Website visitor identification software tells you which companies, and with some tools which people, are behind the anonymous sessions on your site. Most B2B websites convert a small fraction of visitors into form fills, so the appeal is obvious: put names on the rest of the traffic and give sales and marketing something to act on.
Choosing a tool is harder than the vendor pages suggest. Every vendor quotes a match rate, every vendor claims accuracy, and almost none of those numbers are comparable, because they are measured on different traffic, with different definitions of a "match." This guide is about choosing well: the two very different kinds of B2B website visitor identification software, what each means for privacy in the EU, how to run a fair test on your own traffic, and a scorecard you can use with vendors. If you want the mechanics first, read how company-level visitor tracking works.
Our Position: Match Rate Is the Wrong Headline Metric
Most buyers compare website visitor identification tools on one number, the share of visitors a tool can identify. We think that is the wrong number to lead with. A tool that identifies more sessions is not better if the extra matches are ISPs, coworking spaces, cloud hosting providers, bots and companies that will never buy from you.
The number that matters is correct identifications of in-ICP companies, per 1,000 visits, that someone acted on. It is smaller, it is harder to inflate, and it is the only one that connects to pipeline. A tool that resolves fewer sessions but gets your target accounts right, and pushes them into the CRM in a usable shape, beats a tool that fills a dashboard with noise. The rest of this guide is built around measuring that.
Two Kinds of Visitor Identification Software
"Anonymous website visitor identification" covers two different products. Know which one you are buying before you compare anything else.
Company-level identification (reverse IP)
Company-level tools map the visitor's IP address, and sometimes other signals, to an organization. You learn that "someone from a 400-person logistics company in Rotterdam" viewed the pricing page twice this week, but not who. This is the classic approach behind tools such as Leadfeeder, ZoomInfo WebSights, Snitcher and the buyer intent feature in HubSpot's Breeze Intelligence. ZoomInfo's own documentation describes WebSights as doing a reverse IP-address lookup that matches the address to a company. Our glossary entry on reverse IP lookup explains the basic technique.
Company-level data is enough for most B2B use cases: account-based reporting, routing target accounts to the right rep, and personalizing the page by industry or company size. It is also the less privacy-intrusive option, though not privacy-free (see below).
Person-level identification (identity graphs)
Person-level tools try to name the individual: name, job title, LinkedIn profile, sometimes a business email. They rely on identity graphs built from cookies, device IDs and data partnerships rather than on IP alone. RB2B is the best-known example, and it is explicit about the scope: its site states that its person-level identity is a US-only technology with a US-only database, with company-level identification used outside the US.
That restriction is not an accident. Person-level identification of website visitors is a hard fit with European privacy law, which is why most vendors either limit it to US traffic or do not offer it at all.
Platforms that bundle identification
ABM platforms such as 6sense and Demandbase include company identification as one input among many (intent data, advertising, account scoring). If you already run one of them, you probably already have visitor identification, and a separate tool needs to justify itself on accuracy or workflow, not on coverage alone.
Privacy and GDPR: What Changes for EU Traffic
If a meaningful share of your traffic comes from the EU or UK, the privacy question is a selection criterion, not a footnote. Three points to understand before you talk to vendors (this is general information, not legal advice; involve your DPO or counsel):
- IP addresses can be personal data. In the Breyer case (C-582/14), the Court of Justice of the EU held that a dynamic IP address can be personal data for a website operator when the operator has legal means to identify the person with additional information. Company-level tools still process IP addresses, so you need a legal basis, a privacy notice that mentions it, and a data processing agreement with the vendor.
- Company identity is not the same as person identity. Knowing that a company visited is generally a lower-risk use than naming the individual. Many EU-focused vendors build their pitch on that difference: Snitcher, for example, presents itself as built in Europe and GDPR compliant. Treat those claims as the start of due diligence, not the end.
- Person-level data on EU visitors is the red zone. Matching an EU visitor to a named person and then emailing them, without consent or a strong legitimate-interest assessment, is where most of the legal and reputational risk sits. If a tool claims person-level matches for EU traffic, ask exactly how, and on what legal basis.
Also check cookie consent. Some tools only work after the visitor accepts tracking cookies, which can cut identifiable traffic sharply on EU sites. Ask whether identification runs before consent, after consent, or both, and get that answer in writing. Our post on personalization and data privacy compliance covers the broader setup.
How to Run a Fair Match-Rate Test on Your Own Traffic
Vendor-published match rates are measured on someone else's traffic. The only number that predicts your result is the one you measure. Here is the procedure we recommend for a two- or three-vendor bake-off.
- Run tools in parallel, not in sequence. Install every shortlisted script on the same pages over the same 2 to 4 weeks. Testing tool A in March and tool B in April compares two different traffic mixes.
- Fix the denominator. Count unique sessions from your own analytics, after removing known bots, your own office IPs and internal staff. Every tool will count differently, so use one source for the base. Our guide to B2B website visitor tracking covers what to track in that analytics setup.
- Build a ground-truth sample. Collect 50 to 100 sessions where you already know the company: form fills, demo requests, logged-in customers and email clicks with tracked links. These are your answer key.
- Score each tool on the ground-truth sample. For each known session, record whether the tool identified a company, and whether it was the right one. This gives you accuracy, which vendor match rates never show.
- Classify the rest of the matches. For a random sample of 100 identified sessions per tool, label each as in-ICP company, out-of-ICP company, ISP or telecom, hosting or cloud provider, or unclear.
- Compute the metric that matters. Correct in-ICP identifications per 1,000 sessions = sessions × match rate × share in-ICP × accuracy, scaled to 1,000.
- Test the workflow, not just the data. Push matches into your CRM or Slack and ask two reps whether they would act on them. A correct match that arrives without page context or in the wrong field does little.
Worked example (illustrative numbers)
These figures are invented to show the calculation, not benchmarks. Over three weeks a site records 12,000 cleaned sessions. Two tools run in parallel.
| Metric | Tool A | Tool B |
|---|---|---|
| Sessions with any company match | 4,800 (40%) | 3,000 (25%) |
| Share of matches that are real companies in your ICP | 30% | 55% |
| Accuracy on the 80-session ground-truth sample | 70% | 88% |
| Correct in-ICP identifications | 4,800 × 0.30 × 0.70 = 1,008 | 3,000 × 0.55 × 0.88 = 1,452 |
| Per 1,000 sessions | 84 | 121 |
Tool A wins the headline match rate by 15 points and loses on the number that matters by about 30%. That reversal is common in practice, because broad matching tends to pull in network providers and companies outside your market.
Evaluation Scorecard for Visitor Identification Tools
Score each vendor 1 to 5 per row, weight the rows that matter to your team, and keep the questions in your notes so answers can be compared side by side.
| Criterion | Questions to ask the vendor | What a good answer sounds like |
|---|---|---|
| Identification level | Company only, or person-level too? For which countries? | A clear split by region, with person-level restricted where the law requires it |
| Data sources | Where does the IP-to-company data come from? How often is it refreshed? | Named methods and a stated refresh cycle, not "proprietary AI" |
| Remote and hybrid workers | How do you identify visitors on home broadband or mobile networks? | An honest answer that home IPs mostly do not resolve, plus any method they use |
| Noise filtering | Do you exclude ISPs, VPNs, hosting providers and bots by default? | Yes, with the filtered traffic visible rather than silently dropped |
| Privacy | Legal basis, DPA, data location, subprocessors, behavior before cookie consent | Documents shared before you sign, not after |
| CRM and routing | Native CRM sync? Which fields? Can we route by account owner? | Writes to account records and activity timelines, not a separate silo |
| Real-time use | Is the company available during the session for personalization? | A client-side or edge API with low latency |
| Pricing model | Priced on traffic, identified companies, seats or credits? | A model that does not punish you for traffic growth you cannot control |
The real-time row matters more than most buyers expect. If the only output is a daily report, identification is a sales prospecting feed. If the company is known during the session, the same data can change the page the visitor sees, which is where the conversion upside is.
Red Flags When Choosing Visitor Identification Software
- A single match-rate number with no definition. Ask whether it counts sessions or companies, and whether ISPs and bots are included.
- Person-level identification of EU visitors with no clear legal basis. If the vendor cannot explain it, your company carries the risk.
- No accuracy measure. Coverage without accuracy is just a longer list.
- Only a dashboard. Data that never reaches the CRM, routing or the website rarely changes outcomes.
- A trial window too short to collect a ground-truth sample. Two or three weeks of parallel data is the minimum for a fair test on most B2B sites.
What to Do After You Choose
Identification on its own produces a list. The value comes from what you do with it in three places:
- Sales follow-up: alert account owners when a target account hits high-intent pages, and route new accounts by territory. Our guide to aligning sales and marketing with visitor data covers the handoff.
- Scoring: feed page-level behavior into an account scoring model so the alerts are prioritized, not just counted.
- The website itself: use the company's industry, size and account status to change headlines, proof points and CTAs while the visitor is still on the page.
The third use is the one most teams skip. Markettailor's visitor identification is built for it: the company is resolved during the session, so the same match that feeds your CRM can drive a page variant through segmentation rules for industry, company size or target-account lists. For the broader view of how B2B teams are using visitor data, see our State of B2B Personalization 2026 report, and for the account-level research signal that complements visitor identification, our guide to B2B intent data providers. If you want a deeper primer on the whole category, read the B2B visitor identification guide.
Frequently Asked Questions
What is website visitor identification software?
It is software that resolves anonymous website sessions to the company, and with some tools the person, behind them. Company-level tools mostly use reverse IP lookup. Person-level tools use identity graphs built from cookies, device IDs and data partnerships, and are usually limited to US traffic.
How do I choose B2B website visitor identification software?
Decide first whether you need company-level or person-level data, then check privacy fit for your traffic regions. Run two or three tools in parallel on the same pages for 2 to 4 weeks, score accuracy on sessions where you already know the company, and compare correct in-ICP identifications per 1,000 sessions rather than headline match rates.
Is anonymous website visitor identification legal under GDPR?
Company-level identification is widely used in the EU, but IP addresses can be personal data, so you still need a legal basis, a privacy notice and a data processing agreement. Identifying and contacting named individuals from EU traffic carries much more risk. Get advice from your data protection officer or counsel before deploying either.
Why do visitor identification tools miss so many visitors?
Many sessions come from home broadband, mobile networks, VPNs and shared networks, where the IP address does not point to an employer. Small companies often have no dedicated IP range either. A tool that claims to identify almost all B2B traffic is usually counting low-quality matches such as ISPs.
Can visitor identification data personalize the website in real time?
Yes, if the tool resolves the company during the session and exposes it through a client-side or edge API. Then industry, company size or target-account status can change the headline, case studies and CTA before the visitor leaves. Tools that only produce daily reports cannot do this.