“See who is on your website” is one of the most effective subject lines in B2B software, because it promises the thing every marketing team wants: the names behind the traffic they are already paying for. It is worth unbundling, because it contains three claims of very different strength.
Claim one: the organisation
A connection arrives from an IP address. That address can be looked up against a registry that maps ranges to organisations. If the range is registered to a company and the visitor is on that company’s network, you have learned something real.
Both conditions have weakened considerably. Home connections resolve to consumer ISPs, mobile to carriers, VPN traffic to an exit node somewhere else entirely, and shared offices map one range to every tenant in the building. The failure is silent — you get a company name, it is just the wrong one — and it is indistinguishable from a correct result at the point of use.
Legally this is workable. In the EU an IP address is personal data, so you need a lawful basis, a notice and a retention limit. Company-level lookup on your own logs is a case most organisations can make on legitimate interest, provided the assessment is written down and the notice actually says it.
The lookup is not the risky part. The database that turns a company into a person is.
Claim two: the individual
Naming the person who visited, without them telling you, requires matching your visit to an identity graph assembled somewhere else — a cross-site profile built from cookies, hashed emails, tracking pixels or purchased lists.
The technical question is not the interesting one. The interesting questions are the ones the graph’s own compliance has to answer:
- What lawful basis covered the original collection of each identifier?
- Was the person told, at collection time, that this was one of the purposes?
- How does a person exercise erasure across every downstream buyer, including you?
- What happens to records already matched into your CRM when the source is deleted?
- Can the vendor produce the assessment, or only a reassurance?
A vendor who answers the first and goes quiet on the third has not solved the problem. They have transferred it — the notice on your site is the one the person will read, and your controller obligations are the ones that will be examined.
Claim three: intent
The third claim is quietest and does the most work: that the visit means something. Someone from a company read your pricing page, therefore they are evaluating.
Perhaps. It is equally consistent with a competitor, a candidate preparing for an interview, an analyst, an existing customer checking their own plan, or a person who clicked a link from a newsletter and left. None of those are exotic, and nothing in the record distinguishes them.
| Claim | Technically possible? | Defensible in the EU? |
|---|---|---|
| Organisation associated with the connection | Often, with a real error rate | Yes, with an assessment, a notice and retention limits. |
| The individual, from a purchased identity graph | Sometimes | Hard. The basis sits upstream and you inherit the exposure. |
| The individual, because they told you | Always | Yes. This is the clean path and the only one that scales without risk. |
| Buying intent from a page view | Not a technical question | Not a legal question either — it is an unsupported inference. |
The version that holds up
Company-level signals from your own logs, under your own notice, with a retention limit you enforce. First-party behaviour recorded on your own domain. Identity when — and only when — the person hands it over, knowing what it is for.
This returns less. It returns a smaller number of visits you can say something about, and it will not populate a dashboard with names. What it does is survive the question “where did you get this?”, which is asked at the worst possible moment: by a prospect, on a call, about themselves.
It is why Memory scores a returning visitor rather than claiming to have verified them, and why Analytics stores nothing on the device by default. The full rules, including what we refuse to do, are on the evidence standard page. The related argument about third-party behavioural data is in why most intent data is noise.