98% of your website visitors leave without converting, so knowing which companies they work for is tempting. Then legal asks the obvious question: are we allowed to do this?
For US companies the question has two layers. California’s privacy law, the CCPA, applies to many B2B businesses that sell into the state. And if your site gets visitors from Europe, GDPR can apply too.
This guide explains what both laws say about the data visitor identification touches, where company-level identification fits, and which questions to put to any vendor. It is general information based on the published texts, not legal advice. Your own counsel should confirm how the rules apply to your business.
The short answer
Website visitor identification is not illegal in itself. What matters is what the tool collects, what it outputs, and what you do with the result.
A tool that recognizes organizations and reports company-level data carries a different risk profile from a tool that names individual visitors. Under both GDPR and the CCPA, the step from “a company visited” to “this person visited” is where most of the obligations start.
What data visitor identification actually touches
Most B2B identification tools work by matching the network a visit comes from to a database of organizations. If you want the mechanics, read what is IP tracking and how you can identify website visitors with it.
That means two kinds of data are involved:
- Input: the IP address of the visit, plus page views and timestamps.
- Output: a company name, industry, size, location and the pages that company viewed.
The output is business data. The input is where the legal discussion sits, because both laws treat IP addresses with care. Identification is also not perfect: home workers, mobile networks and VPNs often resolve to a provider rather than a company, as explained in how reliable IP tracking is for identifying website visitors.
What the CCPA says
The California Consumer Privacy Act, as amended by the CPRA, is the US law B2B marketers run into most often. Based on the texts published by the California Attorney General and the California Privacy Protection Agency, these are the points that matter for visitor identification.
Who it applies to. For-profit businesses that do business in California and meet at least one of these conditions:
- annual gross revenue above $26,625,000, the threshold as adjusted from January 1, 2025;
- buying, selling or sharing the personal information of 100,000 or more California residents or households;
- deriving 50% or more of annual revenue from selling California residents’ personal information.
What counts as personal information. Information that identifies, relates to, or could reasonably be linked with a consumer or household. The statute explicitly lists “internet protocol address” among its examples of identifiers, next to names and email addresses.
Business contacts are included. The temporary exemptions for employee data and business-to-business data expired on December 31, 2022. A procurement manager who lives in California is a consumer under the CCPA, even when you only contact them in a work context.
What consumers can ask for. The right to know what you collected, to delete it, to opt out of its sale or sharing, to correct it, and to limit the use of sensitive information.
What you have to tell them. A notice at collection that lists the categories of personal information you collect and the purposes you use them for. In practice, that means your privacy policy should describe your visitor identification tool.
Other US states
Privacy rules in the US are set largely at state level, and the laws differ on an important point for B2B teams. Virginia’s Consumer Data Protection Act, for example, defines a consumer as a resident acting in an individual or household context, and excludes people acting in a commercial or employment context. California has no such exclusion anymore.
So check each state you sell into. A workflow that is out of scope in one state can be in scope in California.
What GDPR means for a US company
GDPR applies to organizations outside the EU when they monitor the behavior of people in the EU. If your site attracts European visitors and you analyze their behavior, the regulation can apply to you even without an office in Europe.
Under GDPR, company-level visitor identification is usually based on legitimate interest, Article 6(1)(f). Cookies are a separate question: a tool that depends on cookies needs consent, and most tools lose 40 to 60 percent of their visibility to consent banners. The details are in what’s allowed and what’s not under GDPR.
Where company-level identification sits
Here is the honest version. A company-level tool does not tell you which person visited. But it does process the IP address of the visit to recognize the organization, and the CCPA lists IP addresses as personal information. So “no personal data is involved at any point” is not the right way to describe it in a US context.
The accurate description is narrower: the tool uses network data to recognize an organization, and what it reports is business-level.
Three steps change the picture, under both laws:
- Adding named contacts. When you look up a person at an identified company, you process personal information about that person.
- Person-level identification. Features that match a visit to an individual, for example after a form submission, bring you fully into personal data.
- Using cookies. Cookie-based tracking triggers consent requirements in Europe and belongs in your privacy notice in California.
None of these are forbidden. Each one needs a documented purpose, a line in your privacy notice and a way to honor requests.
How Leadinfo handles this
Leadinfo identifies companies, not individuals, and the identification output is business-level: company name, industry, size, location and page behavior.
- Cookieless option. In cookieless mode, Leadinfo delivers 100% company identification without cookies. You can know which company is visiting your website without a consent banner deciding what you see.
- Legal basis in Europe. Legitimate interest under GDPR Article 6(1)(f).
- Security and hosting. ISO 27001 certified, GDPR by design and EU-only hosting in Ireland and Frankfurt, with no transfers to the US.
- Opt-out. Any company can opt out through Leadinfo’s opt-out page, applied within 48 hours.
- Person-level features are separate. Persona Insights, Leadinfo’s person-level feature, requires cookies. It is not compatible with cookieless mode, so you decide deliberately whether to switch it on.
For the full technical picture, read how identifying website visitors without cookies works.
Questions to ask any visitor identification vendor
Put these to every vendor on your shortlist, including us, and ask for the answers in writing:
- Does the tool identify companies, individuals, or both?
- Does it depend on cookies, and what happens when a visitor declines them?
- Which data does it collect as input, and how long is it retained?
- Where is the data hosted, and is it transferred to other countries?
- What is your legal basis under GDPR, and how do you describe your role under the CCPA?
- How can a company or person opt out, and how fast is that applied?
- Which certifications are independently audited?
Our checklist for fully GDPR-proof website visitor identification turns the European side of this into a working list.
Getting started
Legal’s question is a fair one, and it has an answer once you know what your tool actually does. This week, list every tool on your site that recognizes visitors, note whether it works at company or person level, and check whether your privacy notice describes it. Share that list with your counsel before you add named contacts to the workflow. Leadinfo makes the first part simple: company-level output, a cookieless mode and documented hosting you can hand straight to your legal team. Book a demo and walk through the setup with your legal questions on the table.
Frequently asked questions
Is website visitor identification legal in the US?
It can be, depending on the tool and how you use it. Company-level identification is a common B2B practice, but under the CCPA an IP address counts as personal information, and business contacts are covered. Describe the tool in your privacy notice, honor opt-out requests and confirm your setup with legal counsel.
Does the CCPA apply to B2B companies?
Yes, if the company meets one of the thresholds and does business in California. The exemption for business-to-business data expired on December 31, 2022, so personal information about California-based business contacts is covered like any other consumer data.
Can I identify anonymous website visitors without breaking GDPR?
Company-level identification is usually based on legitimate interest under GDPR, as long as it does not single out individuals. Cookie-based tracking needs consent. A cookieless, company-level tool keeps you on the safer side, while person-level identification requires a stronger basis and clear information for visitors.
Is Leadinfo CCPA compliant?
Leadinfo is GDPR-compliant, ISO 27001 certified and hosted in the EU, and it reports company-level data. Whether your use of any visitor identification tool meets the CCPA depends on your own notices, opt-out handling and purposes, so review your setup with your counsel and ask us for our privacy and security documentation.
