The short answer

RB2B doesn't say it complies with GDPR. It says GDPR doesn't apply to its person-level identification, because that only works for people in the US.

For a European website, that leaves three things you're responsible for: the script running on your site, any personal data you receive, and where that data goes. RB2B's own terms say so too.

What RB2B says about GDPR

On its GDPR page, RB2B says its person-level identification "is a US technology that fires on US soil, resolving US data subjects". Its FAQ adds that its database "only contains profiles matched to US home addresses, and IP ringfencing ensures only US traffic is resolved". On its pricing page, person-level identification is labelled "US Only".

For visitors elsewhere, RB2B offers company-level identification through a partner, Demandbase. For that, its GDPR page says you "MUST use a Consent Management Solution".

The same page is open about two limits:

  • It collects EU visitors' IP addresses to decide whether to fire, which it calls "incidental".
  • It says it's "not inconceivable" that its suppliers occasionally provide data about someone in the EU or UK.

And it advises: if you market EU or UK products from the EU or UK, "you may wish to consult an attorney regarding whether the GDPR applies to you".

Three questions for a European website Each applies whatever the tool's own position is 1 The script on your site Reads from and stores on the visitor's device: consent first (ePrivacy Directive) 2 The data you receive A legal basis, telling the person, and stopping when they object (GDPR) 3 Where the data goes Outside the EU only on a valid transfer basis (GDPR chapter V)
What EU law asks of the website, whatever the tool's own position.

RB2B works by adding a script to your site. Its help centre lists ten cookies it sets in the visitor's browser, one of which keeps a visitor ID for 360 days.

Under the EU's ePrivacy Directive, storing something on a visitor's device, or reading from it, is only allowed with their consent, unless it's strictly needed for the service they asked for. The Court of Justice ruled in Planet49 that this applies whether or not the information is personal data, and that a pre-ticked box isn't consent. The European Data Protection Board says a tracking pixel's script counts as reading from the device.

RB2B says its script doesn't need consent "in line with U.S. standards". Its help centre also says it "does not support configuring its script to exclude tracking in specific regions", so it loads for your European visitors too. Its own advice where consent is required: "Do not load RB2B's tracking script until after consent is given."

The responsibility isn't only RB2B's. In Fashion ID, the Court of Justice held that a website that embeds a third party's script can be a controller for collecting and passing on its visitors' data. Regulators enforce this: the Dutch authority fined Kruidvat €600,000 for tracking cookies set without consent, and says it monitors 10,000 Dutch websites.

2. Any personal data you receive is your responsibility

A name, a LinkedIn profile and a work email are personal data under GDPR, and so is a visitor's IP address when it can be linked to a person, as the Court of Justice ruled in Breyer. Business contacts aren't exempt.

RB2B's terms say that if you receive data covered by GDPR, you may only use it with the person's consent or another legal basis, and that you are "solely responsible" for complying with the law. Its data protection addendum makes you and RB2B each an independent controller of that data.

If any such data reaches you, GDPR asks three things:

  • A legal basis. Using data for direct marketing can be a legitimate interest, but only if it's strictly necessary and the person's interests don't outweigh yours. In 2024 the Court of Justice confirmed that a commercial interest can count, under those conditions. The European Data Protection Board's draft guidance says the balancing test would hardly ever come out in your favour for tracking people across websites for marketing.
  • Telling the person. When you get data about someone from elsewhere, you must tell them who you are and what you're doing with it, at the latest when you first contact them.
  • Stopping when they object. People can object to direct marketing at any time, and then you must stop.

3. Where the data goes

RB2B's privacy policy says its service is "hosted in the United States". Personal data can only leave the EU on a valid basis, such as a company certified under the EU-US Data Privacy Framework, or standard contractual clauses. We searched the official Data Privacy Framework list on 23 October 2026 and found neither RB2B nor its legal entity, GetEmails LLC (Retention.com). Its data protection addendum is written around US state privacy laws.

If you only use RB2B on US visitors, this matters less. But the script, and with it the IP addresses of your European visitors, still goes to RB2B.

How regulators treat similar tools

No European regulator has published a decision about RB2B that we could find. The closest cases:

  • KASPR (France, 2024). The CNIL fined KASPR €240,000 for a browser extension that collected professional contact details from LinkedIn profiles, with a database of about 160 million contacts. The CNIL found the collection went beyond what people on a professional network could reasonably expect, and that people weren't properly informed. The fine was agreed with all other European regulators. In 2026, KASPR deleted its database to comply.
  • Infobel (Belgium, 2025). The Belgian authority fined data broker Infobel €40,000 for reselling data for marketing without valid consent, and ordered it to inform its business customers.
  • Bought data (Belgium, 2025). In decision 76/2025, the Belgian authority said a business can't rely on the claimed lawfulness of data it bought, and that a clause in the contract with the seller doesn't remove its own responsibility.

The lesson for a European business: a vendor saying "GDPR doesn't apply to us" doesn't settle whether it applies to you.

If you still want to use RB2B

For example because you sell to US companies and most of your traffic is from the US:

  1. Load the script only after consent, through your cookie banner. RB2B's own guidance says to do this where consent is required. Expect fewer matches: RB2B says about a third of visitors decline its banner.
  2. Say it in your privacy policy: which tool, what it does, and that data goes to the US.
  3. Check what reaches you. If a European contact shows up, don't email them on that basis; delete it.
  4. Give people a way to object, and honour it.
  5. Ask a lawyer if you sell mainly in Europe.

Is there another way?

Most of the value of knowing who visited is in reaching the people who are ready to talk. You can also get that by asking them.

Signal reads what a visitor does on your site, asks one short question when the answer would change what to offer, and offers the ready ones a call, a call back or WhatsApp. It doesn't buy contact data or keep IP addresses; when a visit comes from an organisation's own network it shows that organisation's name, and home and mobile connections never show one. Contact details only come from visitors who chose to give them. See Signal compared with RB2B, and for tools that work for European traffic, RB2B alternatives for European websites.