Website visitor identification GDPR and US privacy law, company level by design
If you sign off on tools that touch your website traffic, you need a straight answer to one question: what does this product collect, and what are we responsible for. VisitorDetector identifies companies, never named people. This page explains what we collect, what we never collect, the controls you get, and how GDPR, CCPA and CPRA and other US state laws apply, in plain English. This is not legal advice, and your own counsel should review your setup.
What VisitorDetector collects
When a page with the snippet loads, we receive the technical data any web server receives, and we use it to match the visit to a business network.
From the match we show company data: company name, website, industry, employee range, HQ country and region, and a LinkedIn company page link when we have one.
- The IP address of the visit, used to match a business network and then truncated or kept according to your setting.
- The page URL, page title, time on page, referrer and UTM parameters of the visit.
- A first-party session identifier so that several page views of one visit are grouped together.
- Browser signals that matter for privacy, such as Global Privacy Control and Do Not Track, when you turn on that option.
What we never collect
Company level is a design decision, not a setting someone can switch off. The product has no feature that turns a visit into a person.
No names of visitors, no email addresses, no phone numbers.
No personal profiles, no social profile matching of individuals, no enrichment of people.
No form field capture and no keystroke recording.
No third-party cookies and no cross-site tracking of individuals.
No identification of residential, mobile carrier or known VPN traffic. Those visits stay anonymous.
Privacy controls built into every plan
- Visitor opt-out. Your notice can link to our opt out page, where a visitor stops measurement on every site that uses VisitorDetector in that browser.
- IP truncation. Turn it on and we shorten the stored IP address after matching, so the full address is not kept.
- Retention. Visit data is kept for 13 months by default, and you can shorten that. Starter keeps 90 days of history.
- Consent mode. If you already use a cookie or consent manager, the snippet can wait for the consent signal you choose before it measures.
- GPC and DNT. You can tell the snippet to respect Global Privacy Control and Do Not Track, and those visits are not measured.
- Exclusions. Exclude your own office IPs, existing customers and competitors from lists and alerts.
- DPA on request. Email [email protected] and we send our data processing agreement.
- Deletion on request. We delete a company record or a visit history when you or a data subject asks.
How GDPR applies to company-level identification
Under GDPR an IP address can be personal data, even when the purpose is to identify a company. That means GDPR can apply to your use of any visitor identification tool when visitors come from the EU or the UK. Saying "it is only company data" does not end the analysis, and we do not pretend it does.
You, the website owner, are the controller for the data collected on your site. We act as your processor and process the data only on your instructions, under a DPA.
There are two lawful bases teams usually consider, and here is the honest version of each.
Either way, describe the processing in your privacy notice and link to the opt-out.
- Legitimate interest. Many B2B teams rely on legitimate interest for company-level analytics, after a documented balancing test. Company level, IP truncation, short retention, a clear notice and an easy opt-out all weigh in favor of the visitor. It is your assessment to make, and some regulators take a stricter view.
- Consent. If your counsel concludes that consent is required in your case, for example because local rules on device access apply, use consent mode so the snippet only measures after the visitor agrees in your existing consent manager.
CCPA, CPRA and other US state laws
In the US there is no single federal privacy law. California's CCPA as amended by CPRA, and a growing list of state laws in places such as Virginia, Colorado, Connecticut, Texas and Oregon, set rules for personal information, which can include IP addresses.
For a longer walk through the rules, read our guide on website visitor tracking privacy law.
- Under CCPA and CPRA we act as your service provider. We use the data only to provide the service to you, and we do not sell it or share it for cross-context behavioral advertising.
- Several state laws treat Global Privacy Control as a valid opt-out signal. Turning on GPC support helps you honor it automatically.
- Your notice should say that you use a visitor identification service, what categories are collected and how to opt out.
Notice templates for EU and California
Every account includes notice text templates you can adapt and add to your privacy policy. They explain in plain words that your site uses a company-level visitor identification service, what is collected, the purpose, the retention period, and where to opt out.
Templates are a starting point, not a finished legal document. Have your counsel review the final text.
- An EU and UK template that names the lawful basis you chose and the rights of the visitor.
- A California template that covers categories of personal information, the service provider role and the opt-out.
What this page is and is not
This page describes how VisitorDetector works and how the main privacy laws are generally understood. It is not legal advice and it is not a guarantee that any particular setup is compliant. Your obligations depend on your business, your visitors and your notice. If you have questions about our processing, email [email protected]. Read more on security at VisitorDetector and in the privacy policy.
Start with a company-level setup
See which pages of your site carry the most buying intent with try the demo, then pick a plan on visitor identification pricing and install the snippet with your privacy settings in place from day one.