B2B website visitor identification at company level vs person level

B2B website visitor identification comes in two broad flavors. One tells you which companies visit your site. The other tries to tell you which named people visit. Both are sold as ways to find buyers who never fill in a form, and both appear in the same product categories, which makes them easy to confuse. They are built on different data, they carry different risks and they produce different kinds of output. This article compares the two neutrally on how they work, how accurate they tend to be, what the legal picture looks like and which teams each approach suits. It is not legal advice, and it does not rank vendors.

What each approach means

Company-level identification attributes a website visit to an organization. It typically works by matching the network address of the visit to a business network using an IP-to-company data set. The output is a company profile, such as name, industry, size and location, plus the pages that company viewed. No individual is named.

Person-level identification attributes a visit to an individual. It usually relies on one or more of the following: third-party cookies synced across a network of partner sites, device graphs that link browsers and devices to known identities, hashed email addresses collected by publishers, or data from identity resolution providers. The output can include a person's name, job title, email address, phone number and social profile.

Some tools offer both, often presenting person-level results where available and company-level results as a fallback. When you evaluate a tool, ask which layer each field in the report comes from.

Where the data comes from

The source of the data shapes everything else, so it is worth understanding before anything else.

• Company-level data comes from the network side. Internet registries record which organizations hold which address blocks, autonomous system numbers identify networks, reverse DNS names often reveal the owner of a host, and commercial data sets combine these with other business signals to map ranges to companies. We explain this in detail in identify company by IP address.
• Person-level data comes from the identity side. It depends on a visitor having been identified somewhere else, on another site, in another app or through a data partner, and on a link being made between that identity and the browser that visits your site.

The practical difference is that company-level matching does not need to know anything about the person in front of the screen. Person-level matching only works because something about that person is already known and shared.

Accuracy and coverage compared

Neither approach identifies every visitor, and honest vendors on both sides say so. The failure modes differ.

Company-level matching misses visits from home broadband, mobile carriers, VPNs, coworking spaces and small companies without their own network ranges. When it does match, the answer is about the organization behind the network, which is usually stable and easy to check: you can look at the company's website and see whether it makes sense as a visitor. The main errors are stale range data, shared networks and visits from a company's hosting or cloud provider rather than its staff, which good tools filter out.

Person-level matching can reach some visits that company-level matching cannot, for example a known person browsing from home. Its errors are harder to spot. A device graph may link a shared household computer to the wrong person, a cookie match may be probabilistic rather than deterministic, and contact data may be outdated. Because you rarely know the true identity of an anonymous visitor, it is difficult to measure how often a named result is wrong. Ask any vendor how they validate matches, how often data is refreshed and whether results are deterministic or probabilistic.

• Company-level output is coarser but verifiable at a glance.
• Person-level output is more specific but harder to verify independently.
• Both should tell you what share of your traffic they matched, rather than quoting a universal rate.

The legal picture in broad strokes

This section is a general overview, not legal advice. Laws change and their application depends on your facts, so involve your own counsel.

In the European Union and the United Kingdom, IP addresses can be personal data under the GDPR and UK GDPR, so even company-level processing needs a lawful basis, a clear notice and appropriate safeguards. Reading or writing information on a visitor's device is also governed by ePrivacy rules, which is why consent setups matter. Person-level identification goes further, because it links browsing to a named individual and often involves data received from third parties, which raises questions about transparency, the lawful basis for each step and the rights of the people identified.

In the United States, there is no single federal privacy law for this use case. A growing number of states, including California, have comprehensive privacy laws with notice requirements, rights to opt out of the sale or sharing of personal information and, in some cases, recognition of signals such as Global Privacy Control. Separately, some plaintiffs have brought claims under older wiretap and pen register statutes against website tracking technologies. Person-level tools that tie a named individual to their browsing are generally closer to the center of these debates than company-level tools, but no approach is automatically safe, and no vendor can guarantee compliance on your behalf.

For a fuller overview of how these rules interact with visitor tracking, read website visitor tracking privacy law.

Trust and reputational risk

Legal exposure is only part of the risk. The other part is how your prospects feel. A buyer who receives a cold email naming the exact pages they personally read, after never giving their details, may conclude that your company watches people closely. That reaction can hurt a deal more than the outreach helps it.

Company-level data naturally encourages a different style of outreach. You know an organization is researching a problem, so you contact the relevant role at that account with something useful, rather than referencing an individual's behavior. Many security and legal reviewers also find company-level tools easier to approve, because the data model is simpler to explain: network address in, company out, no personal profile stored.

Which approach fits which team

The right choice depends on your market, your sales motion and your appetite for risk.

• Company-level identification suits teams selling to mid-size and larger organizations, account-based marketing programs, agencies reporting on campaign impact and any team that needs legal sign-off without a long review.
• Person-level identification is sometimes considered by teams selling high-volume, lower-priced offers where reaching an individual quickly matters more, and who have the legal resources to assess data sources and consent in detail.
• Many teams combine company-level identification with the person-level data they already collect lawfully, from forms, logins and email engagement, which covers known people without buying identity data.

Whichever you choose, make it a deliberate decision with your legal and security teams, not a default that comes with a tool. Our b2b website visitor identification page summarizes how the company-level approach works in practice.

Questions to ask any vendor

Whether you are looking at company-level or person-level products, these questions surface the important differences quickly.

• Does each field in the report come from company-level or person-level data?
• What are your data sources, and are they licensed for this use?
• How do you treat residential, mobile and VPN traffic?
• Do you report the matched share of my traffic?
• What privacy controls exist: opt-out, IP truncation, retention settings, consent mode, Global Privacy Control?
• Is a data processing agreement available, and what does your security review package include?
• Can I buy, change and cancel the plan myself, or does it require a contract negotiation?

If you are also comparing specific products, our neutral pages on Leadfeeder alternatives and Lead Forensics alternatives list publicly verifiable differences without ranking anyone.

Where VisitorDetector sits

VisitorDetector is a company-level tool by design. A script under 10 KB records visits, a licensed B2B IP-to-company data set matches business networks to companies, and residential, mobile and known VPN ranges are excluded and stay anonymous. You get company profiles, visit history, an interest score, alerts and CRM sync, never names or emails.

Privacy controls include an opt-out page, IP truncation, a retention setting with a 13-month default, notice templates for EU and California, consent mode support and optional respect for Do Not Track and Global Privacy Control. A DPA is available on request. Plans start at $24 per month billed yearly and are fully self-service. See how it works and our privacy-first approach for details, or read the companion article can you see who visits your website.