Apollo

What Apollo is

Apollo, also known as Apollo.io, is a business to business sales intelligence and engagement platform based in the United States. On a website it is deployed as a visitor tracking script that loads from Apollo servers, and in outbound email it appears as tracking pixels embedded in messages. The tracker turns anonymous website traffic into named accounts and contacts by writing a first party cookie, building a visitor profile and matching that profile against the very large contact database that Apollo maintains.

What data and cookies Apollo collects

When a visitor lands on a page that carries the Apollo script, the tracker writes a first party cookie to the browser, generates an anonymous visitor identifier and records behavioural events such as the pages viewed, the time spent and the navigation path. These events are sent to Apollo ingestion endpoints through track_request calls. Apollo then matches the visitor and any collected identifiers against its own contact database, which holds extensive personal data on business professionals, in order to reveal the company and, where possible, the specific individuals behind the visit. In outbound email, Apollo tracking pixels record when a message is opened and can tie that action back to a known contact.

GDPR and ePrivacy implications

The visitor identifiers, behavioural events and matched contact records that Apollo processes are personal data under the GDPR, because they relate to identifiable people and are used to profile them. Writing and reading a cookie on the visitor device falls squarely within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers. The matching of visitor data against a large third party database is exactly the kind of large scale profiling that European regulators scrutinise most closely.

When consent is required

Consent is required before the Apollo tracking script loads, because it is not strictly necessary to deliver the content of the page and it identifies the visitor. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the script must not run, no first party cookie should be written and no behavioural events should be sent to Apollo. Legitimate interest for the underlying contact database is heavily contested by European regulators and should not be relied upon for this tracking.

Transfers of data to the United States

Apollo processes visitor data, behavioural events and matched contact records on United States based infrastructure, so European visitor and prospect data is transferred outside the European Economic Area. Such transfers require the EU Standard Contractual Clauses within the Apollo Data Processing Addendum and a documented Transfer Impact Assessment that considers United States surveillance law, in line with the Schrems II ruling and the guidance of the European Data Protection Board. The enrichment of visitor data against a United States held database adds further weight to the need for a robust transfer assessment.

Practical steps for compliant use

Gate the Apollo script behind your consent management platform so that it fires only after the marketing or analytics category has been accepted, and classify Apollo under that category. Provide clear information about Apollo in your cookie policy, including the first party cookie it sets and its lifetime, the behavioural tracking it performs and the matching against the Apollo database. Sign the Apollo Data Processing Addendum, complete a Transfer Impact Assessment and apply the shortest workable retention on visitor and prospect records. Where contact level identification is not needed, avoid enabling it, and review whether legitimate interest can genuinely be justified before relying on it.