B2B Retargeting: What It Achieves and What Data Protection Allows

Why are B2B businesses interested in retargeting?

On most websites of businesses that sell to companies, only a small share of visitors inquire. The rest read, compare and leave. Many never come back. Retargeting promises to bring these visitors back: someone who viewed the service page sees ads from the business on other websites or in networks over the following weeks.

This article assesses what to make of that. The guiding question is: What does retargeting achieve in business-to-business markets, and what does data protection law in Germany allow? We first clarify the terms and a model from consumer research that explains when ads are perceived as intrusive. Then we look at findings from field experiments, then at the legal framework. At the end there is a three-step test. This article is not legal advice.

An ad that knows too precisely where you have been does not seem attentive; it seems watchful.

What is retargeting, and which forms exist?

Retargeting (also remarketing) means deliberately showing ads to people who have already been in contact with your offer, usually through a visit to the website. Technically this happens via cookies or pixels: small files or code snippets that are stored in or read from the browser during the visit and make the visitor recognizable later. There is also list-based retargeting, where a business uploads its contacts’ email addresses to an advertising platform so that the platform can recognize those people there.

Two variants should be distinguished. With generic retargeting, the visitor sees an ad for the brand, for example with the business’s value proposition. With dynamic retargeting, the ad shows exactly the product or service they viewed. Distinct from both is contextual advertising: it is targeted not at the person but at the content of the page on which the ad appears, for example an ad for hall heating on a trade portal for building services.

When is an ad perceived as intrusive? The persuasion knowledge model

Friestad and Wright (1994) developed the Persuasion Knowledge Model. It assumes that over their lives people learn how advertising and selling work. When they recognize an attempt to influence them, their response changes. They examine the message more critically, ask about the sender’s intentions and resist if they consider the means inappropriate.

Retargeting makes the persuasion attempt particularly visible. An ad showing exactly the service page someone read two days ago reveals that the visit was observed. According to the model, whether this is experienced as a helpful reminder or as surveillance depends on whether the viewer considers the approach appropriate. In business-to-business markets there is an additional factor: the viewer often evaluates the provider on behalf of their employer and pays closer attention to whether it comes across as reputable.

What do field experiments show about the effect?

The best-known study comes from Lambrecht and Tucker (2013). They analyzed a field experiment by an online travel firm in which visitors were randomly shown either dynamic ads with the offers they had viewed or generic brand ads. The surprising result: on average, dynamic ads were less effective than generic ones. Only when visitors’ behavior showed that their preferences had already matured, for example because they had visited review sites, did the precise ads work better. Those still searching were more likely to be put off by a single offer.

A new study by Bai, Wang and Ren (2025) in the Journal of the Academy of Marketing Science goes a step further. Working with a large insurer in China, the researchers determined from a visitor’s entire sequence of actions which concerns kept them from buying: product fit, price or privacy. In a randomized field experiment, visitors then received either generic messages or messages tailored to their concerns. For customers with product or price concerns, the personalized approach raised the company’s daily economic outcome by about 41 percent. For customers whose privacy concerns dominated, the effect reversed and the outcome fell by about 32 percent.

In a large field experiment with a car manufacturer, Valenti, Miller and Tucker (2025) examined how retargeting and contextual advertising interact. Combining both methods was more effective for website visits, engagement and early signs of purchase intent than either alone. But only if the content of the retargeting ad was adapted accordingly.

All three studies come from consumer business and from large companies. They are instructive for small B2B businesses nonetheless. They refute the assumption that more personalization automatically brings more, and they show that the recipient’s concerns decide the effect. How strongly this applies in business-to-business markets has not been studied.

What does data protection law in Germany allow?

In Germany, two sets of rules interlock for retargeting. The Telecommunications Digital Services Data Protection Act (TDDDG), called TTDSG until May 2024, regulates access to terminal devices in Section 25. Anyone who stores information in a user’s browser or reads it from there needs the user’s consent, unless the access is strictly necessary for the service requested. Retargeting cookies and advertising pixels are not. The General Data Protection Regulation (GDPR) then governs whether the personal data obtained in this way may be processed and passed on to advertising platforms. Here too, in practice, consent is usually the basis for advertising purposes.

Courts have clarified what consent must look like. In 2019 the Court of Justice of the European Union ruled in the Planet49 case (C-673/17) that a pre-ticked box is not valid consent. Germany’s Federal Court of Justice followed in 2020 (I ZR 7/16). Consent must therefore be active, informed and given before the cookie is set. A banner that starts retargeting without consent or makes rejecting harder than accepting is legally vulnerable.

For list-based retargeting there is an additional point: uploading email addresses to an advertising platform transfers personal data to third parties. That requires a sound legal basis, and with platforms outside the EU questions of data transfer come on top. How origin, consent and objection are documented in the CRM is described in the article on data protection in sales.

Technology is also changing the situation. Safari and Firefox have blocked third-party cookies by default for years. In April 2025 Google announced that it would not phase out third-party cookies in Chrome and would not introduce a new prompt about them either. For German law this changes nothing: the consent requirement does not depend on whether the browser technically allows cookies.

What does this mean for the B2B calculation?

The consent requirement and small audiences change the economics. Not every visitor consents, and of the rest only some belong to the target group. The following worked example shows how sharply a month with 2,000 website visitors narrows down.

Two readings suggest themselves. The first says retargeting hardly pays off for small B2B businesses because too few people remain after consent and targeting. The second says that precisely because the number is small, the remaining visitors are particularly valuable, and a single order can cover a year’s costs. I consider the second reading defensible, but only on one condition: the ad has to offer the visitor something new that helps with the decision, such as an expert article, a checklist or a comparison. An ad that only says “you were here” amplifies the effect the persuasion knowledge model describes.

Often the problem is not the missing second contact anyway but the page itself. Visitors who do not inquire frequently found no simple next step. Before money goes into retargeting, it is worth looking at the checklist for a website that brings inquiries and at the article on building a landing page.

The three-barrier test before every campaign

Research and law yield a simple test. I call it the three-barrier test. A campaign starts only if it passes all three barriers.

1. Barrier 1: consent

   Is there valid, provable consent for every person addressed? Is the banner designed so that rejecting is as easy as accepting?

2. Barrier 2: occasion

   Does the ad offer something that helps the visitor with their next decision? Does it fit the stage of the buying process they are in? According to Lambrecht and Tucker (2013), generic, helpful content is the better choice for visitors who are still searching.

3. Barrier 3: measure

   Is it limited how often and how long someone sees the ad? Are customers and applicants excluded who have no reason to see it? Does the campaign end after a set period?

The same applies to measurement as with search ads: count inquiries and orders, not clicks. How to set this up with small budgets is described in the article on search ads with a small budget. How inquiries are assigned to their source is covered in the article on how to measure marketing success.

Conclusion: what does retargeting achieve in B2B, and what is allowed?

We set out to ask
retargeting achieves in business-to-business markets and what data protection law allows. The field experiments show that retargeting can work, but not as simply as promised. Precise, personalized ads help prospects who already know what they want and backfire with people who have privacy concerns. Generic, helpful ads are often the better choice for visitors still orienting themselves. The persuasion knowledge model explains why: people who notice the observation and did not want it push back.

Legally, retargeting via cookies or pixels in Germany generally requires prior, active consent. That further shrinks the already small audiences in B2B. For small businesses, retargeting is therefore a supplement for individual, clearly defined cases, not a cornerstone. If you take the three-barrier test seriously, you lose less reach than you gain in trust.