Is Website Visitor Identification GDPR Compliant?
Company level visitor identification can be run lawfully under GDPR on legitimate interest. Person level identification of named EU individuals is a different matter, and most of the confusion comes from treating the two as one.
Website visitor identification can be GDPR compliant when it works at company level: matching a visit to an organisation, not to a named person, under a documented legitimate interest and a clear privacy notice. Person level identification, which puts a named individual against a page view, is personal data processing that usually needs consent in the EU, and most tools doing it cannot show they have it.
That is the short version. The longer version matters because vendors on both sides of the line tend to describe themselves in the same words, and the legal position of the two approaches is not remotely similar.
Where Exactly Is the Line?
GDPR applies to personal data, meaning information about an identified or identifiable natural person. A limited company is not a natural person. So the output of a company level tool, a report that says a logistics firm in Rotterdam with 200 staff looked at your pricing page three times this week, is generally not personal data.
The input is a different story, and this is the part most vendor articles skip. To make that match, the tool reads the visitor's IP address. Since the Court of Justice ruling in Breyer (C-582/14) in 2016, a dynamic IP address can be personal data in the hands of a website operator, because there are lawful routes to tie it to a person. So even a purely company level tool is processing personal data for a moment, and it needs a lawful basis for doing so. Saying that company data is outside GDPR is true of the result and misleading about the process.
- Company name, industry, headcount and location: not personal data in themselves.
- The visitor's IP address at the moment of lookup: can be personal data, so it needs a lawful basis.
- A sole trader or a two person firm: the company and the person can be the same thing, and the data should be treated as personal.
- A named individual, their work email or their LinkedIn profile tied to a visit: personal data, without any doubt.
What Legitimate Interest Actually Covers
For company level identification, the usual basis is legitimate interest under Article 6(1)(f). Recital 47 of GDPR says processing for direct marketing purposes may be regarded as carried out for a legitimate interest, which is about as close as the regulation gets to endorsing B2B prospecting. It is not a blank cheque. You have to pass a three part test: a genuine interest, processing that is necessary for it, and a balance that does not override the visitor's rights.
The balance is where company level identification holds up well. The IP address is used to resolve an organisation and then is no longer needed. The visitor is acting in a professional capacity on a business website. Nothing about their private life is inferred. Write that reasoning down in a legitimate interest assessment, keep it with your records of processing, and you have something you can show a regulator.
The Cookie Question Is Separate
A lot of companies get this wrong in the opposite direction. They satisfy themselves on GDPR and forget the ePrivacy Directive, which sits alongside it. Article 5(3) requires consent before storing or reading information on a visitor's device unless it is strictly necessary for the service the visitor asked for.
The European Data Protection Board's guidelines on the technical scope of Article 5(3) make clear this is not only about cookies. Local storage, tracking pixels and some fingerprinting techniques can fall inside it too. So the question to ask a vendor is not just whether they are GDPR compliant, but what their script stores or reads on the device. A tool that sets identifying cookies needs to sit behind your consent banner, whatever its marketing says about legitimate interest.
Why Person Level Tools Do Not Travel
Most person level identification products were built in the United States, where the default model is notice and opt out. They work by matching visitors against identity graphs: cookie syncing with data partners, hashed email matches, publisher networks. The output is a named person, often with a personal email, against your page view.
Bring that into the EU and three problems appear at once. The matching relies on reading identifiers from the device, which needs ePrivacy consent. The match itself is personal data processing that is hard to justify on legitimate interest, because a visitor reading a pricing page does not reasonably expect a stranger to learn their name and inbox from it. And Article 14 requires you to tell people when you obtain their data from somewhere other than them, within a month at the latest. In practice almost nobody sends that notice.
To their credit, several of the larger US vendors say this plainly and restrict person level matching to US traffic. The risk sits with the ones that do not, and with buyers who assume that a tool sold to them in Europe must be legal to use in Europe.
What a Compliant Setup Looks Like
- Company level matching only for EU and UK traffic.
- A written legitimate interest assessment covering the IP lookup.
- A privacy notice that names visitor identification and the vendor doing it.
- A data processing agreement with that vendor, and clarity on where the data is hosted.
- Consent through your banner for anything the script stores or reads on the device beyond what is strictly necessary.
- Contact details for people at the identified company sourced and handled as their own processing, with their own basis and an easy opt out.
That last point deserves a note. Knowing that a company visited is one thing. Reaching out to a buyer there is a separate act of processing, and the usual B2B rules apply: legitimate interest for the contact data, national rules on unsolicited email, which vary between countries, and a clean way to unsubscribe. In the UK, PECR plays the role of the ePrivacy Directive and the logic is the same.
So Which Should You Use?
If most of your traffic is European, company level identification is the defensible option and the one worth building a process on. It tells sales which accounts are in market, which is what most teams actually need. Contaktly works this way, identifying the company rather than the person. If your traffic is overwhelmingly American and you have taken advice, a person level tool may suit you better, and it would be dishonest to pretend otherwise.
This article explains how the rules are generally applied. It is not legal advice. If visitor identification is central to your pipeline, have your data protection officer or counsel review your setup and your legitimate interest assessment.
