Divide your form submissions by your sessions and you will see that the large majority of B2B website visitors leave without identifying themselves. Website visitor identification tries to recover part of that: which organisations are browsing, what they read and how often they come back, without a form fill. In B2B it feeds three jobs: telling sales which accounts are researching, personalizing the site for those accounts, and building account lists for ads.
The technology is simpler than vendors make it sound, and less complete than most buyers expect. This post explains the three identification methods, why match rates vary so much, what data you get, which actions each confidence level supports, the privacy rules that apply, and how to roll it out. For a one-paragraph definition, see the glossary entry on visitor identification. If you are comparing vendors, our guide to choosing website visitor identification software covers the evaluation.
The Three Identification Methods
Every vendor uses some combination of three methods. They differ in what they identify (a company or a person), how confident the match is, and how much legal exposure they carry.
1. Reverse IP lookup (company level)
Every device connected to the internet has an IP address. When someone at Acme Corp visits your website from the office, their browser sends requests from an IP address assigned to Acme Corp's network. Visitor identification tools maintain databases that map IP addresses to company names. The resolution process follows these steps:
- IP capture: your website receives the visitor's IP address with every web request; no special tracking is needed for this part
- Database lookup: the tool looks up which organisation owns or leases that IP block
- Enrichment: once a company is matched, the tool appends firmographic data: industry, employee count, revenue range, headquarters location, technographics
- Session stitching: page views from the same company within a time window are grouped into a single company visit
The IP-to-company databases are built from regional internet registry records (ARIN, RIPE NCC, APNIC and others), reverse DNS, BGP routing data, observed traffic and commercial data partnerships. The quality of this database is the biggest differentiator between vendors. The reverse IP lookup glossary entry covers the mechanics.
What it cannot do: tell you who the person is, or identify anyone on a network that is not registered to their employer. When an employee works from home, their traffic comes from a residential ISP like Comcast, AT&T or Deutsche Telekom, and the tool sees the ISP, not the employer. Remote and hybrid work have made this ceiling lower. Some tools try to work around it with cookie-based matching, device fingerprinting or first-party data correlation, but pure IP resolution has a hard limit.
2. First-party identification (person level, known contacts)
When someone fills in a form, logs in, or clicks a tracked link in your email, you can associate the session (and later sessions on the same browser, if cookies are allowed) with a known contact in your CRM or marketing automation platform. This is the most accurate method by far, because the person told you who they are. Its limit is coverage: it only works for people already in your database.
3. Identity graphs (person level, third party)
Some vendors, mostly focused on US traffic, match a browser to a person by joining cookies or device signals against a third-party identity graph assembled from publisher and data-partner networks. They can return a name and email for a visitor who never filled in a form. Our view: for EU and UK traffic this is very hard to justify, because the visitor has no relationship with you and no reasonable expectation of being named. Treat it as out of scope unless your counsel has signed off on the specific vendor and data flow.
Why Match Rates Vary So Much
There is no reliable industry-wide match rate to plan around. Vendor figures are measured on their own customer base and definitions differ (some count sessions, some count visitors, some exclude ISP traffic before calculating). The share of sessions that resolve to a company depends mostly on your traffic, not the vendor. The factors, roughly in order of impact:
- Where people work. Office networks are often registered to the employer. Home broadband is registered to a consumer ISP, so a remote employee looks like a household. Audiences with a lot of remote or hybrid work resolve less often.
- Company size. Large organisations are more likely to own registered IP ranges and route traffic through them. Small companies often share connections in co-working spaces or use consumer ISPs.
- Mobile traffic. Mobile carriers share IP addresses across very large numbers of subscribers, so mobile sessions rarely resolve to a company.
- VPNs and privacy relays. A corporate VPN can help (traffic exits from the company's range) or hurt (it exits from a cloud provider such as AWS). Consumer privacy services hide the origin entirely: Apple notes that with iCloud Private Relay (Apple Support) enabled, websites see a temporary IP address rather than the user's own.
- Geography. Database coverage differs by region and by vendor. A vendor that is strong on North American enterprises may be weak on Nordic mid-market companies.
- Bot and non-human traffic. Crawlers and monitoring services come from data centres and inflate "identified" counts with hosting companies unless filtered.
The only match rate that matters is the one measured on your own traffic during a trial. Check accuracy as well as coverage: take a sample of matches for accounts you know (customers, open deals, your own office) and see how many are right. A lower match rate with correct company names is worth more than a higher one full of misattributions, which send reps after accounts that were never there.
Example: from sessions to usable accounts
Illustrative numbers for a hypothetical B2B site with 10,000 monthly sessions:
| Stage | Count | What removes sessions here |
|---|---|---|
| All sessions | 10,000 | |
| After bot and employee filtering | 8,500 | Crawlers, monitoring, your own staff |
| Resolved to an organisation | 2,500 | Home broadband, mobile, relays |
| Organisation is a real business, not an ISP, university or hosting provider | 1,800 | Low-quality matches |
| Distinct companies | 900 | Repeat sessions from the same company |
| Companies that fit your ICP | 180 | Wrong size, industry or region |
| ICP companies showing buying behavior (pricing, comparison, multiple visitors) | 25 | Casual or one-page visits |
In this example a headline match rate of 25% turns into 25 accounts a month worth a salesperson's attention. Plan your process around that last number. Teams that plan around the top of the funnel flood sales with noise and lose their trust in the first month.
What Data You Actually Get
When a visitor is identified at company level, you typically receive two categories of data.
Visit-Level Data
- Company name and domain
- Pages viewed and time on each page
- Entry page and referral source
- Number of visits over a time period
- Approximate location of the connection (city-level, not street address)
Firmographic Data (Enrichment)
- Industry classification (SIC/NAICS codes)
- Employee count or range
- Annual revenue range
- Headquarters location
- Technographic data (what software the company uses)
- Funding information (for startups)
What you do not get from company-level identification is the individual. It tells you "someone at Salesforce visited your pricing page three times this week", not that it was Jane Smith, VP of Marketing. Individual identification only happens when the visitor identifies themselves through a form fill, login or email click. Make that clear to your sales team early; it shapes both privacy compliance and what reps can reasonably do with an alert.
Match the Action to the Confidence
This is the rule most implementations miss. Different uses of the data tolerate different error rates, so decide which confidence level each action needs before you switch anything on.
| Signal | Confidence | Safe to use for | Not safe for |
|---|---|---|---|
| IP resolves to a company, single page view | Low | Aggregate reporting, industry-level personalization | Sales alerts, named-account copy |
| IP resolves to a company, repeated sessions over several days | Medium | Industry and size personalization, ad audiences, account engagement scores | Naming the account on the page |
| Company match plus CRM target-account flag | Medium-high | Sales alerts with page context, tier-based ABM experiences | Assuming a specific person visited |
| Known contact via form, login or email click | High | Personal follow-up within your stated privacy terms, open-opportunity pages | Anything the person was not told about |
A wrong industry guess costs you a slightly less relevant headline. A sales rep calling a company that never visited, or a homepage greeting the wrong company by name, costs credibility. Scale the visibility of the action to the confidence of the signal.
Privacy Compliance: GDPR and Beyond
This is a practitioner summary, not legal advice. Settle these questions with your privacy lead or counsel before you install anything.
- Is personal data involved? Almost certainly yes. GDPR Recital 30 lists IP addresses among online identifiers, and the EU Court of Justice held in Breyer (CJEU, 2016) that a dynamic IP address can be personal data for a website operator. The output may be a company name, but the input is an IP address from a person's device.
- Which legal basis? Company-level identification is usually argued under legitimate interests, GDPR Article 6(1)(f). That needs a documented legitimate interests assessment: purpose, necessity and a balancing test against the visitor's expectations. The ICO's legitimate interests guidance walks through all three parts.
- Does the tracking itself need consent? Reading or storing information on the device (cookies, local storage, many scripts) falls under Article 5(3) of the ePrivacy Directive, which the EDPB interprets broadly in its Guidelines 2/2023. If your identification tag sets or reads identifiers, assume it sits behind your consent banner unless counsel concludes otherwise.
- Can visitors object? Under GDPR Article 21, people can object to processing based on legitimate interests, and the objection is absolute for direct marketing. You need a working way to honour it.
- US traffic. The CCPA's temporary exemption for business-to-business personal information expired on 1 January 2023, so data about employees of other companies is covered like any other personal information. California's law, as amended, gives consumers rights to know and to opt out of the sale or sharing of personal information, including via Global Privacy Control signals; see the California Attorney General's CCPA page.
Stay on the company side of the line. "A visitor from Deutsche Bank viewed your security page" is treated differently from "Max Mueller from Deutsche Bank viewed your security page". Practical minimums, whichever law applies:
- A privacy notice that names company-level visitor identification and its purpose
- A Data Processing Agreement (DPA) with the vendor
- A documented retention period for identification data
- Person-level enrichment switched off for EU and UK traffic unless specifically cleared
- Sales alerts that describe company activity, not individual browsing
- A way to handle objections and opt-out requests
Combining Visitor Identification with First-Party Data
Identification becomes far more useful when combined with data your visitors provide themselves. (For the events worth recording against each identified company, see our guide to B2B website visitor tracking.) An illustrative progression, using a well-known company name purely as an example:
Stage 1: Anonymous Company Identification
A visitor from Stripe views your homepage, features page and pricing page over two visits in one week. You know it's someone at Stripe. You don't know who. This is enough for account-level personalization: fintech-specific case studies, relevant integrations, pricing page messaging for their company size.
Stage 2: Progressive Enrichment
The same visitor downloads a whitepaper and provides their email address. Now you can match this individual to the company-level history you already have: three earlier visits, which pages they viewed, and the company profile. Your CRM record gets all of this context.
Stage 3: Account-Level Picture
Multiple people from Stripe visit over the following weeks. Some identify themselves through forms, others remain anonymous. Grouping the activity at account level shows buying committee engagement: three people have visited, two have downloaded content, one visited the pricing page four times.
No single source gives you this picture. The identification layer covers the anonymous visits, and every first-party interaction fills in a name.
What to Do With the Data
Most companies start with identification for marketing, but several of the most useful applications sit with sales and customer success.
Sales Digests and Alerts
Send account owners a daily or weekly digest of their target accounts' activity: which pages, how many distinct visitors, how recently. Reserve real-time alerts for the highest-intent pages such as pricing, case studies and comparison pages, where timing matters: an alert that arrives while the account is still researching is useful, one in a weekly digest often is not. Use the data to time and shape outreach, not to announce surveillance; an email that leads with material relevant to what the account read usually lands better than "I noticed your team has been on our website". Our guide to routing website leads by intent covers the alert logic, and the same signals can feed an account scoring model so priority is consistent.
Website Personalization
Use medium-confidence firmographics for industry and size variants, and CRM-matched accounts for ABM experiences. Unidentified visitors see the default. Our post on website personalization covers how to set up the segments and measure them against a holdout.
Account-Based Ads
Export ICP accounts that visited high-intent pages as company lists for account-based ad campaigns, and exclude current customers and open opportunities from prospecting campaigns.
Reporting and Content Validation
Break traffic and conversion reports down by industry and size to see whether campaigns attract the right companies, not just more sessions. The same layer helps content decisions: instead of only knowing that a Kubernetes post got a few thousand views, you can see whether the identified visitors were from ICP companies or from students and hobbyists.
Product-Led Growth
For SaaS companies with self-serve signups, identification shows which accounts researched the product before signing up. If a company visited several times over two weeks and then creates an account, onboarding can start from the features they researched most.
Customer Expansion and Churn Signals
Existing customers browsing pages for products or tiers they don't use is an expansion signal: a mid-tier customer visiting enterprise pricing should reach their account manager. Customer visits to competitor-comparison pages can signal churn risk and belong with customer success, not in a sales queue.
Competitive Intelligence
Identification data also shows when competitors visit your site. Don't overreact, but patterns can be informative: a competitor that suddenly checks your pricing page every week may be preparing a change.
Choosing a Visitor Identification Approach
You have three broad options:
Standalone identification tools (like Leadfeeder or Albacross) focus on identifying companies and showing a dashboard of visitor activity. They're simple to implement but leave you to build the activation layer, whether that means checking dashboards or setting up integrations to push data into your CRM.
ABM platforms with built-in identification (like Demandbase or 6sense) bundle identification with advertising, intent data and account scoring. They are comprehensive and usually need a dedicated owner. Pricing is quote-based: 6sense's pricing page lists packages but no prices (as of October 2026), so ask each vendor for a quote at your traffic and seat count.
Personalization platforms with native identification (like Markettailor) combine identification with the ability to change the website for the companies you identify, which closes the gap between knowing who visited and doing something about it.
The right choice depends on what you plan to do with the data. If you want a list of companies visiting your site, a standalone tool works. If you want to change what those companies see, you need identification and personalization working together. To compare specific vendors with a weighted scorecard and a fair match-rate test, use our guide to website visitor identification software.
A 5-Step Implementation Plan
- Define the actions first (week 1). Write down which actions from the confidence table you will run, who owns each, and what "usable account" means for you (ICP fit plus which behaviors). Without this, you are buying a list.
- Settle the legal basis (weeks 1-2). Complete the legitimate interests assessment, decide what sits behind consent, update the privacy notice and sign the DPA before any tracking code goes live. Doing this after launch means re-engineering the tag.
- Trial on your own traffic (weeks 2-4). Install the script on all pages, not just the homepage, since visitors often enter through blog posts or landing pages. Run one or two vendors in parallel for at least two weeks, verify matches against known sessions, and record your baseline match rate and usable-account count.
- Connect to the CRM and filter hard (weeks 4-5). Sync only companies that pass ICP and behavior filters. Exclude ISPs, hosting providers, universities, existing customers (route those to customer success instead) and your own company.
- Launch one action, measure, then add the next (week 6 onward). Start with weekly account digests for sales, then add high-intent page alerts. Add personalization or ad audiences once sales confirms the accounts look right.
Common Mistakes
- Judging vendors by their quoted match rate. Measure on your traffic and count usable accounts, not matches.
- Alerting sales on every match. Within weeks reps ignore the channel. Start with digests filtered to ICP and buying behavior.
- Treating company data as anonymous. The processing starts from personal data. Document it accordingly.
- Not filtering ISPs, hosting and universities. These inflate counts and pollute segments.
- Naming the company on the page for cold visitors. It feels like surveillance. Use industry framing until there is a relationship.
- Ignoring existing customers. Their visits to pricing or comparison pages are expansion or churn signals; route them to the account manager.
Identification on its own is a list of company names. The value comes from what you connect it to: alerts that reach account owners, CRM records that show web activity, and website experiences that change for the segments you care about. Markettailor's visitor identification passes identified companies straight into segmentation for that last step.
Frequently Asked Questions
How does website visitor identification work?
The most common method is reverse IP lookup: the visitor's IP address is matched to the organisation that owns that network range, then enriched with company data such as industry and size. Person-level identification comes from first-party data, when someone fills in a form, logs in or clicks a tracked email link, or from third-party identity graphs, which carry more legal risk.
What percentage of website visitors can be identified?
There is no reliable universal figure, because it depends on your audience. Sites whose visitors work from offices at larger companies resolve more sessions; sites with remote workers, small businesses, mobile traffic or privacy relay users resolve fewer. Measure it on your own traffic during a vendor trial and track usable ICP accounts rather than raw matches.
Is website visitor identification legal under GDPR?
It can be lawful, but it is regulated. IP addresses can be personal data, so you need a legal basis, usually legitimate interests with a documented assessment, a privacy notice, a DPA with the vendor and a way to honour objections. Scripts that store or read identifiers on the device generally need consent under ePrivacy rules.
Can you identify individual people visiting your website?
Reliably and lawfully, only when they identify themselves: a form fill, a login or a click from your own email. Some vendors claim to name anonymous visitors through identity graphs, mainly for US traffic. For EU and UK visitors this is difficult to justify because the person has no relationship with you and does not expect it.
What is the difference between visitor identification and visitor tracking?
Tracking records what sessions do: pages, events, sources. Identification answers who is behind a session, usually at company level. You need both: tracking supplies the behavior that makes an identified account worth acting on, and identification turns anonymous behavior into account-level signals for sales, personalization and ads.