Albacross

Overview

Albacross is a B2B website intelligence platform that identifies the companies visiting a website by reverse-mapping visitor IP addresses to company records using commercial IP intelligence databases. Its scripts are installed by B2B marketers and sales teams on their websites to surface named account traffic that would otherwise appear as anonymous. Albacross is primarily used in Nordic and European B2B markets and positions itself as a GDPR-compliant lead generation tool — a claim that has attracted scrutiny from European data protection authorities.

What This Script Does

Albacross loads a lightweight tracking pixel from res.albacross.com or a customer-configured first-party relay endpoint. The script performs the following:

• Transmits the visitor's IP address to Albacross servers for company record lookup against Albacross's proprietary firmographic database
• Sets a persistent first-party tracking cookie (typically _abcwuid or similar pattern) with a multi-month expiry to maintain a visitor identifier across sessions
• Records page URL, referrer, UTM parameters, session start time, and pages visited during the session
• Fires these signals to Albacross's API (api.albacross.com) where they are joined with the company record and surfaced in the Albacross dashboard

The resulting data product shows the site operator which named companies visited, which pages they viewed, how many sessions they had, and how they found the site — all without any visitor interaction or form submission. Individual-level identification is not claimed, but in small companies a single employee's visits may be effectively individual-identifiable through company context.

Consent & Compliance

IP address is personal data under GDPR (Article 4(1)) as confirmed by CJEU jurisprudence and multiple European DPA guidance documents. Albacross's processing of IP addresses for company identification constitutes profiling of personal data under Article 4(4).

The Swedish DPA (IMY) investigated Albacross and found that its data processing requires a valid lawful basis. While Albacross argues legitimate interest under Article 6(1)(f), the persistent tracking cookie — which accumulates multi-session behavioral data — requires prior consent under the ePrivacy Directive regardless of the GDPR basis claimed for the underlying processing. The ePrivacy Directive analysis is independent: any storage of or access to information on a user's device for non-essential purposes requires consent.

Under CCPA/CPRA, IP-based tracking and behavioral data collection constitute personal information collection. The processing must be disclosed and opt-out mechanisms provided.

The consent category is analytics with significant marketing use case characteristics — the data directly drives sales outreach decisions.

Should You Block This Without Consent?

Yes. Albacross sets a persistent tracking cookie from first page load. The ePrivacy Directive requires prior consent for this storage regardless of the GDPR lawful basis position. Given the profiling nature of the data collection and its primary use for sales targeting, the script must be held behind a consent gate.