Is website visitor identification GDPR compliant?

The short answer

It depends on what the tool identifies, how it gets that information from the visitor's browser, and what you do with the result. There's no blanket yes.

• Person-level identification (a name, a LinkedIn profile, an email) is processing personal data about someone who didn't tell you who they are. In the EU that's hard to justify without their consent.
• Company-level identification (the company behind an IP address) is easier to defend, but not automatically fine. The IP address can be personal data, some company names point to one person, and the script that collects it can need consent.

The vendor can't settle this for you. Under EU law, the website that installs the script shares responsibility for it.

Two kinds of visitor identification

	Company-level	Person-level
What you get	A company name, sector, size	A person's name, profile, email
How	The visitor's IP address, matched to the company that owns the network	Cookies or identifiers, matched to a data broker's database of people
Works for	Visitors on an office network	Mostly US visitors; RB2B, for example, doesn't offer it for EU visitors
Usual legal argument	Legitimate interest	Consent, or a claim that GDPR doesn't apply

We cover person-level tools such as RB2B in Is RB2B legal in the EU?. The rest of this article is mostly about company lookups, because that's what's sold to European websites. For how both methods work, see website visitor identification explained.

Is an IP address personal data?

It can be. In Breyer (2016), the Court of Justice ruled that a dynamic IP address is personal data for a website operator if the operator has legal means to identify the visitor with extra information held by their internet provider. The European Commission lists "an Internet Protocol (IP) address" and "a cookie ID" among its examples of personal data.

Vendors often answer that company data isn't personal data. The Commission agrees that GDPR doesn't cover data about companies as such. But it adds two things vendors rarely mention:

• Information about a company can be personal data when it identifies a person. A sole trader's business name is often their own name.
• The rules cover people acting in a professional capacity. A business email like forename.surname@company.eu is personal data.

So a lookup that returns "Acme GmbH, 2,000 staff" is one thing. A lookup that returns a one-person consultancy, or that you then pair with a named contact, is processing personal data.

Does the script need consent?

Separately from GDPR, the EU's ePrivacy rules say that storing information on a visitor's device, or reading from it, needs their consent unless it's strictly necessary for a service they asked for. In Planet49, the Court of Justice held that this applies whether or not the information is personal data, and that a pre-ticked box isn't consent.

Many company lookup tools say they're cookieless, so these rules don't apply. The European Data Protection Board's guidelines are less reassuring:

• JavaScript that instructs the visitor's browser to send information to a server falls within the rule (paragraph 33).
• Tracking based on the IP address alone "could" fall within it too. Unless a provider can ensure the IP address doesn't come from the visitor's own device, it "has to take all the steps" the rule requires (paragraphs 54 and 55).

The Board adds that falling within the rule doesn't always mean consent is needed; an exemption may apply (paragraph 56). But "no cookies" doesn't settle the question.

The website is responsible too. In Fashion ID, the Court of Justice held that a website that embeds a third party's code can be a joint controller with that third party for collecting and passing on its visitors' data.

Can you rely on legitimate interest?

This is the vendors' main argument. Leadinfo, for example, writes that the legal basis for company-level identification is "Article 6(1)(f) GDPR: legitimate interest", and that you "don't need explicit consent". Leadfeeder is more careful: it says which legal basis applies is "a determination for you and your legal team to make and document".

The European Data Protection Board's guidance on legitimate interest sets three conditions, and all three must be met:

1. A real interest. Finding customers can count.
2. Necessity. You must check whether your aim "cannot reasonably be achieved just as effectively by other means less restrictive" of people's rights (paragraph 119).
3. Balancing. People's interests and reasonable expectations mustn't outweigh yours. The Board says the balancing test would hardly ever come out in your favour for tracking individuals across websites, devices or services for marketing (paragraph 120).

Two more points from the same guidance. Where a tracking technique needs consent under the ePrivacy rules, consent is likely the right basis for what follows too, which normally rules out legitimate interest (paragraph 115). And people can object to direct marketing at any time, without giving a reason; you must then stop (paragraph 122).

What regulators have done

We found no published decision by a European regulator about a company lookup tool. What we did find:

• Saxony, Germany (2024). The regional regulator checked about 30,000 websites and wrote to 2,300 that used Google Analytics without proper consent.
• France. The CNIL lets audience measurement run without consent only if it's strictly for the site's own statistics, produces anonymous data, isn't combined with other processing and doesn't follow people across sites. Identifying who visited doesn't fit those conditions.
• KASPR (France, 2024). For person-level contact data, the CNIL fined KASPR €240,000 for collecting LinkedIn contact details beyond what people "could reasonably expect". We cover this and other cases in Is RB2B legal in the EU?.

What vendors leave out

Put together, the vendor answer ("company data, legitimate interest, no cookies, so no consent") skips four things:

1. Sole traders and named contacts. Not every company is anonymous, and business emails are personal data.
2. The script itself. Cookieless isn't the same as outside the ePrivacy rules, according to the European Data Protection Board.
3. Whose decision it is. You, as the website, must make and document the legitimate interest assessment, including whether a less intrusive way would do.
4. Whether it works for you. A lookup finds companies on office networks. Visitors on home Wi-Fi or mobile data show up as their internet provider, so for many small businesses' audiences it finds little.

If you use a lookup tool anyway

It can make sense if you sell to large companies and want to know which accounts are researching you. Then:

1. Write down your legitimate interest assessment, including why a less intrusive way wouldn't do.
2. Ask the vendor whether its script stores or reads anything on the device, and connect it to your cookie banner if in doubt.
3. Say it in your privacy policy: which tool, what for, the legal basis and how to object.
4. Treat one-person companies and named contacts as personal data, and don't email anyone on the strength of a lookup alone.
5. Check where the data is hosted and who the vendor shares it with.

For tools that work for European traffic, see RB2B alternatives for European websites and Leadfeeder alternatives for small businesses.

Do you need to identify anyone?

The European Data Protection Board asks whether you could reach your aim in a less intrusive way. For most small businesses, the aim isn't a list of company names. It's talking to the visitors who are ready to buy. You can get that by asking them.

Signal reads what a visitor does on your site, asks one short question when the answer would change what to offer, and offers the ready ones a call, a call back or WhatsApp. Contact details only come from visitors who choose to give them, and it records their consent with its wording and time.

It isn't outside these rules. When a visit comes from an organisation's own network, Signal shows that organisation's name, looked up in its own database; home and mobile connections never show one. It doesn't keep IP addresses, it runs in Frankfurt, and in the EU and UK it remembers returning visitors only once your cookie banner allows it. More in GDPR-friendly visitor tracking.