RB2B GDPR Alternative: Visitor ID for European Traffic

If you need an RB2B alternative for GDPR reasons, the practical shift is from person-level matching to company-level, cookieless identification, combined with a clear lawful basis and a signed data processing agreement. That reduces, but does not remove, your obligations. This article is general information and not legal advice.

Product descriptions below come from the public pages of BusinessMCP, which competes with RB2B and says so on its own RB2B alternatives page. Read them as the vendor’s own claims.

Why RB2B raises questions for European traffic

The comparison says RB2B’s person-level matching relies on US identity-graph data and covers only US traffic, resolving roughly 5 to 20 percent of it. It also describes the consent posture for US persons visiting from the EU as debated. That does not mean the tool is unlawful. It means the question is open enough that a European company should ask the vendor for its legal analysis, data processing agreement, retention periods and sub-processors before turning it on. If you are curious how far outside the US it reaches, see does RB2B work outside the US.

Two different kinds of data

Approach	Typical output	Personal data risk	Coverage
Person-level matching	Name, email, LinkedIn URL	High	US only for most vendors
Company-level resolution	Company name, domain, network class	Lower, not zero	Global
Cookieless analytics	Aggregated counts	Lower	Global

The distinction matters because the core GDPR test is whether data relates to an identified or identifiable person. The regulation’s definitions are in Article 4 of the GDPR. A company name resolved from a network block is generally about an organisation, but an IP address can itself be personal data in some contexts, and a small company or sole trader can blur the line. Our explainer on person-level versus company-level identification goes further.

Key takeaway: company-level identification lowers risk because it asks a less intrusive question, not because it exempts you from the law.

What a more conservative setup looks like

BusinessMCP says it uses cookieless tracking and processes firmographic data instead of personal profiles, which it calls the GDPR-conservative approach, and publishes a GDPR guide to visitor identification. Its comparison also lists DPA and GDPR pages in its footer. Whether that is enough for your situation depends on your lawful basis, your sector and your national regulator.

Components of a cautious configuration:

1. Company-level resolution only, with no attempt to name individuals.
2. Cookieless or consent-gated scripts, aligned to your cookie banner logic.
3. A written assessment of your lawful basis, commonly legitimate interests for B2B analytics, documented.
4. A DPA with every vendor that touches the data.
5. Clear wording in your privacy notice about what you collect and why.
6. Retention limits and a way to honour objections and deletion requests.

Outreach is a separate legal question

Identifying a company is one thing; emailing someone there is another. BusinessMCP’s tracking-laws guide says B2B email is not harmonised across the EU and that Germany and Austria generally require prior consent even for cold B2B email. The UK has its own rules under PECR. Plan outreach per country, and do not assume that a lawful identification step makes a lawful email. Our own summary of tracking laws points to the main regimes.

Questions for any vendor

• Do you process personal data, and under what role: processor or controller?
• Can you provide a DPA and a list of sub-processors?
• Where is data stored and for how long?
• How do you handle opt-outs and the Global Privacy Control signal?
• What happens to data if I delete a visitor record?
• Do you set cookies on my visitors’ devices?

Trade-offs of going company-level

You gain	You give up
Lower personal-data exposure	Individual LinkedIn profiles
Worldwide coverage	The ability to message a named visitor immediately
Simpler consent story	Familiar US-centric workflows

BusinessMCP is candid about this: it identifies companies by default, offers person-level reveal only through your own RB2B or Leadpipe key for US traffic, and is a younger product with a smaller integration marketplace. If those limits suit you, the BusinessMCP visitor identification page describes how it works, and our tool roundup lists other options.

Final check

Before launch, test on your own traffic with the process in how to test a visitor identification tool, and have a privacy professional review the setup. Regulators and case law change, and the same configuration can be fine in one country and risky in another.

A short due-diligence worksheet

Before you adopt any identification tool for European traffic, work through this list with whoever is responsible for privacy in your company.

1. Roles. Decide whether the vendor acts as a processor on your behalf or as an independent controller. This changes who owes what to the visitor.
2. Lawful basis. Many B2B teams rely on legitimate interests for analytics, which requires a documented balancing test. Consent is the alternative where cookies or similar technologies are involved.
3. Transparency. Your privacy notice should describe visitor identification in plain language, including what is collected, why, for how long and who receives it.
4. Transfers. If data leaves the EU or UK, identify the transfer mechanism the vendor relies on and keep a copy.
5. Minimisation. Collect only what you need. If you only act on company names, do not store individual-level fields.
6. Rights. Make sure you can honour access, objection and deletion requests, including requests that reach the vendor.
7. Records. Add the processing to your record of processing activities.
8. Review. Calendar a review for six months out, because regulator guidance moves.

None of this guarantees compliance. It does show a regulator that you took the question seriously, which tends to matter if a complaint arrives.

Consent banners and identification scripts

Whether a tool needs consent depends on whether it stores or reads information on the visitor’s device. BusinessMCP’s guide says cookieless analytics mainly changes the cookie-consent question; other duties remain. If your chosen tool sets cookies, it should load only after consent in jurisdictions that require it, which will reduce the visitors it can see. Expect lower counts in Europe than in the US for that reason, and do not treat the gap as a tool failure. It is the cost of lawful consent handling.

What to do if you already use RB2B in Europe

Do not panic, and do not rely on a blog post. Request the vendor’s DPA and documentation, ask for its position on EU visitors, and have your privacy lead decide whether to pause the script for European traffic while you review. You can geofence the script to US visitors if your consent platform supports it. In parallel, trial a company-level, cookieless alternative using our test plan, and compare what you would give up. In many cases, teams find that the European share was contributing very little identification anyway, because a US-only tool does not match those visitors; see coverage outside the US.