GDPR does not have a B2B exemption. It has no carve-out for "professional" visitors, no exception for websites that sell to enterprises rather than individuals, and no rule that makes consent optional because your audience is sophisticated. The legal framework is the same regardless of your business model.
What does differ between SaaS/B2B websites and typical consumer sites is the technology stack. B2B SaaS companies tend to use fewer advertising pixels and more product analytics, sales intelligence, and CRM tracking tools. Some of these tools require consent; others can rely on alternative lawful bases. Getting the distinction right lets you run a compliant site without a consent banner that torpedoes your demo request conversion rate.
The B2B Compliance Myth — and Why It Persists
The belief that B2B sites do not need GDPR cookie consent likely originates from a misreading of the ePrivacy Directive's recitals and national implementation differences. In some early national implementations, "subscriber" and "user" were interpreted narrowly. The EDPB has since clarified in its guidelines that Article 5(3) applies to all users of electronic communications services — professional visitors to a SaaS marketing website are users in this sense.
The myth is also reinforced by low enforcement visibility: most GDPR cookie enforcement actions have targeted high-traffic consumer sites, not B2B SaaS companies. This creates a false impression of reduced risk. B2B companies are not immune to enforcement — they are just less frequently targeted, and the trend is shifting as DPAs expand their scope.
What IS Different for B2B Sites
While the legal requirement is the same, the practical implementation differs in three meaningful ways.
The tool mix is different. Consumer sites tend to rely heavily on advertising pixels (Meta, TikTok, Pinterest) that require marketing consent. B2B SaaS sites rely more on:
- Product analytics (Mixpanel, Amplitude, Heap, PostHog) — require consent
- CRM tracking (HubSpot, Marketo, Salesforce Pardot) — require consent
- Sales intelligence (HubSpot Sales, Salesloft, Apollo) — may require consent
- Intent data (Clearbit, ZoomInfo WebSights, Dealfront) — depends on implementation
- Support tools (Intercom, Zendesk) — post-login use may not require consent
The visitor journey has two phases. Consumer sites have one phase: anonymous visitor. SaaS sites have two: (1) anonymous visitor on the marketing site, and (2) authenticated user in the product. These phases have different consent and lawful basis considerations.
Conversion funnel sensitivity is higher. On a consumer site, a poorly implemented consent banner costs you some analytics data. On a B2B SaaS site, it sits directly on the path to a trial signup or demo request — friction here has direct revenue impact. Getting consent implementation right matters more, not less.
Phase 1: Anonymous Visitors on the Marketing Site
For anonymous visitors to your pricing page, homepage, or blog, the rules are identical to any other website. Non-essential cookies require consent before they fire. This includes:
- HubSpot's tracking code (sets
hubspotutkfor lead identification) - Intercom's widget (sets
intercom-id-*for visitor identification) - Any Google Analytics or product analytics event tracking
- LinkedIn Insight Tag (popular for B2B retargeting)
- Google Ads conversion tracking
Implement a consent banner that blocks all non-essential scripts by default. For B2B sites, a well-designed banner can achieve 40–60% opt-in rates with clear copy that explains why the tracking is useful (e.g., "Analytics help us improve our product" rather than generic cookie language).
Phase 2: Authenticated Users in the Product
Once a user completes signup and logs in, the legal picture changes for some — but not all — data processing.
Strictly necessary basis (no consent required):
- Session management cookies (keeping the user logged in)
- CSRF protection tokens
- User preference storage (theme, language, notification settings)
- Load balancing and server routing cookies
- Security and fraud detection identifiers
Legitimate interest (GDPR Article 6(1)(f), not ePrivacy Article 5(3)): For non-cookie data processing in the product — such as logging feature usage events server-side, or performing IP-based company identification without client-side cookies — legitimate interest may apply. Document your legitimate interest assessment: the purpose is product improvement, the data is minimised, and users have a reasonable expectation that a SaaS product monitors its own usage.
Still requires consent:
- Session recording tools (FullStory, Hotjar, LogRocket) — these capture personal data beyond what's strictly necessary
- Marketing automation tracking within the product (e.g., HubSpot events for lifecycle marketing)
- Advertising retargeting pixels in the product (less common but not unheard of)
Product Analytics: Consent vs Privacy-First Options
| Tool | Client-side cookies? | Consent required? | Self-hosted option? |
|---|---|---|---|
| Mixpanel | Yes — distinct_id cookie | Yes | No |
| Amplitude | Yes — amplitude_id cookie | Yes | No |
| Heap | Yes — _hp2_id cookie | Yes | No |
| PostHog (cloud) | Yes — ph_* cookies | Yes | Yes |
| PostHog (self-hosted) | Yes — cookieless mode available | No (cookieless) | Yes |
| Matomo (self-hosted, cookieless) | No (cookieless mode) | No | Yes |
| June.so | No client-side cookies (server-side events) | Depends on implementation | No |
PostHog self-hosted in cookieless mode and Matomo self-hosted configured without cookies are the two strongest options for product analytics without a consent requirement in the authenticated product environment — provided events are sent server-side and no client-side identifiers are set.
CRM and Marketing Automation Tools
HubSpot, Marketo, and Salesforce Pardot are the three most common marketing automation platforms in B2B SaaS. All three use tracking scripts that set persistent cookies for lead identification. All three require marketing consent when loaded on anonymous-visitor marketing pages.
HubSpot is the most commonly misimplemented: the HubSpot tracking code is typically added to the site-wide header, meaning it fires on every page — including the product login page and post-login pages — for all users. For authenticated users using the product, this creates an unnecessary consent requirement where legitimate interest might suffice if the tracking were moved server-side. Splitting tracking implementation between marketing pages (client-side, consent-gated) and product pages (server-side, legitimate interest) is worth the engineering effort.
Consent UX Patterns for SaaS/B2B
Keep the banner minimal. A compact banner at the bottom of the page with "Accept" and "Manage preferences" performs better than a full-screen overlay. For B2B audiences, verbose legal language creates distrust; brief, direct copy converts better.
Use geo-targeting. If your visitor base is global, show the consent banner only to EU/UK visitors. This eliminates consent friction for the majority of your audience while maintaining compliance for EU traffic.
Pre-accept for known accounts. If a user is returning to the product and their previous session cookie is present (indicating a prior login), you already have a contractual relationship — session-necessary cookies need no consent. Keep the marketing tracking separate and gate it on consent, but do not show the consent banner on every authenticated product page load.
Test opt-in rates. A well-designed consent implementation for a B2B SaaS site should achieve 40–70% analytics opt-in. If you are seeing under 30%, your banner copy or design is creating unnecessary friction — optimise it before assuming analytics data loss is unavoidable.
Build a consent banner optimised for SaaS and B2B workflows — with script-level blocking, geo-targeting, and preference memory — using our Cookie Consent Generator.