The GDPR is not the reason your pipeline is soft. What is soft is the version of the GDPR that gets passed around in marketing Slack channels — a mix of overheard risk-aversion, half-remembered cookie-banner theatre, and the odd LinkedIn thread from a consultant selling a course. Here are five of the most expensive myths, each with the honest reality and a next step you can actually take on Monday.
Note
This is a marketing article, not legal advice. Regulators do move on details; when in doubt about your specific situation, talk to your DPO or your counsel. That said — the myths below are not close calls.
Myth 1 — "Everything needs consent"
Reality: consent is one of six lawful bases in Art. 6 GDPR, not the default. Legitimate interest (Art. 6(1)(f)) is a full lawful basis in its own right and is explicitly available for direct marketing under Recital 47. B2B website-visitor identification at the company level — no personal profiling, no tracking of individual site users — routinely qualifies under legitimate interest with a proper balancing test on file.
What to do: stop reflexively asking for consent for things that do not need it. Document your balancing test (LIA) for the ones that qualify. Reserve consent screens for what actually requires them, like third-party ad cookies. Users will thank you; so will your conversion rate.
Myth 2 — "IP addresses are always off-limits"
Reality: IP addresses are personal data when they can be linked to an individual. Processing them is not forbidden — it needs a lawful basis and proportionate safeguards. B2B identification typically resolves the IP to a company (an organisation, not a person), keeps the raw IP for a short technical window, and never sells or enriches individual behaviour. That is a very different processing profile from the ad-tech scenarios the "IP = untouchable" myth is imagining.
What to do: keep the IP-processing window short, be explicit about it in your privacy notice, and describe the transformation (IP → company, not IP → person). If you use a processor, put that in your Art. 28 DPA.
Myth 3 — "First-party only means no insight"
Reality: this myth confuses two entirely separate things. Consent for cookies (ePrivacy / TDDDG § 25 in Germany) is a rule about what you store on the visitor's device, and it distinguishes cross-site advertising storage from a functional first-party identifier on your own domain. Identification of the company behind a visit runs server-side against verified B2B data — it is a distinct processing activity that lives under GDPR alone. You can restrict yourself to a first-party functional identifier and still know that Bosch was on your pricing page.
What to do: separate the two questions in your own head first. "What do I store in the browser?" (ePrivacy answer, likely nothing beyond strictly necessary). "What do I process about the visit?" (GDPR answer, likely under legitimate interest for company-level identification).
Myth 4 — "GDPR bans B2B tracking"
Reality: the GDPR regulates the processing of personal data. It does not regulate "tracking" as a category, and it certainly does not ban B2B marketing — Recital 47 is explicit that direct marketing is a legitimate interest. What is heavily regulated is behavioural tracking of natural persons for ad targeting. Company-level identification, without personal profiling, is not in the same universe.
What to do: describe accurately in your own materials what you do and what you do not. "We identify visiting companies. We do not track individual site users. We do not sell data." Precise language protects you far more than vague language.
Myth 5 — "A cookie banner fixes everything"
Reality: a banner is a consent capture mechanism for cookie-and-similar-technology storage. It is not an all-purpose GDPR indulgence. Slapping a banner on top of processing that is not lawful underneath does not launder the processing; it just makes the interface uglier. Conversely, a properly-scoped process under legitimate interest does not need a banner to be lawful.
What to do: your banner exists for one job — collecting consent for storage that is not strictly necessary. Everything else belongs in a privacy notice, a DPA, and internal documentation. If your banner is doing more than that, it is probably doing it badly.
The five myths, side by side
| Myth | Reality | Anchor |
|---|---|---|
| Everything needs consent | Consent is one of six bases; LI is a valid basis for B2B marketing | Art. 6(1)(f); Recital 47 |
| IP addresses are off-limits | Personal data — needs a lawful basis and proportionate safeguards | Art. 4(1), Art. 6 |
| First-party only means no insight | ePrivacy governs storage (and distinguishes first-party functional from cross-site advertising); GDPR governs processing. Distinct. | ePrivacy Directive; TDDDG §25 (DE) |
| GDPR bans B2B tracking | It regulates personal-data processing; B2B direct marketing is a recognised LI | Recital 47 |
| A banner fixes everything | A banner captures consent for storage. It does not launder unrelated processing. | ePrivacy |
The pattern in all five
Each myth swaps one specific rule for a vague vibe. The rules themselves are, in general, more permissive of thoughtful B2B marketing than the vibes suggest. Reading the actual article you are citing takes ten minutes and saves quarters of self-imposed handicap.
None of this is an invitation to be reckless. It is an invitation to stop being intimidated by regulation you have not read. GDPR-first marketing exists; a lot of it is quietly beating consent-only marketing on the metrics that matter.
This article is general information for B2B marketing teams and not legal advice. Confirm your specific situation with your DPO or counsel.
Published by
lead.box Team
More articles
See lead.box on your own traffic
Start free — no card, no sales call required. Or book a 20-minute walk-through if you want the guided tour.