Website visitor identification for B2B: what it sees, what it misses, what to do next

Updated 11 November 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run inbound, midbound and outbound for founders

Website visitor identification tells you which companies have been on your site, and much less often which person. The company-level part matches a visitor's IP address or device signals to an organization, and honest published match rates sit around half of sessions, not the 90% in some sales decks. Person-level identification is far rarer and carries real privacy obligations.

What can these tools actually see?

Three things break company-level matching, and nobody selling the tools leads with them. Remote workers on home broadband resolve to a consumer ISP. Mobile traffic resolves to a carrier. VPNs and proxies resolve to whatever exit the traffic takes. If your buyers are remote-first, your match rate sits at the bottom of the published range.

What match rate should I expect?

Published numbers vary because vendors measure different denominators. Two we read ourselves:

The gap between 46.8% and 65% is mostly the denominator. Warmly defines match rate as "the percentage of sessions a tool can confidently tie to a company or person", and warns that vendors claiming very high rates often compute them against "matchable visitors" rather than all visitors. So ask one question on the demo: all sessions, or something smaller? Then run a two-week trial and compute it yourself, identified sessions divided by total sessions.

What are the privacy rules?

This is general information, not legal advice. Get counsel before turning person-level identification on.

In the EU. The ePrivacy Directive, Article 5(3), allows storing or accessing information on a user's device only where the user has clear information and "is offered the right to refuse such processing by the data controller" (Directive 2002/58/EC on EUR-Lex, checked November 2026). The exemptions are narrow: facilitating a transmission, and what is "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user". Our cautious reading: a script whose purpose is to identify visitors for sales outreach is not strictly necessary for delivering your website, so it sits behind consent. The GDPR applies separately once a person is identifiable: Recital 26 says the principles of data protection "should apply to any information concerning an identified or identifiable natural person", and Recital 47 weighs legitimate interests against the data subject's reasonable expectations (Regulation 2016/679 on EUR-Lex, checked November 2026).

In the US. The rules are state by state. California's privacy agency says the CCPA applies to for-profit businesses doing business in California that meet at least one threshold: gross annual revenue of "$26.625 million or more", buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling or sharing it (CPPA FAQ, checked November 2026). It defines personal information as information that "identifies, relates to, or could reasonably be linked to a particular consumer or household", and says businesses "must honor opt-out preference signals" such as the Global Privacy Control. Our cautious reading: person-level identification on US traffic needs a privacy policy that describes it and respect for that signal, and you should check whether you have crossed a threshold. Many seed-stage startups have not, which is not the same as having no obligations.

We could not open a UK primary source today, so we will not summarize UK rules here. If you have UK traffic, read the ICO's own guidance and take advice.

What do you actually do with a company-level signal?

Nothing creepy, and nothing automatic. Here is the play we would run for a made-up company, Harlow Grid, which sells energy monitoring software to property managers. Harlow Grid is an example, not a customer.

Step 1, filter hard. Keep only companies matching the target rule: property management firms with 50 or more buildings. Most weeks that is a handful out of hundreds of sessions. Ignore the rest, including your own team, investors and recruiters.

Step 2, check whether they are already in motion. If the account is in a sequence or has an open deal, the signal goes to its owner as context, not as a new touch.

Step 3, research the account, not the visit. What changed there recently? New buildings, a new head of facilities, a reporting deadline. That is what the message is about.

Step 4, pick a person the normal way. Build the contact from your usual sources. Do not try to work out who was on the page.

Step 5, write about the topic, never the visit. Good: "Most property managers we talk to are pulling meter data by hand before a reporting deadline." Bad: "I saw someone from your company on our pricing page on Tuesday." The second costs you the meeting.

Step 6, if they are a known contact, move fast. A known contact on your pricing page in working hours is a midbound signal, and the window is minutes, not days. See speed to lead.

Step 7, measure it as a list. Count how many identified accounts turned into a conversation over 8 weeks. If the answer is nearly none, the filter is too loose or your traffic is not your buyer.

Is it worth paying for?

Under about 1,000 B2B sessions a month, probably not yet. Half of a small number is a smaller number. Fix the traffic first. With real traffic and a narrow target list, company-level identification is a reasonable addition to the other signals you already watch, which we ranked in buying signals for B2B outbound. It is one input, not a pipeline source.

SOVE7GN GTM treats it that way. We run inbound, midbound and outbound daily for B2B founders at seed to Series C: founder posts, fast personal follow-up with people who show interest, and cold outreach written one message at a time. Site signals feed the research, never the opening line. Book 30 minutes to see your own signals worked properly. Pricing is shared on the call, and the rest of our writing is in the GTM guides hub.

Questions people ask