Is it legal?
Yes. What applies where (US, UK, EU/EEA), whether you need visitor consent, and the four things to have on your website.
Yes. Identifying the people who visit your website is legal and standard B2B practice. You do not register with anyone, and you do not ask visitors for consent beyond what your normal privacy and cookie notices already cover. What we identify depends on where the visitor is.
What is allowed where
| Where | What you get | What it rests on |
|---|---|---|
| United States and the other exact-visitor countries | The exact visitor: name, work email, phone, LinkedIn, company | People who opted in through our partner network. US privacy law (CCPA, CPRA) works on notice and opt-out, not opt-in. |
| United Kingdom | The exact visitor, as in the US | The same opt-in. Business contacts can be emailed without prior opt-in (PECR). |
| EU and EEA | The company, plus a suggested contact there; never the individual visitor | GDPR Article 6(1)(f), legitimate interest in reaching a decision-maker at a company that showed interest |
A work email, a job title and a company phone are business contact details, treated differently from sensitive personal data everywhere. Reaching a person in their professional capacity is the normal basis of B2B marketing.
Do I need visitor consent?
No prior consent in the US and most of the world: notice in your privacy policy, plus a way to opt out.
- United States: mention us in your privacy policy and link an opt-out. In California, also link "Your Privacy Choices" and let your consent manager handle the GPC signal (California privacy setup).
- United Kingdom: most sites already run a cookie banner. Add us to its Marketing category and list us in your privacy policy.
- EU and EEA: a consent banner is standard there. Put us in its Marketing category (which category to choose).
- Everywhere else: the same as the US.
The four things to have on your site
- A privacy policy line saying you use a visitor identification service, next to where you mention Google Analytics: the paragraph to paste.
- A cookie notice entry, listed with your other cookies: the wording. Using a consent banner? The pixel goes in the Marketing category.
- An opt-out link: happierleads.com/opt-out, or your own opt-out page.
- Our Data Processing Agreement, for the processor side: it applies automatically under the Terms (read the DPA); sign a copy under Settings → Compliance.
Can I email or call the people you identify?
Yes. In the US, CAN-SPAM asks for a real sender and a working unsubscribe link; no prior opt-in. In the UK, PECR treats corporate email addresses differently from personal ones. In the EU the rules vary by country. The safe pattern is the same everywhere: a clear sender, a relevant reason for writing, and an easy way to opt out. Email campaigns add the unsubscribe link for you.
What we do on our side
- We never sell, share or license your identified leads to anyone. Your leads are yours alone, and we never combine data across customers.
- Anyone can opt out at happierleads.com/opt-out; every request is handled within 45 days, and visitor privacy requests (access, deletion) are handled for you.
- We are a UK-based company and comply with GDPR and the CCPA: Privacy & GDPR, Personal data under GDPR and CCPA.
California: am I a data broker?
No. For a business identifying visitors to its own website, the visitor came to you and you use the data yourself instead of selling it. What the Delete Act and DROP mean for resellers: California Delete Act, DROP and data brokers.
We are not a law firm and this is not legal advice; it is how the rules work in practice for the businesses using Happierleads. Share this page and the DPA with your legal team and they will have what they need.