Skip to content
Antiqore

Visitor identification: what is legal, what is possible, what is neither

The pitch is that you can learn who visited your site without them telling you. Three separate claims are bundled in that sentence, and they have very different answers.

Antiqore5 min read

“See who is on your website” is one of the most effective subject lines in B2B software, because it promises the thing every marketing team wants: the names behind the traffic they are already paying for. It is worth unbundling, because it contains three claims of very different strength.

Claim one: the organisation

A connection arrives from an IP address. That address can be looked up against a registry that maps ranges to organisations. If the range is registered to a company and the visitor is on that company’s network, you have learned something real.

Both conditions have weakened considerably. Home connections resolve to consumer ISPs, mobile to carriers, VPN traffic to an exit node somewhere else entirely, and shared offices map one range to every tenant in the building. The failure is silent — you get a company name, it is just the wrong one — and it is indistinguishable from a correct result at the point of use.

Legally this is workable. In the EU an IP address is personal data, so you need a lawful basis, a notice and a retention limit. Company-level lookup on your own logs is a case most organisations can make on legitimate interest, provided the assessment is written down and the notice actually says it.

The lookup is not the risky part. The database that turns a company into a person is.

Claim two: the individual

Naming the person who visited, without them telling you, requires matching your visit to an identity graph assembled somewhere else — a cross-site profile built from cookies, hashed emails, tracking pixels or purchased lists.

The technical question is not the interesting one. The interesting questions are the ones the graph’s own compliance has to answer:

  • What lawful basis covered the original collection of each identifier?
  • Was the person told, at collection time, that this was one of the purposes?
  • How does a person exercise erasure across every downstream buyer, including you?
  • What happens to records already matched into your CRM when the source is deleted?
  • Can the vendor produce the assessment, or only a reassurance?

A vendor who answers the first and goes quiet on the third has not solved the problem. They have transferred it — the notice on your site is the one the person will read, and your controller obligations are the ones that will be examined.

Claim three: intent

The third claim is quietest and does the most work: that the visit means something. Someone from a company read your pricing page, therefore they are evaluating.

Perhaps. It is equally consistent with a competitor, a candidate preparing for an interview, an analyst, an existing customer checking their own plan, or a person who clicked a link from a newsletter and left. None of those are exotic, and nothing in the record distinguishes them.

ClaimTechnically possible?Defensible in the EU?
Organisation associated with the connectionOften, with a real error rateYes, with an assessment, a notice and retention limits.
The individual, from a purchased identity graphSometimesHard. The basis sits upstream and you inherit the exposure.
The individual, because they told youAlwaysYes. This is the clean path and the only one that scales without risk.
Buying intent from a page viewNot a technical questionNot a legal question either — it is an unsupported inference.
The three claims are usually sold as one product. They are three products with three different risk profiles.

The version that holds up

Company-level signals from your own logs, under your own notice, with a retention limit you enforce. First-party behaviour recorded on your own domain. Identity when — and only when — the person hands it over, knowing what it is for.

This returns less. It returns a smaller number of visits you can say something about, and it will not populate a dashboard with names. What it does is survive the question “where did you get this?”, which is asked at the worst possible moment: by a prospect, on a call, about themselves.

It is why Memory scores a returning visitor rather than claiming to have verified them, and why Analytics stores nothing on the device by default. The full rules, including what we refuse to do, are on the evidence standard page. The related argument about third-party behavioural data is in why most intent data is noise.

Frequently asked questions

Can you identify anonymous website visitors?
You can sometimes identify the organisation a connection is associated with. Identifying the individual person without them telling you is a different claim, and where it is done it usually depends on a data source whose own lawful basis is the part nobody can produce.
Is IP-to-company lookup legal in the EU?
An IP address is personal data under GDPR, so processing it needs a lawful basis, a notice, and a retention limit. Company-level lookup can be run on a legitimate interest assessment. Resolving to a named individual is a much harder case to make and needs to be argued, not assumed.
What about vendors who return a person's name and email from a visit?
Ask where the underlying identity graph came from, what lawful basis covered its collection, and how a person exercises their right to erasure across it. A vendor who cannot answer all three has not solved the problem — they have moved it onto your risk register.
Does a cookie banner cover visitor identification?
Not by itself. Consent to storing a cookie is not consent to being identified and contacted. Those are separate purposes and need to be presented separately if you are relying on consent for either.
What is the defensible version of this?
Company-level signals from your own logs, first-party behaviour under a clear notice, and identity only when the person gives it to you. It returns less, and everything it returns can be explained to the person it concerns.