B2B website visitor identification in France

It is workable under Regulation (EU) 2016/679, which applies directly, together with the Loi Informatique et Libertés n°78-17, repeatedly amended to stay aligned with the GDPR. The usual legal basis is legitimate interest under Art. 6(1)(f) GDPR, documented through a written balancing test (mise en balance) that weighs the commercial interest in identifying a visiting company against the expectations of whoever browses the site, and the practice is disclosed in the politique de confidentialité alongside other processing already listed there. The CNIL has published guidance on legitimate interest in the context of commercial prospecting that a French compliance reviewer will often check a vendor against, rather than accepting a generic GDPR statement. lead.box acts strictly as processor under a data processing agreement; the final assessment of whether this basis fits your own site and audience always stays with you as controller, and nothing here should be read as legal advice.

The CNIL (Commission nationale de l'informatique et des libertés) is the French supervisory authority, and it is unusually active in publishing detailed positions — lignes directrices and recommandations on cookies and trackers, including the well-known délibération n°2020-091 — that go beyond the bare ePrivacy text. Its doctrine and its sanctions under Art. 82 of the Loi Informatique et Libertés target consent interfaces that make refusing tracking harder than accepting it, a question that only arises once something is stored on or read from the visitor's device. Company-level identification resolves an organisation from network-level signals without writing to or reading from that device, so it sits outside the specific mechanism the CNIL's cookie doctrine polices. Whether the rest of a given site needs a compliant consent banner for its own trackers remains a separate question the controller has to answer, independent of this tool.

French legal and DPO teams generally expect three documents before signing off: the written balancing test under Art. 6(1)(f) GDPR naming the specific purpose (prospection commerciale, not profiling), an entry ready to drop into the registre des traitements required under Art. 30 GDPR, and the data processing agreement under Art. 28 GDPR with its sub-processor list. Many French groups already run a similar balancing-test template for other BtoB prospecting tools, so a reviewer usually recognises the pattern rather than starting from scratch. Where a data protection officer has been appointed under Art. 37 GDPR — common in larger French groups and public-facing organisations — that person typically wants the balancing test to state a review date rather than being filed once and forgotten. lead.box provides the underlying facts needed to complete these documents, but drafting and approving them stays the controller's own responsibility.

lead.box resolves the name and domain of the visiting company from network-level signals associated with the visit; it does not set a cookie, does not read or write anything on the visitor's device, and does not build a cross-site advertising profile. Just as importantly for a French reviewer, it does not identify or attempt to identify the named individual behind a visit, does not scrape professional network profiles, and does not append an email address to a session the way some sales-intelligence tools marketed for BtoB prospecting do — a distinction French compliance teams are increasingly used to asking about given CNIL scrutiny of aggressive prospecting practices. The output is a company name and the pages viewed, not a person and not a contact record, which keeps the processing at the company level the entire way through, from collection to export.

French BtoB sales cycles, particularly for equipement industriel, services informatiques and consulting sold to grands comptes, tend to run through several stakeholders who research quietly for weeks before a comité de direction issues a formal appel d'offres, and the final purchase decision is often reserved for a directeur général even when a manager ran the evaluation. Commercial teams typically work Salesforce, HubSpot or Pipedrive, and identified companies are pushed there by webhook so an Account Executive following named grands comptes sees a new company appear without manual entry. For smaller PME/ETI, a simple weekly CSV or Excel export reviewed in the point commercial meeting is often more practical than a live dashboard, and it fits the more hierarchical, formally structured way French sales organisations tend to review pipeline.

The data processing agreement under Art. 28 GDPR and a versioned sub-processor list are published so a DPO or an external avocat spécialisé can review them in French before a contract is signed rather than requesting them mid-negotiation. Data concerning EU visitors, including visitors from France, is processed in ISO-certified EU data centres and is not transferred outside the EU for this purpose, which removes the international transfer question that has become particularly sensitive in France following the CNIL's own scrutiny of non-EU processing tools such as its 2022 position on Google Analytics. Because French procurement often wants documents in hand before a comité de direction meeting rather than after, having the DPA, the sub-processor list and the residency statement available upfront tends to shorten rather than lengthen the internal approval cycle.

Getting started means adding a first-party JavaScript snippet to the site, most often through a tag manager such as Google Tag Manager, which is the deployment method most French web teams and their prestataires already govern, so no direct code change is usually required. Identified companies typically start appearing within the first days of traffic, and from there they can be exported as CSV or Excel for a weekly commercial review, or pushed automatically by webhook into whichever CRM the sales team already runs. Seats can be added for colleagues as the commercial team grows, and cancellation is handled through self-service account settings rather than a written lettre de résiliation sent by post, which matches how French SaaS buyers increasingly expect to trial and exit tools without a long-term engagement.

Identification resolves companies from network-level signals, and its accuracy depends on how a visit reaches the internet: an employee on a fixed office connection from a major French operator such as Orange, SFR, Bouygues or Free is generally resolved reliably, while a visitor on a mobile network, a personal VPN, or a shared connection is harder or impossible to attribute correctly. Large immeubles de bureaux and business parks that house several unrelated companies behind a single shared internet connection can also produce a resolved name that reflects the building's main tenant rather than the actual visiting company, and holding structures where several filiales share one group-level egress IP present a similar risk. lead.box treats every match as a signal for a sales team to qualify, not a verified fact, and a French sales rep should always confirm the account before treating a resolved name as a qualified lead.