Key takeaways
- An AI visibility tool acts as a data processor under GDPR. The LLM providers it queries (mostly US-based) are its subprocessors, so you need a DPA, a subprocessor list with locations, and a named transfer mechanism.
- EU data residency lowers risk and shortens the conversation with your DPO. It is not a legal requirement on its own. Valid transfer mechanisms and transparency matter more.
- No vendor can avoid sending prompts to US-built assistants entirely, because ChatGPT, Gemini and Claude are the things being measured. Ask which steps leave the EU, not whether anything does.
- Vendors write most of the comparisons you will find, and they are biased. Verify claims against the DPA itself.
- Language coverage, country-language tracking and proof of impact belong on the checklist next to compliance.
Why GDPR applies to an AI search tracking tool
It feels odd at first. You are tracking whether ChatGPT mentions your brand. A domain name and a share-of-voice number are not personal data, so where is the GDPR problem?
The problem is the pipeline. To measure your visibility, the tool sends prompts, your domain, often your competitors, and sometimes your content to third-party LLM providers. It also stores your team's logins and, if you connect analytics or customer data, more than that. That makes the vendor a data processor working on your instructions, with you as the controller. The LLM providers behind it become subprocessors.
Article 28 of the GDPR requires a contract between controller and processor, and says a processor must not engage another processor without the controller's prior written authorisation. In practice that means two documents you should be able to get from any vendor before signing: a data processing agreement (DPA) and a subprocessor list.
Does your brand data count as personal data? Often not. But prompts can contain a named prospect, and pages you feed a tool can contain customer language. The simplest approach is to treat the pipeline as if it could carry personal data. Compliance questions get easier to answer that way.
Controller, processor, subprocessor: who is who
| Role | Who it is | What GDPR expects |
|---|---|---|
| Controller | Your company | Decides what data goes in and why; signs the DPA |
| Processor | The AI visibility tool | Handles data on your instructions; discloses subprocessors |
| Subprocessor | OpenAI, Google, Anthropic and other LLM or cloud providers | Bound by the same obligations down the chain |
The chain matters because the weakest link sets your risk. A tool with an EU database and a clean DPA still routes prompts to a US model provider, and that transfer needs a legal basis.
The US transfer question
Most AI answer engines are US-operated. The EU-US Data Privacy Framework adequacy decision took effect on 10 July 2023, and it is one legal route for transfers to certified US companies. Standard Contractual Clauses (SCCs) are the other common route. Both appear in real vendor documentation.
The honest vendors say this plainly. One European vendor, 3RD, states that its data sits on AWS and Google Cloud in EU regions, while the AI analysis runs through OpenAI, Anthropic and Google, which process data in the USA under safeguards such as SCCs. It also notes that requests are mostly deleted after processing and that some providers keep them up to 30 days for abuse monitoring. You can disagree with the architecture, but at least you can evaluate it. See the 3RD guide to European AI visibility platforms for the full wording.
A vague answer is the red flag here. "We are GDPR compliant" in a footer tells you nothing. "Here is our DPA, here are our subprocessors with locations, here is the transfer mechanism" tells you everything.
What EU data residency does and does not buy you
Data residency means your account data and stored results sit on servers in the EU. It is worth having. It reduces exposure, simplifies the DPO review, and procurement teams like it.
But be careful with the claim. Residency usually describes where the database lives. It rarely describes where every processing step happens. A tool can host in Frankfurt and still send each prompt to a US model. So the right question is not "is it EU-hosted?" but "which processing steps leave the EEA, and under what safeguards?"
You also do not strictly need every server inside the EU. You need valid transfer mechanisms and transparency. Residency is one factor among several.
What vendors actually say
Here is what the vendors' own documentation and third-party comparisons state. I have not verified subprocessor lists, current pricing, or whether the LLM providers are DPF-certified, so confirm each point yourself before relying on it.
| Vendor | Base | Stated data position | Watch for |
|---|---|---|---|
| Peec AI | EU/US entities | DPA says data is hosted in the EU, primarily Germany, on GCP | A third-party comparison reads its privacy policy as Google Ireland hosting with possible US transfers under DPF or SCCs. Read the DPA yourself |
| Otterly.AI | Austria | Pricing page does not state hosting or security documents | Ask for the DPA directly |
| Profound | New York, USA | Pricing page does not state hosting; offers SOC 2, SSO and SAML on Enterprise | Ask where data is stored and which regions are available |
| 3RD | Copenhagen | EU storage, AI analysis via US providers under SCCs | Says most European vendors, itself included, lack SOC 2 |
| WebGlazer | Latvia | EU-resident hosting claimed | Self-published comparison |
| Howseen | France | Customer database in the EU (Frankfurt), AI providers named in privacy policy | Self-published comparison |
A note on sources. 3RD, WebGlazer and Howseen all wrote comparisons of their own market, so treat their rankings as marketing. The factual claims about their own hosting are useful, because you can test them against their DPA.
A practical vendor checklist
Run every vendor, European or American, through the same questions and compare the answers side by side. The gaps tell you more than the demos.
- Send me the DPA and the subprocessor list with locations.
- Where is my data stored, and which processing steps leave the EU?
- What is the transfer mechanism for US providers: DPF, SCCs, or something else?
- How long do you and your LLM providers retain prompts and responses?
- Is my data used to train any models?
- Does the tool process personal data beyond team logins, for example connected analytics or customer data?
- Will I be notified if the subprocessor list changes?
Question 7 is underrated. When a vendor is acquired or switches providers, the DPA and the subprocessor list can change under you. Contractual notification of changes is the protection.
Beyond compliance: what else a European brand should check
A compliant tool that cannot see your market is useless. European buyers ask in French, German, Spanish, Swedish, and AI answers differ by language. The same question in French can name a different set of brands than in English.
- Track each country-language pair separately, not just a language.
- Confirm the engines you need are covered: ChatGPT, Gemini, Perplexity, Google AI Overviews, Copilot.
- Check that prompts reflect how your local buyers actually phrase things, rather than translated English templates.
- Look for proof of impact, such as traffic and conversions from AI platforms, instead of just a score.
Some vendors are explicit about trial limits here. Profound's trial, for example, covers one language and one region, with custom languages and regions on Enterprise. Check this before you assume multi-market coverage.
Where the data flows: a note on query fanouts
It helps to understand what actually travels to those US providers. When an assistant answers a prompt, it often runs several web searches behind the scenes, known as query fanouts. According to Promptwatch's ChatGPT query fanout data, average fanouts per response fell from 2.15 in early December to about 1.84 by early March, and average query length fell from roughly 117 characters to the high 80s by February to March. When fanouts returned in April they averaged 1.0 per response at about 53 characters. The page also quotes a higher range for individual prompts, but the averages are the better guide to typical volume.
The takeaway for a DPO is simple. Every tracked prompt triggers external calls you do not control, so the subprocessor chain is real and active, not theoretical. Promptwatch's own data comes from the real interfaces of ChatGPT, Gemini, Perplexity, Claude and AI Overviews and is published as aggregated, non-identifiable trends.
Where Promptwatch fits
If you are comparing platforms on capability as well as compliance, Promptwatch is worth a look. It tracks real AI interfaces across many countries and languages, adds IP-verified AI crawler logs and visitor analytics, and goes on to content creation and publishing instead of stopping at monitoring. I have not verified its hosting or GDPR position for this guide, so ask for its DPA and subprocessor list like you would from anyone else.
For a wider shortlist, the GEO software directory at bestgeosoftware.com lists many more options to run through the same checklist.
Do you need an EU-only tool?
It depends on the sensitivity of what you feed in.
- Public brand and category prompts, no connected customer data: a vendor with a solid DPA, transparent subprocessors and SCCs or DPF coverage is usually defensible.
- Connected analytics, CRM or customer language: push harder on residency, retention and deletion terms.
- Regulated sectors such as finance and healthcare: expect your DPO or procurement team to prefer EU-hosted options and to ask about SOC 2 or equivalent. Be aware that many European vendors do not yet have SOC 2.
The AI Act also matters if a tool does anything beyond tracking brand mentions. Pure visibility measurement generally sits outside the high-risk categories, but check with your legal team if a vendor adds sentiment or emotion analysis on people.
How to run the evaluation in a week
- Shortlist three to five tools, mixing EU-based and US-based vendors.
- Email each the seven questions above and ask for the DPA and subprocessor list.
- Compare answers in one table. Discard vendors who dodge question 2.
- Test each shortlisted tool on your real markets and languages, with the same 20 prompts.
- Loop in your DPO with the written answers before any contract is signed.
You will usually have a defensible choice by the end of the week. If you want help choosing between tools, 1001 SEO Media works on GEO and AI search measurement for brands and can help with vendor selection.
The short version
GDPR compliance for an AI visibility tool is mostly about paperwork you can verify: a DPA, a subprocessor list with locations, a named transfer mechanism, and clear retention terms. EU hosting helps, but it describes a database, not the whole data path. Ask where each processing step happens, read the documents instead of the badge, and pick the vendor that answers plainly.