Snitcher was built for B2B: it identifies the companies visiting your website, not individual consumers. That focus shapes how we handle data — we collect the minimum needed, aggregate it at the company level, and host everything in the EU. This article explains exactly what the Snitcher tracker collects and stores, the legal basis for using it, and what to add to your privacy statement and cookie notice.
In short:
Snitcher can be used in compliance with the General Data Protection Regulation (GDPR), on the well-established legal basis of legitimate interest (Art. 6(1)(f) GDPR).
Snitcher identifies companies, not people. Visit data is matched against our company database and aggregated at the company level, and we never share a visitor's IP address.
The tracker's footprint in the browser is deliberately small: it sets one cookie,
snitcher_device_id, with a lifetime of one year, plus session information in browser storage — the full list is below.Snitcher works smoothly alongside consent banners: it integrates automatically with Cookiebot, OneTrust and Transcend, and can be configured to not set cookies until the visitor has given consent.
All data is processed and stored in the EU (Frankfurt, Germany), encrypted in transit and at rest.
We recommend mentioning Snitcher in your privacy statement and cookie notice — ready-to-use example text is included at the end of this article.
What data does Snitcher collect?
Snitcher's tracker collects the following data about your website's visitors:
Behavioural data — the pages a visitor views, the source that referred them, and how long they are active on your site.
Technical data — the visitor's IP address and technical characteristics of their browser and device.
Identifiers — a randomly generated device ID (stored in the
snitcher_device_idcookie) and a session ID.
We process the visitor's IP address to look up the company behind the visit and its geographic location in our proprietary database. All visitor data is then aggregated at the company level: Snitcher shows you which companies visited your website and what they did there. The result is corporate data — company name, industry, size — not consumer profiles, and we do not share a visitor's IP address with you or anyone else.
Some optional features process additional data, and these are always under your control. For example, form tracking captures the fields of forms a visitor submits (password fields and other sensitive fields are always excluded), and the identify API and our Segment and RudderStack integrations let you attach details you already hold, such as a business email address.
Where is the data processed?
All collected data is sent to our infrastructure hosted on AWS (Amazon Web Services) in Frankfurt, Germany (eu-central-1), so your visitor data never leaves the EU. Data is encrypted both in transit and at rest.
See our Security article for more information.
Our legal basis: legitimate interest
Snitcher's processing is based on legitimate interest:
"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
See Art. 6(1)(f) GDPR – Lawfulness of processing for reference.
For B2B marketing and analytics, legitimate interest is the most suitable and most commonly used basis. The GDPR itself recognises this: Recital 47 explicitly notes that processing for direct marketing purposes may be regarded as carried out for a legitimate interest. The reasoning is straightforward — a business researching your product on your website has a genuine interest in what you offer, and you have a genuine interest in knowing which businesses those are.
Because Snitcher focuses on identifying businesses rather than individuals, personal data is used to a minimal extent, and nothing is exposed in the product at an individual level.
Cookies and browser storage
We keep the tracker's browser footprint small and transparent. It sets one cookie and uses browser storage to distinguish between different visitors on the same network:
Name | Type | Lifetime | Purpose |
| First-party cookie + localStorage | 1 year | A randomly generated identifier used to recognise a returning browser. Contains no personal data. |
| localStorage | 30 minutes after the last activity | A session identifier and engagement timing, used to group pageviews into a single visit. |
| localStorage | 1 year | Only used if you capture visitor details yourself via form tracking, the identify API, or an integration such as Segment. |
A few technical notes that may help when reviewing a cookie scan:
The
snitcher_device_idcookie is set as a first-party cookie on your own domain, withSameSite=Lax, and theSecureflag on HTTPS sites.To determine the correct domain to set its cookie on, the tracker briefly sets and immediately deletes a technical cookie named
__sn_tld_probe. It stores no data, but some cookie scanners may list it.Older versions of the Snitcher tracker used a cookie named
SNID. The current tracker no longer sets it, so it can be removed from your cookie policy.
Using Snitcher with a consent banner
Snitcher is designed to fit into your consent flow, whichever tool you use. With consent mode enabled (waitForConsent), the tracker does not set any cookies or persistent browser storage until the visitor has given consent — it only keeps a temporary identifier in sessionStorage, which is deleted when the tab is closed. Once consent is given, the tracker switches to the cookie and storage described above.
Snitcher automatically detects Cookiebot, OneTrust and Transcend consent banners and treats the visitor's acceptance of analytics or marketing cookies as consent. If you use a different consent management platform or a custom banner, your developers can signal consent with a single call to Snitcher.giveCookieConsent().
See our tracker consent documentation for setup instructions.
If you use Snitcher and need to comply with GDPR, we recommend the following:
Update your privacy statement to inform visitors about your use of Snitcher — GDPR requires you to inform visitors about what happens to their personal data, so add a note explaining that you gather this information and for what purpose.
Update your cookie notice with the cookie and storage listed above.
Here's an example text snippet you can include:
"We use Snitcher to measure the business use of our website and to identify the companies that visit us. Snitcher processes visitors' IP addresses to determine the company they work for, together with behavioural data such as the pages they visit and the time they spend on our site. This data is aggregated at the company level. To distinguish between visitors, Snitcher sets a first-party cookie named 'snitcher_device_id' with a lifetime of one year and stores session information in the browser. For more information, see Snitcher's privacy policy."
Questions about GDPR, cookies, or your specific setup? Reach out via the chat — we're happy to help.