What can visitor identification actually do?
Last updated 1 September 2026
TLDR
Website visitor identification resolves anonymous traffic to the organisation it came from, not to a named individual. It works best on business traffic from office networks, typically matching a minority of total sessions, and it carries disclosure obligations. It reveals which companies are researching you; it does not tell you who was at the keyboard.
Key facts
- Identification is company-level. Naming individuals from anonymous traffic is not what these tools do.
- Match rates for business-to-business sites commonly fall in the twenty to forty per cent range.
- Consumer, mobile and residential traffic largely cannot be resolved.
- Use requires a published disclosure and, in some jurisdictions, a lawful basis and honoured opt-outs.
- The output is a research signal, not a qualified lead.
How does it work?
The visitor's network address is matched against databases mapping address ranges to organisations, then enriched with firmographic data such as industry, size and location. The result is 'a mid-sized accounting firm in Leeds visited your pricing page three times this week'.
No cookie is needed for the resolution itself, though behaviour tracking across the session usually does involve one.
What is a realistic match rate?
For a business-to-business site with office-hours traffic, twenty to forty per cent of sessions is a normal range. For a consumer-facing site it can be under five per cent. Anyone quoting a flat high number without seeing your traffic is guessing.
Ask any vendor to show your actual rate during a trial rather than an industry average.
What are the compliance obligations?
At minimum, publish a clear notice explaining that you identify visiting organisations, what you collect, how long you keep it and how to opt out — and honour opt-outs. Where regional rules require a lawful basis or consent, establish it before switching the tool on.
Keep retention short and purpose-limited. Storing years of browsing histories against company records is difficult to justify and adds risk without adding value.
How should the data be used?
As prioritisation, not as a cold-call list. A company that read your pricing page three times is worth a relevant, well-timed approach; opening with 'I saw you visiting our website' is uncomfortable and usually counterproductive.
Its most valuable use is often analytical: knowing which industries your content pulls in reshapes what you publish next.
Sources
- Helix visitor identification disclosure — The published notice shipped with the product.
Want this checked on your own site?
The free scan shows your technical health and whether assistants mention you.