Website Visitor Identification: Turning Anonymous Traffic Into Named Accounts
Most B2B site visitors never fill in a form. Company-level and person-level identification recover some as named accounts, with very different legal exposure.
Website visitor identification resolves anonymous traffic into named companies through reverse IP lookup, or into named people through identity-graph matching. Company-level works globally at 20 to 50 percent match rates; person-level is effectively US-only at 15 to 45 percent and carries significant GDPR and state privacy exposure. Value depends on same-week routing.
Key takeaways
- Company-level identification uses reverse IP lookup and works globally at roughly 20 to 50 percent match rates; person-level uses an identity co-op and is effectively US-only.
- Plan for 15 to 20 percent person-level resolution on your own US traffic until a trial proves otherwise, because vendor headline rates are measured across their whole customer base.
- Person-level de-anonymisation without consent is very difficult to justify under GDPR and ePrivacy, which is why the leading person-level tools are US-first by design.
- The active US risk in 2026 is state wiretapping and session-tracking litigation, including California Invasion of Privacy Act claims, rather than federal privacy enforcement.
- Pricing spans a genuine free Leadfeeder tier and RB2B from $79 per month up to Vector at $399 to $999 per month.
- Clearbit Reveal was retired after the HubSpot acquisition, and its successor Breeze Intelligence requires a paid HubSpot subscription.
Reviewed and updated August 10, 2026
Website Visitor Identification: Turning Anonymous Traffic Into Named Accounts
Somewhere between 95 and 98 percent of B2B website visitors never fill in a form. Visitor identification software exists to recover some of that traffic as named companies or named people. It works, partially, and the partial is the whole story: match rates, jurisdiction, and what you do in the next 24 hours determine whether this is a pipeline source or an expensive Slack channel nobody reads.
Company-level versus person-level
These are two different products sold under one category name, and the gap between them is legal as much as technical.
| Company-level | Person-level | |
|---|---|---|
| Output | Account name, domain, firmographics | Named individual, LinkedIn profile, sometimes business email |
| Mechanism | Reverse IP lookup against an IP-to-company graph | Identity graph matching against a data co-op |
| Geographic coverage | Global | Effectively US-only in practice |
| Typical match rate | 20 to 50 percent of B2B traffic | 15 to 45 percent of US traffic |
| Regulatory exposure | Lower, still not zero | High outside the US |
| Typical monthly cost | Free tier to a few hundred dollars | $79 to several hundred dollars |
Company-level identification tells you Acme Corp visited your pricing page. Person-level tells you a named director at Acme did. The second is dramatically more actionable and dramatically more regulated.
How it actually works
Company-level resolves the visitor's IP address against a commercial IP-to-organisation database. It works because corporate networks announce ranges that map to registered organisations. It degrades badly with remote work, mobile traffic, consumer ISPs, and VPNs, which is why match rates on a consumer-heavy or heavily remote audience can sit far below the vendor's headline number.
Person-level relies on an identity graph. A network of participating sites captures a hashed identifier when a user is logged in or submits a form, and that hash is associated with a device or browser signature inside a co-op. When that same signature appears on your site, the provider resolves it back to a person. Coverage is a direct function of how much of the co-op your visitor has previously touched, which is why US B2B traffic resolves and traffic from most other markets does not.
Two consequences worth internalising. A vendor's advertised match rate is measured on their whole customer base, not your traffic mix, so treat 15 to 20 percent on your own site as the realistic planning number until a trial proves otherwise. And person-level identification is probabilistic: a shared device or a stale graph entry produces a confident, wrong name.
Legality: US versus EU
Nothing here is legal advice, and this is an area where you should involve counsel before deploying anything person-level.
In the EU and UK, an IP address is personal data under GDPR, and the ePrivacy Directive governs access to information stored on a device. Company-level identification is commonly run under legitimate interest with a documented balancing test, and several vendors are built specifically for that posture. Person-level de-anonymisation without prior consent is a different matter entirely: you are identifying a natural person who took no action to identify themselves, which is very difficult to justify under legitimate interest and which most person-level vendors do not attempt to support in Europe. That is why the person-level tools are US-first by design rather than by accident.
In the US, there is no federal equivalent, but the risk has shifted from privacy regulators to plaintiffs' lawyers. The active exposure in 2026 is state wiretapping and session-tracking litigation, most prominently claims brought under the California Invasion of Privacy Act, alongside state comprehensive privacy laws and the Washington My Health My Data Act for anything health-adjacent. Practical mitigations that vendors and counsel commonly recommend: a clear and current privacy policy disclosure, a consent banner configured for your jurisdictions, honouring global privacy control signals, and geographic gating so the person-level pixel does not fire for EU and UK visitors at all.
The 2026 tool landscape
Pricing verified against vendor pages and current buyer guides in August 2026. This category reprices frequently.
| Tool | Resolution | Priced from | Notes |
|---|---|---|---|
| RB2B | Person-level, US traffic | Free tier, paid from $79 per month | Slack and Teams push, credit-based, US-only person-level |
| Vector | Person-level plus ad audience activation | Around $399 per month, scaling to $999 | Strongest when identified contacts feed paid retargeting |
| Warmly | Company and person-level with orchestration | From around EUR99 per month billed annually | Bundles alerts, chat, and sequencing on top of identification |
| Leadfeeder (Dealfront) | Company-level | Genuine free tier, paid from around $99 per month | The most defensible option for EU and UK traffic |
| Clearbit Reveal | Company-level | Retired as a standalone product | Folded into HubSpot Breeze Intelligence; requires a paid HubSpot subscription, and non-HubSpot teams cannot buy the successor |
The Clearbit entry deserves emphasis because it still appears on comparison lists as a live option. HubSpot acquired Clearbit and rebranded the enrichment as Breeze Intelligence; the standalone Reveal product and free tools were sunset, and buying it now means buying HubSpot. If you were evaluating it, the practical replacements are in best Clearbit alternatives. For a detailed look at the person-level leader, see our RB2B review and alternatives.
Turning identification into pipeline
The failure mode is universal and it is not the software. A Slack channel fills with company names, everyone admires it for two weeks, and then it becomes noise. Three things prevent that.
Filter before you route. Score every identified visitor against ICP fit before it reaches a human. An identified visitor who is not in your ICP is not a lead, and letting those into the channel is what trains people to ignore it.
Weight by page, not by visit. A pricing page view, a docs page view, and a careers page view are three different events. Route on the first two and suppress the third.
| Signal | Action | Response window |
|---|---|---|
| ICP-fit person views pricing | Direct outreach on the underlying problem | 24 hours |
| Multiple people from one ICP account in a week | Multithread the account across email and LinkedIn | 48 hours |
| Company-level ICP match, no person resolved | Add the account to a targeted sequence, source contacts separately | 5 days |
| Repeat visitor already in an open opportunity | Alert the owning rep, do not sequence | Same day |
| Non-ICP visit | Suppress entirely | None |
Never mention the surveillance. "I saw you visited our pricing page" is the single fastest way to lose the account. Reference the problem the page addresses. The whole point of the signal is timing, not a conversation starter.
Speed is the variable that decides whether this works. Identification data ages out in days, so the play is a short, ready sequence run across both email and LinkedIn at once, not a queue for someone to work on Friday. The sequencing patterns in the outbound sales playbook apply directly.
Where it sits in the signal stack
Visitor identification is first-party intent, and it is the strongest signal most companies are not yet using: the account came to you. Third-party topic data from a co-op is a wider, weaker, and far more expensive net. Instrument your own traffic before you buy a feed, and read the B2B intent data guide for how the two layers combine. Once both are firing, the routing itself is worth automating, along the lines described in 8 GTM agent workflows.
Bottom line
Company-level identification is cheap, global, defensible in the EU, and roughly half as useful. Person-level identification is powerful, US-practical only, and carries litigation risk that needs real legal review. Both are worthless without a filtered routing rule and a same-week response.
If you want the response motion built rather than another dashboard, get a free campaign plan and we will design the sequence that fires when a named account shows up.
Frequently asked questions.
Frequently asked questions- How does website visitor identification work?
- Company-level tools resolve the visitor's IP address against a commercial IP-to-organisation database, which works because corporate networks announce registered ranges. Person-level tools use an identity graph: a co-op of sites captures a hashed identifier when someone logs in or submits a form, associates it with a device signature, and resolves that signature when it appears on your site.
- Is website visitor identification legal under GDPR?
- Company-level identification is commonly run under legitimate interest with a documented balancing test, since an IP address is personal data under GDPR. Person-level de-anonymisation without prior consent is much harder to justify, because you are identifying a natural person who took no action to identify themselves. Take legal advice and geographically gate any person-level pixel.
- What match rate should I expect from visitor identification?
- Vendor headline rates are measured across their entire customer base, not your traffic. Plan for 20 to 50 percent at company level depending on how corporate your traffic is, and 15 to 20 percent person-level on US traffic, with premium tiers reaching 35 to 45 percent. Remote work, mobile traffic and VPNs all reduce company-level matching.
- Should I mention that someone visited our website when I reach out?
- No. Referencing the visit reads as surveillance and converts badly, and person-level resolution is probabilistic, so you will occasionally name the wrong person with confidence. Use the signal purely for timing and write to the problem the page addresses. The account came to you, which is the advantage, and it survives without being announced.
- What is the difference between company-level and person-level visitor identification?
- Company-level returns the organisation and its firmographics, works globally, and carries lower regulatory exposure. Person-level returns a named individual with a LinkedIn profile and sometimes a business email, is far more actionable, and is effectively limited to US traffic because of identity-graph coverage and European consent requirements.
About the author.
Fernando Cao is CEO at RevenueFlow, which builds and operates outbound revenue engines for B2B companies. Previously at Accenture Strategy. Studied at University of Bath.
Fernando Cao · CEO
Connect on LinkedIn →Explore more.
Ready to scale your outreach?
We build GTM engines that book real meetings. See the receipts.
Related articles.
B2B Intent Data: What It Actually Predicts and Which Providers Are Worth Paying For
Intent data predicts that an account is researching a topic more than usual. That is the whole signal. What the providers cost, and why most programs disappoint.
How to Build an ICP That Actually Changes Your Target List (With TAM Math)
Most ICPs never change the target list. Here is the count test, the five inputs, a worked TAM, SAM and SOM example with full arithmetic, and an eight-field worksheet.