B2B Marketing: Privacy Compliance & Best Practices

This is a general overview of compliance tips when engaging in B2B marketing. The first half of the overview provides practical guidance for configuring and using B2B sales and marketing tools. The second half gives more comprehensive information about the legal requirements that inform the practical guidance.

Please note: This is a practical guide that may be useful for those thinking through and planning B2B marketing under the GDPR and CCPA but should not be construed as legal advice. Please always consult with your counsel or compliance team to determine your organization’s requirements.  

I. How to Use This Guide

This guide is intended to help 6sense customers, sellers, marketers, and legal teams translate privacy requirements into practical decisions when configuring and using B2B sales and marketing tools. It focuses on common 6sense-related workflows, including website visitor data and webtag deployment, contact acquisition and enrichment, outbound email campaigns, AI-assisted sales and marketing, and advertising audience activation.

II. Quick Compliance Checklist for 6sense Users

• Confirm which 6sense features are enabled and how they will be used.
• Identify what personal data is collected, enriched, scored, segmented, activated, or exported.
• Confirm cookie banner and consent-manager treatment for the webtag and other website tracking technologies.
• Confirm that privacy notices explain relevant analytics, marketing, profiling, segmentation, advertising, and AI-assisted processing.
• Determine whether contacts are eligible for outreach under applicable email marketing rules, not merely whether they may be stored.
• Confirm that suppression, deletion, opt-out, and consent-preference workflows are operational across CRM, MAP, SEP, advertising, and data-provider systems.
• Assess whether advertising audience activation may constitute a CCPA sale/share or targeted advertising activity.
• Confirm the organization’s AI use cases, human-review requirements, and disclosure or transparency approach.
• Document decisions where appropriate, such as legitimate interest assessments, DPIAs, consent configurations, vendor review, and regional marketing rules.

IV. Shared Responsibility Between 6sense and Customers

6sense provides tools, documentation, privacy and security materials, and product workflows that can support compliant B2B sales and marketing programs.

Customers remain responsible for:

• deciding how to configure and use the platform based on their applicable laws,
• risk tolerance,
• privacy notices,
• consent practices,
• marketing rules,
• and internal governance.

In practice, this means customers should ensure that their own systems and downstream integrations honor suppression, deletion, opt-out, consent, and regional eligibility requirements.

V. General Privacy Compliance in B2B Marketing Campaigns

A. Collecting Information About Website Visitors

1. Cookie Banners

A consent preference manager, or “cookie banner,” is a banner or a pop-up on a website that lets website visitors know that information is being collected about their devices and activities, i.e., through the placement of cookies, pixels, web beacons, etc. The cookie banner also generally links to an organization’s privacy policy, so website visitors can learn more about the collection of their personal data. Finally, a cookie banner can be used to allow website visitors to choose whether and how their browsing information is collected.  

Web admins can configure the consent preferences available to a website visitor based on applicable law and risk tolerance. For example, some organizations may require opt-in for all cookies and trackers that are not “strictly necessary.” Other organizations may geofence the options presented to a website visitor to mandate opt-in only in the countries and regions where opt-in is required.

6sense is unable to provide direct guidance to its customers about how to classify its webtag and cookies. However, many customers classify the 6sense webtag under an analytics use case. You can also learn more about 6sense cookies and browser storage in the 6sense Knowledge Base.

2. Privacy Policies

Different countries and states have different requirements for what information needs to be included in a privacy policy. Generally, a privacy policy should clearly describe:

• the types of personal data collected;
• how personal data is used, including analytics, marketing, segmentation, profiling, advertising, and AI-assisted processing where applicable;
• the categories of recipients or service providers that receive personal data;
• the individual’s rights with respect to personal data and how to exercise them;
• how opt-out, deletion, suppression, sale/share, and targeted advertising choices are honored; and
• contact information for the organization’s privacy program.

Privacy information should be provided in a clear, visible, understandable, and readily available format; written in plain language; delivered at the appropriate time; and made available free of charge.

Specific requirements for the privacy policy will differ depending on applicable privacy law, so it’s best practice to review applicable law to determine which additional requirements may apply.  

Finally, for organizations subject to the CCPA that use website visitor information for cross-context behavioral advertising, these organizations will want to have a “Do Not Sell/Share My Personal Information” link that allows website visitors the opportunity to opt-out of the share/sale of their personal information.

3. Web Forms

As with any other collection point for personal data, it’s a good idea to inform individuals of how you plan to use their information. Typically, companies will provide a link to their privacy policy; however, if you plan to use information collected via a webform for sales and marketing purposes, then you will need to determine whether express opt-in is also required.

4. State and Federal Wiretapping Statutes

In recent years there have been a spate of claims raised under the California Invasion of Privacy Act  and other theories related to wiretapping. These cases span a wide range of industries and frequently relate to the collection and transmission of website visitor data through commonly used website technologies, such as cookies, pixels, analytics tools, and other scripts. 6sense has guidance available for its customers related to reducing the likelihood of these types of claims.

Many of these claims focus on whether data collected during a website visit is shared with third parties without adequate notice or consent, and whether such data collection occurs before a visitor has had an opportunity to make a meaningful choice regarding tracking. While legal outcomes continue to evolve and vary by jurisdiction, organizations should be aware of these developments when assessing their website data collection practices. Some practical considerations include:

• Obtaining opt-in consent prior to the collection of such web traffic data;
• Providing clear and transparent notices of collection;
• Utilizing Google Tag Manager (or similar solutions) to delay tag firing until a predefined action, or “trigger,” occurs.

Practical Note: Organizations should conduct periodic reviews of consent mechanisms and website technologies to ensure that any configurations are technically enforced (e.g., that user choices (such as declining or withdrawing consent) are respected in practice, and that relevant tracking technologies do not continue to collect or transmit data after an opt-out).

B. Acquiring Contact Data

If your organization has completed the requirements to enable Contact Data in 6sense, you can use 6sense Services to acquire new contacts or enrich existing contacts.

Different uses of personal data may have different requirements. For example, some rules apply to marketing emails that don’t apply to other use cases, like storing personal data. One reason is that there is often one law covering the use of personal data generally (e.g., the GDPR) and another law covering online marketing specifically (e.g., the ePrivacy Directive). Even in absence of a comprehensive privacy framework, there can still be requirements for marketing emails, such as adding an “unsubscribe” link under laws like CAN-SPAM.

The privacy requirements related to storing a contact in your CRM, MAP, SEP, etc., vary based on whether there are privacy laws and regulations that apply to that activity, and the specific requirements of any applicable privacy laws and regulations.

6sense flows down requests for deletion, erasure, and opt-out to its customers. We require customers to check the opt-out list at least once a month. However, there are practical steps that your organization can take to simplify Contact Data and opt-out compliance.

Under the GDPR, a legal basis is required in connection with processing personal data. The appropriate legal basis is determined by factors like the circumstances of collection, whether consent was obtained, and the purpose of processing. The most common legal bases used in connection with storing business contacts tend to be legitimate interest, consent, or performance of a contract.  

Even if all privacy requirements are met for storing a contact, there may be additional requirements that apply when deciding whether a contact can be added to an email marketing campaign.

Practical note: A contact may be lawfully stored in a CRM, MAP, SEP, or similar system, but that does not automatically mean the contact may receive a marketing email. Email eligibility should be assessed separately based on applicable ePrivacy, PECR, CAN-SPAM, CASL, and local marketing rules.

Whether using contacts acquired from 6sense or from another provider, we suggest reviewing 6sense’s acquired contacts best practices and automating your compliance screening where appropriate.

Operationalizing Suppression and Opt-Outs

• Assign an owner for reviewing 6sense opt-out, deletion, and suppression notices.
• Sync suppression and deletion lists at least monthly, and more frequently where campaign volume, risk tolerance, or local law requires it.
• Apply suppression rules across CRM, MAP, SEP, advertising platforms, enrichment providers, and data exports.
• Avoid re-uploading or reactivating contacts who have opted out or requested deletion.
• Periodically test that opt-out and suppression logic works as intended before launching campaigns or audience activations.

C. Email Marketing Campaigns

There are a variety of compliance frameworks that may apply when setting up an email campaign. In the United States, CAN-SPAM typically applies. In the EU, the GDPR and the ePrivacy Directive may have an impact (see more below).

Generally, it’s a good idea to double-check with your compliance team about which compliance frameworks may apply to your company. Some 6sense customers take a more restrictive approach and require opt-in consent for all email campaigns conducted in the EU. This is easier to implement, but it reduces the number of contacts that can be included in a campaign. Other customers set up automated compliance checks to determine the country in which a contact is located, and for those customers, whether a contact may receive a marketing email will depend on the contact’s country and whether the contact has explicitly opted in.

D. Using Artificial Intelligence

1. Using Artificial Intelligence

B2B sellers and marketers may use AI tools to support ordinary sales and marketing activities—such as drafting outreach, summarizing account research, prioritizing accounts, generating campaign ideas, improving email readability, or supporting segmentation and personalization—but AI should be used as an assistive tool, not as a substitute for legal, compliance, or human review.

Before using AI with prospect or customer information, confirm that the tool is approved for the intended use, avoid entering sensitive or unnecessary personal data, and review AI-generated output for accuracy, fairness, substantiation, brand consistency, and compliance with privacy commitments.

Teams should always confirm that any personal data use is, where applicable, covered by appropriate privacy notices, a lawful basis or other applicable justification, and any required opt-out, objection, or human-review process.

As a practical risk-tiering approach, internal drafting, copy-editing, summarization, and campaign ideation are generally lower risk when humans review outputs before use. Direct AI interaction with individuals, synthetic media, fully automated decisions, sensitive data, regulated industries, or externally facing claims generated without review should receive heightened legal and compliance review.

Legal teams should distinguish between message-level AI disclosure and privacy notice transparency. Message-level disclosure means telling a recipient that they are interacting with AI or that content was AI-generated. Privacy notice transparency means explaining that personal data may be used for analytics, segmentation, scoring, recommendations, personalization, marketing, advertising, or AI-assisted features.

For many sales and marketing use cases, privacy notice transparency and honoring opt-outs may be more important than labeling every AI-assisted email.

More information about AI available through 6sense Services may be found in the 6sense Trust Center and applicable product documentation.

2. Disclosure

As a practical rule, disclose AI use (1) when a reasonable recipient would care that AI was involved, (2) when the AI is interacting directly with the person, (3) when the content could be mistaken for a real person or human-created communication, (4) when synthetic media or personas are used, or (5) when applicable law, or internal policy requires it.

In the EU, the AI Act’s transparency obligations generally require people to be informed when they are interacting with an AI system and require certain AI-generated or manipulated content—such as deepfakes or AI-generated public-interest text—to be identified as AI-generated.

In the UK, the ICO’s AI and data protection guidance emphasizes transparency about how personal data is processed in AI systems, including explaining purposes, retention, and sharing in privacy information.

In the US, there is not yet a single federal AI disclosure law for all B2B marketing, but FTC principles prohibit deceptive or misleading practices; disclosure is especially important where AI-generated personas, synthetic endorsements, altered media, or AI-created claims could mislead recipients.

For routine internal drafting support—such as using AI to polish wording, summarize non-sensitive account notes, or brainstorm campaign copy—standalone AI disclosure is generally less likely to be necessary if the final communication is accurate, non-deceptive, consistent with privacy notices, and reviewed by a human.

E. Common 6sense Scenarios

• Uploading a target account list and enriching contacts: confirm required paperwork is complete, privacy notice coverage is adequate, suppression lists are applied, and contacts are evaluated for outreach eligibility before campaign launch.
• Activating a segment in Google Ads or The Trade Desk: assess whether the use may involve sale/share or targeted advertising, confirm opt-out mechanisms and preference signals, and suppress excluded users before activation.
• Using AI to draft outbound emails: use approved tools, avoid sensitive data, verify claims, apply human review (where appropriate), honor suppression and regional marketing rules, and disclose AI use when the omission would be misleading or where disclosure is legally required.

If you have any additional questions or concerns, please feel free to reach out and contact the 6sense Privacy Team at [email protected].

VI. Legislative Overview

A. Europe’s General Data Protection Regulation (GDPR) and the ePrivacy Directive

The General Data Protection Regulation (“GDPR”) covers principles and rights related to personal data for many countries in Europe and the UK. Switzerland, Liechtenstein, Norway, and Iceland, all also follow the GDPR or laws similar to the GDPR.

Additionally, there are many country-specific laws on direct marketing because of the 2002 ePrivacy Directive, which requires member states to have laws in place. These laws  cover the following channels: email, text, live telephone calls, automated calls and fax. They also cover the use of cookies.

1. GDPR

a. Personal Data

Personal data is any information that relates to an individual, directly or indirectly. For example, a name identifies someone directly, and a national identity number can be used to identify someone indirectly. When determining whether or not information is personal data, there is no distinction made between whether the information is publicly available or not. (However, there can be exceptions to some GDPR requirements when an individual makes their personal data public.)

6sense often receives questions about sensitive personal data. Please note that 6sense does not collect or retain any sensitive personal data as part of its provision of services to customers.

b. Processing Data Under the GDPR: Fairness, Transparency, and Lawfulness

The three most important considerations when complying with the GDPR are: (1) fairness, (2) lawfulness, and (3) transparency.

Within the context of the GDPR, fairness means handling personal data in a reasonable and proportional way. When dealing with fairness and B2B marketing, consider (1) the types of data you will collect and process, and (2) how intrusive this may be perceived by others.

A company should consider what a person’s reasonable expectations about how their personal data will be used to determine whether the processing can be considered fair. This consideration should look at both the types—or “categories”—of personal data being collected as well as whether the proposed use case for the personal data aligns with a reasonable or common use case.

The GDPR also mandates that the processing of personal data must be lawful. This means that the processing must be based on one of the legal bases (justifications) allowed by the GDPR. Article 6 of the GDPR outlines the allowed legal bases, which include consent, contractual necessity, and legitimate interest.

Transparency under the GDPR means ensuring that an individual can easily access and understand the information that you provide about how you handle their personal data. This also means that you should be concise and use clear and plain language. If you’re interested in reading more, the requirements for transparency and privacy are set out in GDPR articles 13 and 14.

Generally, B2B emails should include an unsubscribe link and clear identification of the sender.

c. Legal Bases: Consent and Legitimate Interest

This section covers the two most common legal bases associated with processing personal data in a B2B context:  (1) legitimate interest and (2) consent. You should work closely with your compliance team to determine whether and when each legal basis is appropriate. Whether a proposed legal basis is appropriate can depend on factors like the individual’s location, how you plan to use the personal data, and your organization’s risk tolerance.

i. Legitimate Interest

Recital 47 of GDPR states that “the processing of personal data for direct marketing purposes may be regarded as carried out for legitimate interest.”

There are three basic requirements for legitimate interest:

• Identify a legitimate interest;
• Show that the processing is necessary to achieve it; and
• Balance the legitimate interest and proposed processing against the individual’s interests, rights and freedoms.

When relying on legitimate interest, it will be helpful to record your decision and analysis.

ii. Consent

Under the GDPR, consent must be freely given, specific and informed. This means that you must be clear that the consent covers B2B marketing, and you cannot require consent to marketing as part of receiving access to a service because this unfairly presents a false choice. You must also be careful not to bundle the consent with different, unrelated processing, where the individual would expect to consent separately to each use case.

Consent also means providing control and allowing withdrawal of consent. The principle is that it should be as easy to withdraw consent as it is to provide it. For email marketing this means an opt-out link should be provided in emails.

While withdrawal of consent should be as easy as providing it, the ePrivacy Directive does not require deletion of existing cookie data. A website visitor can clear their browser of cookies at any time. There would be myriad issues with deleting cookie data, including but not limited to security concerns if third parties had the ability to change or remove data on the issuing domain, and the intrusion on the website visitor by a third party’s removal of data on their browser.

d. Data Transfers

If you plan on transferring personal data outside of the EU, then you will need to review the GDPR’s rules around data transfers. For information on countries that the EU has determined offers an adequate level of data protection, please review the European Commission’s adequacy decisions.

6sense is a member of the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

e. Data Subject Rights Under the GDPR

Individuals are empowered and have certain rights under the GDPR when it comes to their personal data. When conducting B2B marketing, it will be important to think through what obligations your organization may have.

The most commonly exercised rights include:

• The Right to be Informed – How will you tell individuals about what personal data your organization is collecting and processing?
• The Right of Access – How will your organization provide a copy of all of the personal data that it holds related to the person making the request?
• The Right to Rectification – If an individual requests to correct the personal data that you have on file for them, how will you handle this type of request?
• The Right to be Forgotten – How can individuals request that your organization erase the personal data that it holds on them? How will your organization remove the personal data in response to a request?

2. The ePrivacy Directive

There are many country-specific laws on direct marketing because of the 2002 ePrivacy Directive, which mandates member states to implement such laws. (Note: The upcoming ePrivacy Regulation will eventually replace the ePrivacy Directive.) These laws address various marketing channels, including email, text messages, live telephone calls, automated calls, and faxes. They also regulate the use of cookies.

a. B2B Marketing

Without providing legal advice, generally, unsolicited marketing to natural persons requires opt-in, while marketing to corporate subscribers may be subject to either opt-out or opt-in requirements depending on the jurisdiction and recipient type.

Some countries may have exceptions to their opt-in requirements for B2B marketing. Please check with your legal counsel or compliance team to make further determinations.

The country classifications above are simplified and may change. Requirements can depend on recipient type, prior relationship, channel, message content, consent history, and local regulator guidance. For the UK, organizations should separately consider PECR requirements in addition to UK GDPR transparency and lawful-basis obligations.

b. Cookie Banner Configuration

Whether or not a cookie banner is required by law, most companies provide some form of notice to website visitors about the information collected on the website. While 6sense does not provide legal advice to our customers on EU or GDPR compliance, we typically find that 6sense customers follow the EU ePrivacy Directive with respect to required opt-outs or opt-ins. A best practice is to inform individuals in your privacy notice and privacy policy of the intended use of the visitor’s web data (for example, analytics and marketing purposes) and that these activities may be performed by third-party vendors on behalf of your organization.

The European Data Protection Board (EDPB), and other applicable supervisory authorities may be helpful resources in understanding compliance obligations under the ePrivacy Directive. For obligations in the UK, the UK ICO makes PECR guidance available on its website.

For existing 6sense customers interested in learning more about installing and configuring the 6sense webtag as they continue to analyze their GDPR and ePrivacy Directive compliance, please visit the Knowledge Base article on setting up 6sense WebTag 2.0.

c. Helpful Resources

• Guidance on EU GDPR from the European Data Protection Board
• Guidance on EU GDPR from the European Commission
• Guidance on UK GDPR from the Information Commissioner’s Office (UK)

d. Specific Guidance on B2B Marketing Compliance From Regulators

• B2B guidance from the Information Commissioner’s Office (UK)
• Direct marketing guidance from the ICO (UK)
• Direct Marketing guidance from Belgian DPA
• Guidance on commercial prospecting from the CNIL In French.
• Direct Marketing guidance from the German Data Protection Conference (group of German Data Protection Authorities) In German.

B. California Consumer Privacy Act (CCPA)

The CCPA is California’s privacy law, which was updated through the CPRA. Businesses that collect personal information about consumers residing in California may be subject to the CCPA.

1. Personal Information Under the CCPA

The GDPR and CCPA have similar definitions for personal data and personal information. Personal Information under the CCPA is any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly. Examples of personal data could include name, email address, IP address, etc.

2. Consumer Rights Under the CCPA

Like the GDPR, the CCPA provides individuals with rights over their personal information, including:

• The Right to Know:
  • how does the business collect, use, and share their personal information, including on request:
  • individualized privacy notice disclosures from the business; and
  • the specific pieces of their personal information the business holds.
• The Right to Delete Personal Information

• The Right to Opt-Out of the Selling and Sharing of Personal information

3. Sell/Share Under the CCPA

Under the CCPA, additional requirements apply to selling or sharing personal information. Selling personal information involves transferring or communicating personal information to another entity in exchange for money  or something of value.  The concept of sharing personal information was introduced in the CPRA.

Personal information is shared when it is passed to a third party for “cross-context behavioral advertising.” This type of advertising generally consists of targeting an individual based on personal information about that person that is (1) collected from a website/application/service with which the individual intentionally interacts, and (2) then passed to a different website/application/service to show that individual an advertisement.

The CCPA gives consumers the right to opt out of selling or sharing their personal information. Organizations that sell or share personal information generally must provide a clear and conspicuous method for exercising that right, such as a “Do Not Sell or Share My Personal Information” link or other legally permitted mechanism. Organizations should also evaluate whether they must honor opt-out preference signals, such as Global Privacy Control, and ensure opt-out decisions are respected for the required period.

There are currently two features in 6sense Services that may be considered a sell/share under the CCPA: (1) 6sense Segments for Google Ads, and (2) 6sense Segments for The Trade Desk. More information about how these features work is available in the links provided.  

For these features, customers should distinguish between 6sense acting as a service provider or processor for core platform services and the customer’s separate decision to activate audience segments with third-party advertising platforms:

• Before activation, determine whether the audience use is cross-context behavioral advertising or targeted advertising.
• Confirm privacy notice disclosures and “Do Not Sell or Share” mechanisms are accurate.
• Suppress users who have opted out, including where opt-out preference signals must be honored.
• Confirm downstream platform terms and restrictions for uploaded or activated audiences.

The California Attorney General and California Privacy Protection Agency provide additional CCPA guidance, including consumer rights and opt-out expectations, on the California CCPA guidance page.

C. Other Jurisdictions

The International Association of Privacy Professionals (IAPP) continues to monitor data privacy regulations around the world through its Global Privacy Directory.

D. Other Jurisdictions in the United States (as of 05/2026)

The IAPP maintains an up-to-date U.S. state privacy legislation tracker.