What the snippet stores in the browser
The snippet is served first-party through your own domain. In the browser it keeps a functional identifier scoped to your domain — in a cookie or in local storage — which exists for one reason: stitching several pageviews of the same browser session into one visit. Without it, a visitor reading four pages would look like four unrelated visits.
That identifier is not an advertising identifier. It is readable only on your own domain, it is not shared with ad networks, there are no third-party or cross-site identifiers, and no device fingerprint is calculated. The company behind a visit is resolved on the server side from the network signal, not from anything stored on the device.
When the snippet loads
lead.box does not gate itself on a consent decision — the loader runs where you place it. That is a deliberate choice: you own the consent architecture of your site, and the snippet should not silently override it. Where you place it therefore decides when identification starts.
Both placements are supported. If your assessment is that company-level identification rests on legitimate interest, you can load the snippet unconditionally like any other functional script. If you would rather have it wait for a decision, put it behind a consent category in your CMP and it only runs once that category is accepted.
Wiring it into a CMP
Technically the snippet behaves like any ordinary tag, so it fits the pattern your CMP already documents. Most teams take one of these three routes.
- Tag manager: add the snippet as a tag and fire it on your CMP's consent event for the chosen category.
- Category-blocked script: let your CMP block the script tag until the category is accepted, exactly as it does for analytics tags.
- Unconditional: place the snippet in the page head and document the processing in your privacy notice.
What to write in your privacy notice
Whichever placement you pick, the processing needs to be disclosed. lead.box ships a ready-made privacy-policy paragraph you can adapt, covering what is processed, the purpose, and where the processing happens. It also points to the public opt-out page so a visitor who objects has somewhere to go.
One caveat worth stating plainly: what is lawful on your site depends on your own assessment and on the rest of your tag setup, which we cannot see. This page describes the product's behaviour so your privacy team has facts to work with — it does not replace their decision.
Related questions
Try it in your own setup
The 14-day trial runs without a credit card, so you can install the snippet in a staging or production setup and see how it behaves alongside your existing tags.