Is RB2B legal? CCPA, GDPR and what your privacy policy must say

Is RB2B legal: what RB2B itself says

Whether RB2B is legal on your site is a question for your counsel, because RB2B's help center says compliance responsibility rests entirely with you as the website administrator. This page is not legal advice.

RB2B's terms say you agree to put its sample privacy wording, or comparable wording your legal counsel approves, on your website. They add that you are solely responsible for your use of the output data and that RB2B has not given notices or obtained consents for you.

What your privacy policy and cookie banner need

An agency founder adding RB2B to a client's site has three edits to settle with counsel: the privacy policy, the cookie banner and an opt-out link.

RB2B publishes its sample privacy-policy sentence in more than one version, so copy the current one from its Updating Your Privacy Policy article and have counsel review it. RB2B's FAQ recommends an opt-out link to app.retention.com/optout, and its Compliance FAQs say to include one for California residents and that the script cannot skip regions.

RB2B's articles disagree on whether its script may run before consent: one says no consent is needed, only cookie disclosure; others say no cookies before consent; the cookie article says to classify them as essential; the GDPR article says session cookies are set first.

With CookieYes, RB2B's article says the script waits until the visitor accepts. Set the cookie banner and privacy wording before the 7-day trial starts counting on live visitors.

California: the CCPA tests and the data broker registry

The California Attorney General's CCPA page (updated August 28, 2026) lists the rights to know, to delete and to opt out of sale or sharing, including through a global privacy control signal. It says a business must give notice at or before it collects personal information.

RB2B's compliance page says many companies under 25 million dollars in revenue are not subject to most CCPA requirements, but the Attorney General lists three tests and only one is revenue. The other two are the personal information of 100,000 or more California residents or households, and 50% or more of revenue from selling it. The California Privacy Protection Agency adjusts the revenue figure for inflation every other year, and its FAQ gives a higher amount, effective January 1, 2025.

Business contacts are covered too: the Attorney General says the business-to-business exemption expired on December 31, 2022. California lists RB2B's company in its data broker registry; see is RB2B legit.

GDPR and visitors outside the US

RB2B's FAQ says its person-level database holds only profiles matched to US home addresses, and that IP ringfencing resolves only US traffic. For a non-US visitor, its Compliance and Data Governance FAQs say RB2B skips person-level matching but still tries a company-level match.

RB2B's comparison pages say it tracks only US visitors, but its help center says company-level matching of visitors anywhere is on by default and needs consent tools. RB2B's GDPR page says you must use a consent management solution for that matching.

For company-level identification only, pick Leadfeeder (by Dealfront), which says individual visitors are not shown by default, or Snitcher, which says its IP-based identification is company-level. See how RB2B works and is website visitor identification legal in the USA.