Most visitors to a B2B website never fill in a form. Website visitor identification tries to tell you who they were anyway. Done well, it points you at companies already reading about what you sell. Done badly, it produces wrong names, creepy emails and privacy problems. This guide explains how it works, what it can and cannot see, the rules around it, and how to use it without putting people off.
01
What website visitor identification is
It is any method that turns an anonymous visit into a known company or person. It is one source of buyer intent: a company reading your pricing page this week is showing interest you can see directly, on your own site. That is different from third-party intent data, which watches research activity across other websites.
Company level
Which company visited
Looks up the network the visit came from. Tells you an organisation, never a person.
Person level
Which person visited
Matches a cookie, a login or a form to a named individual. Far more sensitive, and in Europe it needs consent.
Known visitors
People who told you
Someone who filled in a form or clicked your email is already known. Their later visits can be linked to them, with their consent.
02
How it works, and what each method can see
| Method | How it works | What it cannot see |
|---|---|---|
| Reverse IP lookup | Matches the visitor's IP address to the organisation that owns that network | People on home broadband, mobile data or a VPN, which hides most remote workers |
| Cookie matching | Recognises a browser that was identified elsewhere, on your site or across a data network | Anyone who blocks or clears cookies, or declines consent |
| Form and login matching | Links visits to a person once they fill in a form, log in or click a tracked email | Anyone who has never identified themselves to you |
Company level identification is the most common, and the most limited. It works best for large companies with their own office networks, and worst for small companies and people working from home.
03
How accurate it is
Treat every match as a lead to check, not a fact. The common errors are predictable.
- Shared networks. Co-working spaces, universities and internet providers show up as the visiting "company".
- Remote work. A buyer at home appears as their broadband provider, or not at all.
- Stale records. IP ranges change hands, and old data names the previous owner.
- Bots and staff. Crawlers, monitoring tools and your own team inflate the list unless you filter them out.
- One visit is not interest. A single page view can be a job seeker, a student or a competitor.
04
Privacy and consent
In the EU and the UK, data protection law treats IP addresses and cookie identifiers as personal data in many cases, and the rules on cookies require consent before non-essential tracking runs. That means person level identification of visitors who have not agreed to it is risky there, and company level tools still need a lawful basis and an honest privacy notice.
On our own site, analytics stays off for visitors in Europe until they accept the cookie banner. That is the simplest rule to follow: if you would not be comfortable telling the visitor what you collected, do not collect it. In the US the rules vary by state, and several give people the right to opt out of their data being shared or sold. This is not legal advice; check your setup with someone who knows your markets.
05
Using it in prospecting without being creepy
A visit is a reason to look closer, not a line for your first email. Nobody wants to read "I saw you were on our pricing page yesterday".
- Use visits to choose who to research. A company that read three pages this week moves up your list.
- Find a reason that is about them. Look for a dated event at the company, the kind covered in buying signals, and lead with that.
- Reach the right person. The visitor is often not the buyer. Find the person who owns the problem.
- Keep person level data for people who opted in. Use it for follow up with people who already gave you their details.
- Combine it with other signals. A visit plus a relevant event is worth far more than either alone.
06
Common mistakes
Quoting the visit back to them. It tells the reader they were watched and gives them no reason to reply.
Trusting every match. Shared networks and stale records produce confident wrong names.
Treating one visit as intent to buy. Interest is not a buying decision.
Ignoring consent in Europe. Tracking first and asking later is the wrong order.
Not filtering your own traffic. Staff, partners and bots fill the list with noise.
07
The visitor identification checklist
Before you act on visitor data
- You know whether each match is company level or person level.
- Staff, partners and bots are filtered out.
- Shared networks and providers are removed from the list.
- Your consent banner and privacy notice cover what you collect, by region.
- Person level data is used only for people who agreed to it.
- Every account you contact has a reason that is about them, not the visit.
08
Where to go next
Visitor identification is one kind of signals software. For the others, see buying signals tools.
Visitor data is one signal among many. Read buying signals in B2B sales to see how to tell a real signal from noise, and outbound lead generation, explained for the system it feeds.