> Lemlist cold email and GDPR: EU hosting, tracking pixels, legitimate interest for B2B prospecting, source documentation and how to run compliant outreach. > > Canonical: https://www.flowconsent.com/en/services/marketing/lemlist Marketing # Lemlist Marketing · [Official website](https://www.lemlist.com/) Lemlist (by French company Lempire) is a cold email outreach platform used by sales teams to send personalised email sequences, automate follow-ups, and track opens and clicks. Headquartered in Paris with EU primary infrastructure, Lemlist is one of the more privacy-friendly options in its category. However, cold outreach itself raises significant GDPR and ePrivacy concerns: lawful basis for unsolicited B2B contact, tracking pixel cookies, and the documentation of sources for prospect data. [Block Lemlist until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 5 - Third-party domains 9 - Servers Lempire (Lemlist), Paris, France. EU primary infrastructure Overview ## What does Lemlist do? ## **What is Lemlist** Lemlist is a cold email outreach platform built by Lempire, a French software company. It lets sales teams import prospect lists, design personalised email sequences with dynamic placeholders and images, schedule automated follow-ups based on opens/clicks/replies, and integrate with CRMs. Lemlist hosts its primary infrastructure in the EU. ## **Tracking pixels and cookies** Each email sent via Lemlist can include a 1x1 tracking pixel and rewritten click-tracking URLs. When opened, the pixel logs IP, User-Agent and timestamp; when clicked, the link records the destination URL. Lemlist landing pages also use cookies for visitor identification. ## **Cold outreach and GDPR** For B2B prospects in most EU countries, legitimate interest (Art. 6(1)(f)) is the usual basis, provided a balancing test is documented and an easy opt-out is offered. For B2C contacts and in countries like Germany and Austria, prior opt-in is generally required (TKG, UWG). The source of the email list must be transparent and lawful (no scraping without notice). Always honour right to object immediately. ## **EU hosting and sub-processors** Lempire processes data primarily on European infrastructure (AWS eu-west-3 Paris). Some sub-processors for email delivery, support and analytics may be in the US; their use is covered by SCCs in the Lemlist DPA. The EU-first architecture is a major compliance advantage over US competitors like Outreach or Salesloft. ## **Practical compliance steps** 1\. Sign Lemlist DPA. 2. Document email list sources and lawful basis per source. 3. Run a balancing test for legitimate interest and store it. 4. Include opt-out in every email and honour replies. 5. Maintain a suppression list. 6. Consider disabling open tracking in DE/AT to reduce risk. 7. Map sub-processors. 8. For prospects in non-EU countries, check national anti-spam rules. ## **Compliance checklist** 1\. Source verified. 2. Balancing test documented. 3. Opt-out in every email. 4. Suppression list active. 5. Right to object handled within 30 days. 6. Lemlist DPA signed. 7. Privacy notice updated with Lemlist disclosure. 8. National rules checked per recipient country. Compliance ## Lemlist and the GDPR Lemlist is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis For B2B prospecting: legitimate interest (Art. 6(1)(f) GDPR) with documented balancing; for B2C: consent (Art. 6(1)(a) GDPR and Art. 13 ePrivacy) - Risk level high - Applicable regulations GDPR, ePrivacy Directive, national anti-spam laws (CAN-SPAM US, RGPD France LOPDGDD Spain TKG Germany) ### Impact assessment (DPIA) Lemlist processes prospect contact data (name, email, company, role), email content, open/click events (with IP and User-Agent), reply tracking and engagement scoring. Key DPIA considerations: (1) the lawfulness of cold prospecting depends on whether contacts are B2B or B2C and on national variations; (2) Lemlist's open and click tracking pixels are non-essential and require lawful basis; (3) source documentation: from where did the email addresses come (LinkedIn scraping, lead lists, opt-in forms)? Each source has different lawfulness; (4) right to object and right to erasure must be honoured promptly; (5) ePrivacy national law in DE/AT often requires opt-in for any commercial email, even B2B. ### Sample text for your banner > We use Lemlist (Lempire, France) to send our business communications. We process your name, professional email and role on the basis of our legitimate interest in B2B prospecting; you can object at any time by replying to the email or via privacy@\.com. Our emails may include tracking pixels to measure engagement; you can disable image loading in your email client to block them. Cookies and trackers ## What Lemlist sets and contacts - Tracking method Cold email outreach platform with embedded tracking pixels in emails, JavaScript on landing pages, and SMTP integration. Tracks email opens, link clicks and replies - Server location Lempire (Lemlist), Paris, France. EU primary infrastructure ### Cookies set (5) | Name | Type | Duration | Purpose | | --------------------------- | -------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | lemlist tracking pixel | Tracking pixel (1x1 image) | No persistent storage | Invisible image inserted in outbound emails; loaded from a lemlist domain when the recipient opens the email, used to record open events and approximate geolocation from the request IP. | | lem\_session | Functional | Session | Maintains the visitor session on Lemlist-hosted landing pages. | | lemlist link redirect | URL redirection | No persistent storage | Outbound links rewritten through a lemlist redirect domain to attribute click events to the campaign and recipient. | | lem\_visitor | Marketing | 1 year | Persistent visitor identifier used to recognise returning prospects and attribute conversions. | | tracking\_pixel (in emails) | Marketing | N/A | A 1x1 image embedded in each outbound email which signals open events when the recipient loads images. | ### Third-party domains contacted (9) - `tracking.lemlist.com` - `lemlist.com` - `app.lemlist.com` - `click.lemlist.com` - `track.lemlist.com` - `images.lemlist.com` - `cdn.lemlist.com` - `api.lemlist.com` - `app.lemlist.com` Questions ## Frequently asked questions about Lemlist Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies or trackers does lemlist use? lemlist does not place cookies on your website by default. Inside outreach emails it adds a tracking pixel and rewrites outbound links through a lemlist redirect domain to measure opens and clicks. These behaviours fall under Art. 5(3) ePrivacy in most EU member states. ### Cookies Lemlist sets? On landing pages: lem\_session, lem\_visitor. Emails include a 1x1 tracking pixel. All non-essential beyond essential session cookies. ### Is user consent required for lemlist outreach? For B2C contacts, prior opt in consent is required under Art. 13 ePrivacy. For B2B prospecting in Europe, several authorities (CNIL in France, ICO in the UK, AEPD in Spain) accept legitimate interest under strict conditions: professional purpose, role relevance, easy opt out, and lawful data source. In Germany, the UWG is stricter and typically requires soft opt in. ### Consent for cold email? For B2B in most EU countries, legitimate interest is the basis. For B2C and DE/AT, opt-in is generally required. ### What is the legal basis for processing prospect data? Consent (Art. 6(1)(a) GDPR) for B2C. Legitimate interest (Art. 6(1)(f) GDPR) is possible for B2B subject to a Legitimate Interest Assessment. The Art. 14 GDPR notice must be sent within one month of collecting the contact. ### Legal basis? Legitimate interest with documented balancing for B2B; consent for B2C and stricter jurisdictions. ### Are data transferred to the United States? Not for the lemlist core product, which is hosted on AWS Frankfurt and Dublin. Limited transfers may occur via sub processors (for example Stripe for payments). Where transfers happen, Standard Contractual Clauses are in place. ### Data transfers? Primary processing in France (EU). Some sub-processors in the US, covered by SCCs in the Lemlist DPA. ### Do I need a DPIA for lemlist? A formal DPIA under Art. 35 GDPR is generally not mandatory for small to medium outreach databases, but it is recommended when prospecting at scale, when enriching data from third parties, or when combining outreach with behavioural scoring. ### DPIA? Streamlined DPIA recommended, particularly when list size is large or sources are mixed. ### How do I implement lemlist compliantly? Source contacts lawfully, document the legitimate interest assessment, send the Art. 14 GDPR notice in the first message, include a one click unsubscribe in every email, respect short retention (around 3 years after last activity), sign the lemlist DPA, and keep an audit trail of contact origin. ### How to run compliant outreach? Document sources, balancing test, opt-out in every email, suppression list, honour right to object within 30 days, DPA signed. ### Alternatives? EU-friendly: Woodpecker (Poland), Reply.io (Ukraine, EU options), Mailshake (US, EU options). Lemlist remains the strongest EU-native choice. ### What are the alternatives to lemlist? European alternatives include La Growth Machine (France), Woodpecker (Poland), MailReach and Smartlead. US alternatives include Outreach, Salesloft, Apollo.io, Reply.io and Instantly. ### How do I update my cookie or privacy policy? lemlist does not require website cookie disclosure by default. Update your privacy policy and prospecting notice to mention lemlist as a processor, the EU hosting, the data categories, the retention period, the legal basis and the right to object. ### Privacy policy update? Disclose Lemlist as processor (France), describe lawful basis and tracking pixels, link to right to object. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Optinopoli](https://www.flowconsent.com/en/services/marketing/optinopoli) [Optinopoli is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Optinopoli enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Optinopoli empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/optinopoli) [Marketing](https://www.flowconsent.com/en/services/marketing/optinopoli) · ### [CHIIRP](https://www.flowconsent.com/en/services/marketing/chiirp) [CHIIRP is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CHIIRP enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CHIIRP empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/chiirp) [Marketing](https://www.flowconsent.com/en/services/marketing/chiirp) · ### [Influenster](https://www.flowconsent.com/en/services/marketing/influenster) [Influenster is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Influenster integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Influenster helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/influenster) [Preferences](https://www.flowconsent.com/en/services/marketing/influenster) · ### [Qualified](https://www.flowconsent.com/en/services/marketing/qualified) [Qualified is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Qualified offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Qualified empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/qualified) [Analytics](https://www.flowconsent.com/en/services/marketing/qualified) · ### [Extole](https://www.flowconsent.com/en/services/marketing/extole) [Extole is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Extole supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Extole ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/extole) [Marketing](https://www.flowconsent.com/en/services/marketing/extole) · ### [Formless](https://www.flowconsent.com/en/services/marketing/formless) [Formless is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Formless integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Formless makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/formless) [Marketing](https://www.flowconsent.com/en/services/marketing/formless) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)