The short answer
| What you want to know | Can you see it? | How |
|---|---|---|
| How many people visit, and when | Yes | Any analytics tool |
| Which pages they read, and where they came from | Yes | Any analytics tool |
| Roughly where they are (country, city) | Yes | Worked out from the IP address |
| Which organisation they work for | Sometimes | Only on the organisation's own network |
| Their name and email | No, unless they give it | A question, a form, a booking |
The rest of this article explains each row, and where the law draws lines.
What does your analytics already show?
More than most people look at. Google Analytics, which is free, shows visits, pages, how people arrived (a search, an ad, a link, an email) and where they are.
Location comes from the visitor's IP address. Google says Analytics derives city, region, country, continent and subcontinent from it. For visitors in the EU, Switzerland and the UK, it uses the IP address only for that lookup, and then it's "immediately discarded": Google says it does "not log or store IP addresses" from those users.
What analytics won't show is who. That's by design. Google's policies require that no data be passed to it "that Google could use or recognize as personally identifiable information", and it lists names, email addresses and phone numbers as examples. So no setting in Google Analytics turns visitors into names. If a guide tells you to send email addresses into it, that guide is asking you to break Google's rules.
Can you see the individual people who visit?
Not from the visit itself. When someone opens a page, their browser sends the server an IP address, so the page can be delivered to them. That address belongs to a connection: a home router, a phone on mobile data, an office network. It doesn't come with a name.
It isn't anonymous either. In the Breyer judgment (2016), the Court of Justice ruled that a dynamic IP address is personal data for a website operator that has legal means to identify the visitor with extra information held by the internet provider. The European Commission lists "an Internet Protocol (IP) address" and "a cookie ID" among its examples of personal data. So even the raw address in your server logs falls under GDPR in the EU, though it doesn't tell you who someone is.
Some tools go further and put names to visits, by matching browsers to databases of people. The best known, RB2B, says on its own site that this is "US-only", that it has no offering aimed at the EU or UK, and that its database is designed to exclude personal data of EU and UK residents. For a European business, identifying people who never told you who they are is hard to justify. We cover that in Is RB2B legal in the EU?, and the wider legal picture in Is website visitor identification GDPR compliant?.
Can you see which company visited?
Sometimes. Tools such as Leadfeeder look up the IP address and check whether it belongs to a company's own network. If it does, you see the company's name; if it belongs to an internet provider, you see nothing useful.
Leadfeeder's help centre says it plainly: "only their internet connection defines if we can identify the company behind the visit or not". It doesn't show visits from internet providers, notes that a company VPN helps identify people working from home, and declines to give an identification rate: "As each customer is different there is no way to honestly give a percentage of visitors identified." It adds that a business selling to a small, specialised market will see more matches than, say, a garden supplies shop.
What that means in practice:
- Someone at their desk in a large office may show up as their employer.
- Someone on home Wi-Fi or mobile data shows up as their internet provider. That includes anyone browsing from home or on their phone.
- A one-person business may show up, but then the company name can be the person's own name, which makes it personal data.
So company lookups are useful if you sell to larger organisations and want to know which accounts are reading your pricing page. For most small businesses, whose visitors are consumers or people working from home, they find little. For how these tools work, see website visitor identification explained.
What one visit can tell you: an example
Here's an illustration (not real data) of what a typical visit to a renovation company's site shows, without anyone's name:
- Arrived from a Google search, on a phone, on Tuesday evening.
- Read the bathroom renovation page, then the prices page, then the prices page again.
- Rough location: a city in your service area.
- Network: a mobile provider, so no organisation.
You know what they're interested in and that they're probably comparing prices. You don't know who they are, and no tool will tell you legally. But you know enough to ask a good question while they're still on the page:
When would you like the work done? This month / Later this year / Just getting prices
Someone who answers "This month" has just told you more than a name would. Offer them the next step that fits: a call back today, or a time slot for a visit. When they leave their number, you know who they are, because they chose to tell you.
The realistic way: let them tell you
Every legal route to a name runs through the visitor: a question they answer, a form they fill in, a call they book, a chat they start. Three things make people more willing to do that:
- Ask at the right moment. After someone has read the prices twice, not as a pop-up on arrival.
- Ask one thing, with answers to click. A question that changes what you offer, not a form with eight fields.
- Offer something concrete in return. A price range, a call back, a time slot. "Contact us" isn't an offer.
This is the approach we built Signal on. It reads what a visitor does on your site (pages, order, where they came from), estimates their location from the IP address at the moment of the visit, and, when the visit comes from an organisation's own network, shows that organisation's name; home and mobile connections never show one. It never stores the IP address. It asks one short question when the answer would change what to offer, and offers the ready ones a call, a call back or WhatsApp. Names and contact details only come from visitors who choose to give them. More on what it keeps and why in GDPR-friendly visitor tracking.
When this isn't the right approach
- You sell to large companies and want account lists. A company lookup tool gives you names of organisations that never fill in a form, and that can be worth it. Compare options in Leadfeeder alternatives for small businesses, and check the legal points first.
- Almost all your traffic is from the US. Person-level tools work there, under different laws. If you also have European visitors, read RB2B alternatives for European websites.
- You only need numbers. If what you want is how many people came and which pages work, your analytics already does that.
Questions people also ask
Can I see who visited my website for free?
You can see how many people visited, what they read and roughly where they are for free, with Google Analytics or a similar tool. You can't see their names, for free or otherwise, unless they give them to you.
Does Google Analytics show IP addresses?
No. Google says Analytics doesn't log or store IP addresses from EU, Swiss or UK users; it uses them only to work out a rough location.
Can I see visitors' IP addresses in my server logs?
Often, yes: the browser sends the IP address with every request. In the EU that address can be personal data, so treat your logs that way. An IP address on its own still won't tell you who the visitor is.
