> Pardot (Account Engagement) GDPR guide, visitor_id cookies, consent banner, SCC and DPF transfers, legal basis, DPIA criteria and sample consent text. > > Canonical: https://www.flowconsent.com/en/services/marketing/salesforce-marketing-cloud-account-engagement Marketing # Salesforce Marketing Cloud Account Engagement Marketing · [Official website](https://www.salesforce.com/products/marketing-cloud/marketing-automation) Salesforce Marketing Cloud Account Engagement (formerly Pardot) is a B2B marketing automation platform offering lead capture forms, email marketing, lead scoring and grading, drip campaigns and web visitor tracking through the Pardot tracking code. It assigns persistent visitor\_id cookies, attributes anonymous visits to known prospects once a form is submitted, and feeds engagement data into Salesforce CRM. Used by B2B sales and marketing teams to nurture leads, score account interest and trigger sales workflows. [Block Salesforce Marketing Cloud Account Engagement until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 5 - Third-party domains 5 - Servers United States (Salesforce primary infrastructure on AWS US regions and Salesforce owned data centers), EU pod option available for Account Engagement on AWS Frankfurt for European customers, all configuration and reporting routed through Salesforce trust boundary Overview ## What does Salesforce Marketing Cloud Account Engagement do? ## What Pardot does and how it tracks visitors Salesforce Marketing Cloud Account Engagement, still widely known by its former name Pardot, is a B2B marketing automation platform tightly integrated with Salesforce CRM. It combines landing pages, lead capture forms, email marketing, drip nurture programs, lead scoring, lead grading and an account based engagement view. The most privacy sensitive component is the Pardot tracking code, a JavaScript snippet (commonly named pi.js) that you embed on every page of your marketing site. Once a visitor consents, the script writes a first party cookie containing a visitor\_id linked to your Pardot account identifier (piAId), records page views, time on page, form submissions and clicks, and posts these events to a Salesforce hosted endpoint such as pi.pardot.com or your configured tracker subdomain. When a previously anonymous visitor submits a form, Pardot performs cookie stitching: the visitor\_id is connected to the prospect record carrying the email address, and all historical page views suddenly become identifiable, which is a key reason why prior consent is essential. ## GDPR risks specific to marketing automation Pardot raises several GDPR concerns that go beyond a basic analytics tool. The platform performs systematic profiling by assigning numeric scores and letter grades to prospects, which then drives automated assignment to sales reps and inclusion in targeted email cadences. Under Article 22 GDPR, data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, and aggressive sales outreach triggered by behavioral scoring can fall close to that line. The cookie horizon is also long: Pardot visitor cookies typically last up to ten years by default, allowing very long retrospective profiles. Finally, the cookie stitching mechanism, where anonymous browsing history is retroactively associated with an identified person, must be transparently disclosed in the privacy notice and covered by a valid legal basis from the very first page view. ## Cookies and identifiers set by Account Engagement The main cookies set by the Pardot tracking script are visitor\_id followed by your account number (for example visitor\_id12345), which stores the unique visitor identifier, lpv followed by the account number for the last page view timestamp used to deduplicate hits, a session cookie named pardot for short lived continuity, and pi\_opt\_in which records the consent state when you implement the opt in API. Depending on your tracker domain setup, these cookies can be set either in the first party context on your own marketing domain or in the third party context on pi.pardot.com. All of these are non essential under Article 5(3) of the ePrivacy Directive and the German TTDSG, since they exist to enable cross session marketing analytics and lead identification rather than to deliver the page the user explicitly requested. ## International transfers and Salesforce safeguards Account Engagement is operated by Salesforce Inc. with primary infrastructure in the United States. European customers can opt into the EU pod, which keeps the production database in Frankfurt, but ancillary processing, global support, sub processors and Marketing Cloud integrations may still entail transfers outside the EEA. Salesforce relies on Standard Contractual Clauses in the 2021 form and is self certified under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF. Controllers should document this transfer chain in their record of processing activities (ROPA), perform a Transfer Impact Assessment that considers U.S. surveillance laws such as FISA 702 and Executive Order 14086, and surface the transfer clearly in the privacy notice and consent banner. ## How to deploy Pardot in a compliant way A compliant deployment starts with consent management. The Pardot snippet must be blocked by default and only injected after the visitor accepts the marketing or advertising consent category in your CMP, with all previously set cookies cleared on rejection. Configure a first party tracker subdomain so that cookies are set on your own marketing domain, which improves lifetime in browsers like Safari (ITP) and reduces cross site risks. Shorten cookie lifetimes from the ten year default to the minimum needed for your sales cycle, typically six to twenty four months. Use the Pardot Consent API to honor opt outs, suppress profiles for users who exercise their right to erasure, and integrate with the data subject rights workflow in Salesforce. Restrict form fields to data strictly necessary for the stated purpose, separate marketing communication consent from cookie consent, and document the retention policy for prospect activity history. ## Alternatives and when to reconsider For organizations seeking lighter footprint marketing automation, alternatives include HubSpot Marketing Hub (US based, similar profile), Adobe Marketo Engage (also US infrastructure with EU options), and European vendors such as Brevo (formerly Sendinblue), ActiveCampaign with EU residency, Mautic (open source, self hosted) or Plezi for B2B. For very high risk audiences (public sector, healthcare, legal) consider keeping lead capture server side, sending only consented form data to a CRM, and using a cookieless analytics tool to measure marketing performance without persistent identifiers. Compliance ## Salesforce Marketing Cloud Account Engagement and the GDPR Salesforce Marketing Cloud Account Engagement is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Article 6(1)(a) GDPR is required before loading the Pardot tracking code and dropping visitor cookies, since the tool performs marketing profiling, cross session tracking and lead scoring. Article 5(3) ePrivacy Directive also requires prior consent for the storage of non essential identifiers. For B2B prospect data already in a CRM, legitimate interest under Article 6(1)(f) may apply for limited communications, but web tracking and behavioral scoring always require explicit opt in. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, Swiss FADP, CCPA/CPRA, LGPD, PIPEDA, TTDSG (Germany), LOPDGDD (Spain), French Data Protection Act, EU-U.S. Data Privacy Framework ### Impact assessment (DPIA) A DPIA is strongly recommended and likely mandatory under Article 35 GDPR. Pardot involves systematic monitoring of website visitors, persistent identifiers across sessions, automated lead scoring (a form of profiling that can produce significant effects on individuals targeted by sales outreach), large scale processing of contact data, and international transfers to the United States. The DPIA should evaluate the necessity of behavioral tracking versus less invasive alternatives (server side form processing without persistent cookies), retention periods for visitor histories, the impact of automated scoring on prospects, the adequacy of SCCs and DPF safeguards, transparency toward unknown visitors who become identified after form submission, and the rights of data subjects to object to profiling under Article 22 GDPR. ### Sample text for your banner > We use Salesforce Marketing Cloud Account Engagement (Pardot) to recognize returning visitors, measure interest in our products, attribute marketing campaigns and send relevant follow up communications. This service stores visitor\_id cookies on your device, links your activity to your email address once you submit a form, and shares your behavioral data with Salesforce Inc. in the United States under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. We will only activate Pardot tracking and load the pi.pardot.com tracking script with your explicit consent. You can withdraw consent at any time from our cookie settings. Without consent, you can still browse our site and contact us through alternative channels. Cookies and trackers ## What Salesforce Marketing Cloud Account Engagement sets and contacts - Tracking method Pardot tracking code JavaScript (pi.js) loaded on customer websites, sets first party visitor\_id cookies scoped to the customer domain, additionally writes third party cookies on pi.pardot.com when tracker domains are configured, posts form submissions and page view beacons to Salesforce Account Engagement endpoints, supports iframe and AMPscript integrations within Marketing Cloud journeys - Server location United States (Salesforce primary infrastructure on AWS US regions and Salesforce owned data centers), EU pod option available for Account Engagement on AWS Frankfurt for European customers, all configuration and reporting routed through Salesforce trust boundary - Data transferred outside the EU Personal data (visitor identifiers, email addresses, lead profiles, browsing behavior, form submissions) is transferred to Salesforce Inc. in the United States. Salesforce relies on Standard Contractual Clauses (SCCs) and is certified under the EU-U.S. Data Privacy Framework (DPF) for transfers from the EEA, UK and Switzerland. EU pod customers can keep primary processing in Frankfurt but support, sub-processors and integrations may still trigger transfers. ### Cookies set (5) | Name | Type | Duration | Purpose | | ------------------------ | ------------ | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | visitor\_id\ | first\_party | 10 years (default, configurable) | Persistent visitor identifier scoped to the Pardot account number (piAId). Tracks a browser across sessions, links anonymous browsing to a prospect record once a form is submitted, and powers lead scoring and email attribution in Salesforce Account Engagement. | | lpv\ | first\_party | 30 minutes | Last Page View timestamp, scoped to the Pardot account number. Used by the tracking script to deduplicate rapid successive page views, throttle scoring events and avoid double counting of activity within the same browsing session. | | pardot | first\_party | Session | Session cookie set during a single browsing session to maintain continuity between page views and form interactions. Cleared when the browser is closed. | | pi\_opt\_in | first\_party | 10 years (configurable) | Stores the visitor opt in or opt out decision when the Pardot Consent API is enabled. Allows the tracking script to determine whether to activate visitor tracking, lead scoring and email engagement attribution on subsequent visits. | | visitor\_id\-hash | first\_party | 10 years | Hashed verification value paired with the visitor\_id cookie, used by Salesforce Account Engagement to validate the integrity of the visitor identifier and prevent tampering or cookie injection. | ### Third-party domains contacted (5) - `pi.pardot.com` - `go.pardot.com` - `pardot.com` - `salesforce.com` - `force.com` Questions ## Frequently asked questions about Salesforce Marketing Cloud Account Engagement Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Salesforce Marketing Cloud Account Engagement (Pardot) set? Pardot sets several non essential cookies, all loaded by the pi.js tracking script. The main one is visitor\_id followed by the Pardot account number (for example visitor\_id12345), a persistent identifier that can live up to ten years by default. It is accompanied by lpv plus account number (last page view timestamp, used to deduplicate page views), a short lived session cookie called pardot, and pi\_opt\_in when the Pardot Consent API is enabled. Depending on your tracker domain setup, these cookies are set either on your own marketing domain (first party) or on pi.pardot.com (third party). None of them are strictly necessary, so all require prior consent under Article 5(3) of the ePrivacy Directive. ### Does Pardot/Account Engagement require user consent? Yes. Pardot performs cross session tracking, lead identification through cookie stitching and automated profiling via lead scoring. Under Article 5(3) of the ePrivacy Directive (and national transpositions such as the French Data Protection Act, the German TDDDG, the Italian Codice Privacy or the Spanish LSSI) any non essential storage requires prior informed consent. The Pardot snippet must therefore be blocked by default by your CMP and only loaded after the user accepts the marketing or advertising category. Pre ticked boxes, soft opt in, or implied consent from continued browsing are not valid. ### What is the legal basis for processing under Pardot/Account Engagement? For website tracking and the resulting profiling, the only realistic legal basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) ePrivacy for cookie storage. Legitimate interest under Article 6(1)(f) is generally not appropriate for behavioral tracking, persistent identifiers and cross session profiling, since EDPB guidance and national supervisory authorities consider that the impact on data subjects outweighs the controller's interest. For existing CRM contacts, legitimate interest or contract performance may cover transactional emails, but marketing automation, lead scoring and cookie based tracking still rely on consent. ### Does Pardot transfer data outside the EU (especially to the US)? Yes. Salesforce Inc. is a US company and Account Engagement is primarily hosted in the United States. European customers can subscribe to the EU pod with the production database in Frankfurt, but global support, sub processors and Marketing Cloud integrations can still trigger transfers outside the EEA. Salesforce relies on the 2021 Standard Contractual Clauses and is certified under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF. You must document these transfers in your ROPA, perform a Transfer Impact Assessment and disclose them in your privacy notice. ### Do I need a DPIA for Pardot/Account Engagement? A DPIA is strongly recommended and usually required. Pardot meets several criteria from the EDPB and national DPA lists that trigger an Article 35 GDPR assessment: systematic monitoring of website visitors, persistent identifiers, automated scoring that can produce significant effects (sales contact, exclusion from leads), large scale processing of contact data, and international transfers to a third country. The DPIA should describe the lifecycle from anonymous visit to identified prospect, evaluate retention, examine the impact of automated scoring, assess SCC and DPF safeguards, and define mitigation measures such as shorter cookie lifetimes and a first party tracker domain. ### How do I implement Pardot GDPR-compliantly? Treat Pardot as a marketing tool that must be loaded only after consent. Block the pi.js script by default in your tag manager and CMP, and load it only when the marketing or advertising category is accepted. Set up a first party tracker subdomain so cookies are written on your own marketing domain. Reduce the cookie lifetime from the ten year default to the minimum needed for your sales cycle. Enable the Pardot Consent API to honor opt outs across the platform and to delete or suppress profiles on erasure requests. Keep form fields minimal, separate cookie consent from marketing communication consent, and update your privacy notice to describe cookie stitching, automated scoring and US transfers. ### What are alternatives to Pardot/Account Engagement? Common alternatives in the marketing automation space include HubSpot Marketing Hub (US based, similar privacy profile), Adobe Marketo Engage (US infrastructure with regional options), and European vendors such as Brevo (formerly Sendinblue), ActiveCampaign with EU residency, Mautic (open source, self hostable) or Plezi for pure B2B in Europe. For very privacy sensitive deployments, you can also keep lead capture entirely server side, integrate it directly with your CRM without web tracking, and measure marketing performance with a cookieless analytics solution like Plausible, Matomo (self hosted) or Fathom. ### How do I update my cookie policy to include Pardot? List the Pardot cookies explicitly in your cookie policy: visitor\_id (with the account number suffix), lpv, pardot and pi\_opt\_in. Describe each cookie's purpose (visitor identification, last page view, session continuity, consent state), its duration (from session up to several years), its category (marketing or advertising) and whether it is first or third party in your configuration. Mention Salesforce Inc. as the recipient, explain that data is transferred to the United States under SCCs and the EU-U.S. Data Privacy Framework, and provide a link to the Salesforce privacy notice. The same information must appear in granular form in your CMP preference center so users can opt in or out specifically for Pardot. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [GuildQuality](https://www.flowconsent.com/en/services/marketing/guildquality) [GuildQuality is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. GuildQuality offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, GuildQuality empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/guildquality) [Analytics](https://www.flowconsent.com/en/services/marketing/guildquality) · ### [eSputnik](https://www.flowconsent.com/en/services/marketing/esputnik) [eSputnik is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. eSputnik provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, eSputnik helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/esputnik) [Marketing](https://www.flowconsent.com/en/services/marketing/esputnik) · ### [Clickx](https://www.flowconsent.com/en/services/marketing/clickx) [Clickx is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Clickx offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Clickx empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/clickx) [Analytics](https://www.flowconsent.com/en/services/marketing/clickx) · ### [Myli](https://www.flowconsent.com/en/services/marketing/myli) [Myli is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Myli supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Myli ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/myli) [Preferences](https://www.flowconsent.com/en/services/marketing/myli) · ### [Mutiny](https://www.flowconsent.com/en/services/marketing/mutiny) [Mutiny is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Mutiny provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Mutiny helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/mutiny) [Marketing](https://www.flowconsent.com/en/services/marketing/mutiny) · ### [SEOmator](https://www.flowconsent.com/en/services/marketing/seomator) [SEOmator is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. SEOmator supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, SEOmator enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/marketing/seomator) [Analytics](https://www.flowconsent.com/en/services/marketing/seomator) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)