A lot of B2B tracking vendors like the word "cookieless". It is a marketing word, and if you look closely it is usually not literally true. Company-level identification does write something to the visitor device — a first-party functional identifier on your own domain, used to stitch pageviews of the same browser session into a coherent company view. What it does not do is set advertising cookies, set cross-site cookies, fingerprint browsers, or hand data to ad networks. This piece walks through the exact scope so your DPO does not have to reverse-engineer it.
What the tracker actually writes to the device
On the first pageview the tracker generates a random device-scoped ID and stores it as a first-party value on your own domain (typically in a cookie or in localStorage). On subsequent pageviews the tracker sends this ID alongside URL, referrer, timestamp and user-agent to the ingest endpoint, so multiple pageviews of the same browser session can be attached to the same company view. That is the entire local footprint. No advertising cookies. No cross-site cookies. No third-party cookies. No fingerprinting.
Company resolution itself does not run on the device. The server takes the request IP, looks it up against verified B2B company data, resolves the organisation (or leaves it unresolved), discards the raw IP after resolution and stores the resolved organisation next to the pageview. The device-scoped ID exists only to group pageviews of the same session on your own domain — it is functional plumbing, not a profile.
What the tracker never does
| Behaviour | Company-level identifier (lead.box) | Advertising / retargeting cookies |
|---|---|---|
| Written on your own domain (first-party) | Yes | Sometimes |
| Written under a third-party domain | No | Yes |
| Readable by other sites | No | Yes |
| Used to build a cross-site profile | No | Yes |
| Shared with ad networks | No | Yes |
| Browser fingerprinting | No | Sometimes |
| Persists after opt-out | No | Depends |
Two rules, both still apply
The GDPR governs the processing (Art. 6(1)(f) legitimate interest, with a documented balancing test in favour of the business). ePrivacy / TDDDG §25 governs what is written on the device. Because a first-party functional identifier is written on your own domain, the §25 banner question is a scoping call for your DPO — not something a vendor can decide for you.
The banner question, honestly
You will read vendor pages that promise "no banner needed". Take that as marketing, not legal advice. §25 TDDDG requires consent for storage on or access to the terminal device unless the storage is strictly necessary for a service the user requested. Whether a first-party functional identifier for internal B2B analytics counts as strictly necessary is a scoping call: some DPOs say yes (it is functional plumbing on your own domain, disclosed under legitimate interest), others prefer to include it in the CMP as a functional/necessary category. Both are defensible. What you should not do is call it "cookieless" and skip the conversation.
How it fits alongside a CMP
- Keep your CMP for advertising and cross-site tools — nothing changes there.
- Categorise the company-level identifier as functional / strictly necessary, with a one-line rationale referencing internal B2B analytics on your own domain.
- Disclose the identifier explicitly in your privacy notice (a ready-made paragraph is on the /gdpr page — it names the first-party device-scoped ID).
- Provide the opt-out link (/opt-out) alongside the paragraph, so the visitor rights half of the story is not missing.
What happens when a visitor clicks "reject all"
If your CMP categorises the identifier as strictly necessary / functional, it keeps running — that is what strictly necessary means. If your CMP categorises it as an optional analytics category and the visitor rejects, the tracker stops writing the identifier and stops sending events for that visitor. Both configurations are legitimate; pick the one your DPO signs off on. Your identified-company numbers will be stable in the first configuration and consent-rate-dependent in the second.
What to say in your privacy notice
A single paragraph is enough. It names the processing, states the legal basis, explicitly discloses the first-party device-scoped identifier (do not hide it), points out that no advertising or cross-site cookies are used, and links to the DPA and to /opt-out. The /gdpr page has a copy-paste snippet in EN and DE that already names the identifier honestly.
Published by
lead.box Team
More articles
See lead.box on your own traffic
Start free — no card, no sales call required. Or book a 20-minute walk-through if you want the guided tour.