Website visitor tracking privacy law for B2B sites

Website visitor tracking privacy law is not one rulebook. A B2B site that sees traffic from California, Virginia, Germany and France touches several regimes at once, each with its own definitions, notice duties and rights for the people behind the visits. This guide walks through the main frameworks in plain terms, shows where company-level visitor identification fits, and lists the practical controls a marketing or RevOps team can put in place this quarter. This is not legal advice. Laws change and their application depends on your facts, so treat this as a map for a better conversation with your own counsel.

Why privacy law applies even when you only want company names

Many B2B teams assume privacy law stops at names and email addresses. It does not. Most modern privacy statutes define personal information broadly, and an IP address, a cookie identifier or a device identifier can count as personal information when it relates to a person who can be identified, directly or indirectly. A visit from a corporate network still comes from a human being sitting at a laptop.

That is why the way a tool works matters so much. A product that resolves a visit to a named individual, builds a personal profile and enriches it with an email address raises far more questions than a product that maps a business network to a company and stops there. Company-level identification still processes an IP address in the moment, so it still sits inside the scope of privacy law, but the data you keep and act on is about an organization, not a person.

An IP address can be personal information under GDPR and under several US state laws.
Cookies and similar storage on the device trigger separate rules in the EU, independent of what data you collect.
What you store, how long you keep it and who you share it with drive most of your obligations.

If you want the technical background first, read how IP-to-company matching works and the comparison of company-level vs person-level visitor identification.

California and the CCPA as amended by the CPRA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is the US law most B2B teams meet first. It applies to for-profit businesses that do business in California and cross certain thresholds, such as annual revenue above a set figure that is adjusted over time, or buying, selling or sharing personal information of a large number of California residents, or deriving a large share of revenue from selling or sharing personal information. Check the current thresholds with counsel rather than relying on a number in a blog post.

The law gives California residents rights to know what is collected, to delete, to correct, to limit the use of sensitive personal information, and to opt out of the sale or sharing of their personal information. Sharing, in the CPRA sense, covers disclosure for cross-context behavioral advertising. The temporary exemption for business-to-business contact data ended at the start of 2023, so employees of your prospects are covered like anyone else.

For website visitor tracking, the practical questions are these:

Does your privacy notice describe the categories of data collected at the point of collection, including online identifiers such as IP addresses?
Do you sell or share personal information with any vendor in a way that triggers the opt-out right, and if so, do you offer a working opt-out link?
Do you honor opt-out preference signals such as Global Privacy Control, which California regulations treat as a valid request to opt out of sale and sharing?
Do your contracts with service providers contain the terms the regulations require?

Other US state privacy laws in general terms

A growing number of states have passed comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others, with more taking effect on a rolling basis. They differ in details, but most share a recognizable shape: applicability thresholds based on the number of residents whose data you process, consumer rights to access, delete and correct, an opt-out right for targeted advertising, sale and certain profiling, and a requirement for data protection assessments for higher-risk processing.

Several of these laws exclude data processed in a purely employment or business-to-business context, while others, like California, do not. Some require businesses to honor universal opt-out signals, and the list of states that do has been growing. Because the patchwork moves every year, the safest operating model for a national B2B site is to pick one set of controls that satisfies the strictest common requirements and apply it everywhere, instead of building state-by-state logic you will struggle to maintain.

Publish one clear privacy notice that covers visitor analytics and company identification.
Honor opt-out signals for every visitor, not only for one state.
Keep retention short and documented.
Review the list of applicable states with counsel at least once a year.

If people in the European Union or the United Kingdom visit your site and you monitor their behavior, the GDPR (and the UK GDPR) can apply to you even if your company has no office in Europe. Two layers matter here, and teams often mix them up.

The first layer is the ePrivacy rules, implemented in each EU country's national law. They govern storing or reading information on a visitor's device, such as cookies, local storage or fingerprinting. As a general rule, this needs prior consent unless it is strictly necessary to provide the service the visitor asked for. Analytics and marketing cookies are generally not strictly necessary, so they usually need consent, with some national regulators allowing narrow exemptions for limited audience measurement.

The second layer is the GDPR itself, which governs any processing of personal data, including an IP address, regardless of whether a cookie is involved. You need a lawful basis for each purpose. For company-level visitor identification, businesses typically consider either consent or legitimate interests. Relying on legitimate interests requires a documented balancing test that weighs your interest in knowing which companies show buying intent against the reasonable expectations of the person behind the visit, plus safeguards that reduce the impact on them.

Lawful basis chosen and documented per purpose.
Transparency in your privacy notice, written so a normal visitor understands it.
Data minimization: keep company-level results, not personal profiles.
Retention limits, an easy objection route and a data processing agreement with each processor.
Rules on transfers if data leaves the EU or UK.

Most B2B sites already run a consent management tool for EU visitors. The cleanest setup is to let your visitor identification script follow the same decisions the visitor makes there. If the visitor declines analytics or marketing in the consent tool, the script waits or does not run. If the visitor accepts, it runs. This avoids a second banner and keeps one record of choices.

Global Privacy Control is a browser signal that tells sites the visitor wants to opt out of sale and sharing. California treats it as a valid opt-out request, and other states have adopted similar rules for universal opt-out mechanisms. Do Not Track is an older signal with no general legal force in most places, but honoring it is an easy way to show good faith.

VisitorDetector supports consent mode for cookie managers you already use, and it can respect Do Not Track and Global Privacy Control signals when you turn that setting on. It does not require third-party cookies. You can read more about the approach on our privacy-first visitor identification page.

What your privacy notice should say about visitor identification

Transparency is the one duty that appears in nearly every framework. A good notice section about visitor identification is short, specific and honest. It should tell a visitor, in a way they can understand, what happens when they load your pages.

What is collected: the IP address of the visit, pages viewed, time on page, referrer and campaign parameters.
What it is used for: identifying the company network a visit comes from, so the sales and marketing team can understand which organizations are interested in the product.
What is not done: no identification of individuals by name, no email enrichment, no personal profiles.
Who processes it: a category such as "a visitor analytics provider acting as our processor or service provider".
How long it is kept and how to opt out, with a working link.
The lawful basis for EU visitors and how to object.

VisitorDetector includes notice text templates for EU and California audiences that you can adapt with your counsel, and every installation gets a visitor opt-out page at /opt-out. Treat the templates as a starting draft, not a finished legal document.

DPAs, retention and the data you keep

When a vendor processes visitor data on your behalf, the contract matters as much as the code. Under the GDPR you need a data processing agreement that sets out the subject matter, duration, nature and purpose of processing, the obligations of the processor and the handling of subprocessors. Under the CCPA, service provider and contractor agreements must include specific restrictions, such as a prohibition on selling the data or using it outside the business purpose.

Retention is where many teams quietly accumulate risk. Ask how long raw visit data is kept, whether IP addresses are stored in full or truncated, and whether you can shorten retention. VisitorDetector keeps data for 13 months by default, lets you set a shorter retention period, offers an IP truncation option and provides a DPA on request. Our security page describes how the data is protected in transit and at rest.

Sign a DPA before installing the script on production pages.
Set retention to the shortest period that still supports your sales cycle.
Turn on IP truncation if you do not need the full address after matching.
Exclude your own office IPs so employee traffic does not pollute reports.

A practical compliance checklist for B2B marketing teams

Use this list as a working agenda with your legal and security colleagues. It will not make you compliant on its own, but it covers the questions regulators and prospects tend to ask.

Map which jurisdictions your traffic comes from and which laws may apply.
Decide the lawful basis for EU visitors and document a balancing test if you rely on legitimate interests.
Connect the identification script to your existing consent tool for EU and UK traffic.
Turn on Global Privacy Control and Do Not Track handling.
Update the privacy notice with a clear visitor identification section.
Publish the opt-out page and link it from the notice and the footer.
Sign DPAs with every processor and keep a list of subprocessors.
Set retention and IP truncation, and record why you chose those values.
Review once a year, because the state law landscape keeps moving.

Again, this is not legal advice. If you sell into regulated industries or process traffic at large scale, a short engagement with privacy counsel is money well spent.