Website visitor identification definition

Two different techniques are sold under one name, and most of the confusion about accuracy and legality comes from mixing them up. This page separates them, explains why identification rates vary so much, sets out what the primary EU, UK and California texts say, and covers the step that comes after: turning an identified company into a conversation with the right person.

What is website visitor identification?

Most B2B website visitors never fill in a form. Visitor identification tries to recover something about them anyway: at minimum the company they work for, sometimes the individual. A script on the site records each visit, the tool looks up who the visit came from, and the result appears as a list of companies, with the pages they viewed, in the tool or the CRM.

The output is a signal, not a lead. A company that read the pricing page three times this week is more interesting than one that did not, but nobody there has asked to be contacted. What a team may do with that signal depends on the technique and on the country.

IP-to-company vs person-level: what is actually identified?

IP-to-company identifies an organisation; person-level identifies an individual. Dealfront, which sells the company-level kind, describes its result as a company record, not a person. Person-level tools combine cookies, device identifiers and IP addresses to match a visitor to a known profile, and RB2B's support documentation describes its product as working mainly on US traffic.

Person-level share: RB2B support documentation, vendor figure without a published sample or period.

How accurate is it, and where does it work?

It works best for visitors on a company's own network and worst for everyone else. IP-to-company matching needs the visitor's IP address to belong to a known organisation. A visitor at the office on the corporate network is easy to match. The same person at home, on a mobile connection or behind a VPN shows up as a consumer internet provider, and the tool either returns nothing or guesses.

• Large companies with their own networks are matched most often. Small companies on shared office internet are matched least.
• Remote and hybrid work lowers match rates, because more visits come from home connections.
• Person-level matching depends on the visitor already being known to the vendor's identity graph, which is why published figures are US-centric.
• Vendor accuracy figures rarely state their denominator: all visits, business visits, or visits the tool attempted to match. Test on your own traffic before you rely on one.

Is it legal under GDPR, ePrivacy and in the US?

The primary texts set conditions rather than give a single answer, and the conditions differ by region. This is a summary of those texts, not legal advice.

• EU, personal data: in Breyer (C-582/14, 2016) the Court of Justice held that a dynamic IP address can be personal data for a website operator that has legal means to identify the person behind it. Processing it then needs a legal basis under GDPR, such as legitimate interest with a balancing test.
• EU, access to the device: the European Data Protection Board's Guidelines 2/2023 (version 2.0, 2024), section 3.3, state that tracking based only on IP addresses can fall under Article 5(3) of the ePrivacy Directive, the rule that generally requires consent.
• United Kingdom: the ICO's guidance on PECR applies regulation 6 to storing or accessing information on a device by any method, and non-essential tracking needs consent first.
• California: according to Mayer Brown's October 2026 summary, SB 690 removes private lawsuits under the state's wiretap law over pen-register claims against website tracking from 2027, applying back to 2025. Other US state privacy laws still apply.

Before deploying a tool, three questions decide most cases: does it set or read anything on the visitor's device, which triggers the consent rules in the EU and UK; does it process IP addresses or identifiers you could link to a person, which brings in GDPR; and is the output a company or a named individual, which changes the balancing test.

What do you do with an identified company?

Treat it as a buying signal and do the rest of the work: find the right people and give them a reason to talk. A company name says that someone there looked; it does not say who, or why.

1. Check the fit. Is the company in your ideal customer profile? Most identified visits are not.
2. Read the pages. Pricing and integration pages say more than a blog visit.
3. Find the right roles. Use contact enrichment to find the people who own the problem the pages describe.
4. Write about the problem, not the visit. "I saw you were looking at the pricing page" tells the recipient they were tracked; a relevant message about their situation does not.
5. Combine it with other buying signals, such as hiring or funding, before deciding the account is worth active outreach.

A different route covers visitors who identify themselves by filling in a form; see Speed to lead.

Frequently asked questions

Can website visitor identification tell you who the person was?

IP-to-company tools identify the organisation, not the person. Person-level tools match cookies and device IDs to profiles, mainly for US traffic, ; the EDPB Guidelines 2/2023 and the ICO's PECR guidance treat that kind of tracking as needing consent in the EU and UK.

Is an IP address personal data under GDPR?

It can be. In Breyer (2016) the Court of Justice held that a dynamic IP address is personal data for a website operator that has legal means to identify the person behind it. Processing it then needs a legal basis.

What should you do after identifying a visiting company?

Check it against your ideal customer profile, look at which pages were viewed, find the relevant people through contact enrichment, and write about their problem rather than the visit.