How Website Visitor Identification Actually Works

Website visitor identification works in four steps. The tool reads the IP address of a visit, looks up which network that address belongs to, matches the network to a registered organisation, then enriches that organisation with firmographic data such as industry, size and location. Behaviour on the site is scored on top. The output is a company name and what it looked at, not the name of the person browsing.

That last sentence is where most explanations go soft, so it is worth tracing a single visit through the whole chain before getting to the limits.

One Visit, Followed End to End

Someone at a logistics firm in Rotterdam opens your pricing page at 10:14 on a Tuesday. Their browser requests the page, and a small script on your site records the request along with the public IP address it came from, the page, the referrer and the time. No form has been filled in and no cookie consent is needed to see the address, because every web request carries one.

• Network lookup. The IP address is checked against regional internet registry records and routing data to find which network block it sits in and who operates it.
• Organisation match. If the operator is the logistics firm itself, because it runs its own office connection, the block resolves to that firm. If the operator is a broadband provider, the trail usually stops here.
• Enrichment. The matched firm is joined to a company database: sector, headcount band, country, website domain, sometimes revenue band.
• Behavioural scoring. Pages viewed, time on site, return visits and the type of page (pricing and case studies count for more than the blog) are combined into a signal of how interested the company looks.

By 10:15 the sales team can see that a Rotterdam logistics company of around 200 people viewed pricing twice and read one case study. That is the whole product, done well or badly.

Why Some Visits Never Resolve

Step two is the bottleneck. An office network with its own registered IP range is easy to match. A person working from their kitchen on a consumer broadband line is not, because the address belongs to the internet provider and is shared with thousands of households. Mobile data, VPNs, corporate traffic routed through cloud security gateways and privacy relays built into browsers all have the same effect: the address points at an intermediary, not an employer.

So match rates depend far more on your audience than on the vendor. A site visited mostly by people at desks in offices will see a large share of visits resolve. A site whose buyers browse on phones in the evening will see far fewer. Be sceptical of any single headline percentage quoted without saying whose traffic it was measured on.

Precision Versus Coverage

Vendors make a trade-off here that is rarely stated plainly. A cautious tool only names a company when the IP evidence is strong, so it identifies fewer visits but is usually right. An aggressive tool fills gaps with weaker signals, such as historic associations between an address and a company, and names more visits with more mistakes. A list of 400 companies that is a third wrong is worse than a list of 150 that is nearly all right, because your team will spend its week chasing the wrong third.

When you trial a tool, check a sample of its matches against visits you can verify, such as customers who later booked a call. That tells you more than any accuracy claim on a pricing page.

Companies, Not People

IP-based identification tells you which organisation a visit came from. It cannot tell you which of that organisation's employees it was, and in Europe it should not try. The Court of Justice of the European Union ruled in Breyer (C-582/14) that a dynamic IP address can be personal data, which is why identifying a business is treated very differently from identifying an individual.

Some tools do claim to name individual visitors. They get there in one of three ways: matching visitors against cookies and identity graphs bought from third parties, relying on US rules that are looser than European ones, or attaching a guessed contact (the head of marketing at the matched company, say) and presenting it as the person who visited. The first two are jurisdiction choices you inherit as the site owner. The third is a guess dressed as a fact.

If you sell into Europe, company-level identification is the version you can defend. It is also usually the more useful one. Buying decisions in B2B involve several people, and knowing that a company is on your pricing page is enough to decide whether to act.

What Good Looks Like

A well-run setup filters out internet providers, hosting companies, bots and your own staff before anything reaches a sales screen. It shows the pages each company viewed in order, not just a visit count. It separates a returning company from a one-off. And it is honest about what it could not match, rather than padding the list.

Contaktly works this way: it names the company, shows what it read, and hands the context to the Inbound Agent so the next conversation starts from what the buyer already looked at. Whatever tool you use, the test is the same. Ask it how it got from an IP address to a company name, and see whether the answer has all four steps in it.