitimate interests cannot be used as a basis given the significant impact on individuals and the likelihood that they are unaware of being profiled. The consent must be specific to ZoomInfo Chat, describe the enrichment from a data broker and give visitors a genuine choice to decline without any detriment to their use of the site.
Yes. The visitor IP address, behavioural data and the enriched company and contact information are all processed by ZoomInfo Technologies in the United States. ZoomInfo relies on the EU US Data Privacy Framework and standard contractual clauses for transfers from the EU. Given the sensitivity of the enriched data (third party data broker records about individuals who have not directly interacted with ZoomInfo), you should carefully review ZoomInfo's transfer impact assessment as part of your DPIA.
Yes, a DPIA is mandatory for ZoomInfo Chat. The processing meets the criteria for mandatory DPIA under Article 35 GDPR because it involves systematic profiling of individuals (reverse IP identification combined with data broker enrichment), processing of data about individuals who have not interacted with your organisation, large scale processing of location inferred data and transfers of sensitive enriched data to the US. Complete the DPIA before deployment, document mitigation measures and obtain legal sign off. The DPIA must also address the Article 14 transparency obligation.
Complete a mandatory DPIA before deployment. Gate the ZoomInfo Chat widget behind explicit opt in consent in your consent management platform so it does not load until consent is given. Prepare an Article 14 privacy notice describing the enrichment processing and make it available on your site (for example in your privacy policy and in a link near the chat widget). Sign a Data Processing Agreement with ZoomInfo. Update your privacy policy to describe reverse IP identification, data broker enrichment, US transfers and visitor rights including the right to object to profiling. Monitor ZoomInfo's data source and subprocessor disclosures regularly.
If the goal is B2B visitor identification with lower privacy risk, consider tools that use only first party data and do not enrich from data broker records. Drift and Intercom offer chatbots without reverse IP enrichment. If visitor identification is essential, some tools like Clearbit Reveal (US based) or Albacross (EU based) offer reverse IP identification with varying privacy postures. EU based alternatives with better transparency about data sources may be easier to justify under GDPR. In all cases, validate legal basis and DPIA requirements before deployment.
Add a ZoomInfo Chat section to your cookie policy. List the main cookies: zi_session or visitorid (marketing and analytics, up to one year, ZoomInfo, persistent visitor identification for reverse IP lookup), the chat session cookie (functional, session, manages the active chat) and the enrichment or routing cookie (marketing, session to short term, stores company identification result). Categorise the zi_session cookie as marketing and analytics requiring consent. Explain in the cookie policy that the widget also transmits the visitor IP address to ZoomInfo for company identification, which goes beyond typical cookie use.