Short answer
You can identify anonymous website visitors at the company level with reverse IP lookup tools, but match rates vary and remote work weakens them. Person-level matching exists, with higher legal risk. Privacy laws, wiretap lawsuits and EU consent rules all apply. The most reliable path is first-party: get visitors to tell you who they are.
Composite example: a B2B SaaS team gets 6,000 visits a month and 90 sign-ups. A sales lead asks, "Who are the other 5,910?" Someone suggests a tool that names the companies behind visits.
The answer depends on what "who" means, what the tool sees, and which laws apply.
What does it mean to identify anonymous website visitors?#
Visitor identification is the practice of linking a website visit to a known company or person who hasn't told you who they are. Website visitor tracking, by contrast, counts visits without naming anyone.
| Level | What you learn | How it works | Main risk |
|---|---|---|---|
| Company | "Someone from Acme Corp visited pricing" | Reverse IP lookup against a database of company networks | Wrong or missing matches |
| Person | "Jane at Acme visited pricing" | A vendor matches the browser to a profile in its data | Privacy law, consent, lawsuits |
| First-party | "Jane signed up from the Google Ads campaign" | The visitor gives you an email or logs in | Low, if your notice is clear |
Many "real time visitor tracking" dashboards mix the first two. Ask which level each name comes from.
How does company-level reverse IP lookup work?#
Every visit arrives from an IP address, and many offices use IP ranges linked to their company. A reverse IP lookup checks the address against a database of those ranges. A match gives a company name, not a person. Established B2B tools that do this include:
- HubSpot. HubSpot bought Clearbit in December 2023. Clearbit's free tools were retired on April 30, 2025, with Breeze Intelligence named as the replacement (Clearbit). HubSpot's current Buyer Intent page says it "identifies them using reverse-IP lookup technology" (HubSpot).
- Leadfeeder (Dealfront). Leadfeeder says it uses an "IP database" with "a constant stream of updates." It also says it processes and stores data in the EU (Leadfeeder).
- 6sense. Its page says it "can identify which companies are visiting your site, even if the individual visitors remain anonymous" (6sense).
The strength is real: a list of accounts reading your pricing page helps sales prioritize. None of these pages published a match rate when I checked in October 2026. Test one on your own traffic.
What about person-level identity resolution?#
A second group of vendors, often sold as "identity resolution," tries to name the individual. A script on your site reads browser identifiers. The vendor matches them against data it built or licensed, for example from partner sites where people shared an email. Practices vary by vendor. The result can be a name or email. The trade-offs differ from company lookup:
- You rely on data you didn't collect. You can't easily check how the person was matched or what they agreed to.
- Match quality is hard to audit. A wrong name in a sales email is worse than no name.
- Legal exposure is higher. Personal data, cookies and third parties are exactly what privacy laws and wiretap suits target. More below.
If you test one, have your lawyer review it before the script goes live. Ask the vendor in writing where the data comes from.
Why IP-based identification often misses#
- Remote and hybrid work. BLS reports that 22.6% of US workers teleworked or worked at home for pay in March 2026 (BLS). A home connection usually maps to an internet provider, not an employer. Some vendors say they can still match remote workers; test that claim on your own traffic.
- VPNs and privacy relays. A VPN shows the VPN's address. A shared corporate VPN may still match. A consumer one won't.
- Mobile and shared networks. Carriers, co-working spaces and cafés put many people behind one address.
In practice, some names are right, some are internet providers, and many visits show nothing. Useful for account-based sales; not a lead list.
Is it legal to identify website visitors?#
This is general information, not legal advice. Laws change and depend on your facts, so talk to a privacy lawyer before you deploy any identification tool.
California: CCPA and CPRA notice and opt-out#
The CCPA applies to for-profit businesses that do business in California and meet one of three tests. One is annual gross revenue over $26,625,000, the inflation-adjusted figure since January 1, 2025 (CPPA). Another is buying, selling or sharing the data of 100,000 or more California residents or households (California Attorney General).
If it applies, three duties matter here:
- Notice at collection. You must list the categories of personal information you collect and why (California Attorney General).
- Opt-out of sale or sharing. "Sharing" means sharing "for cross-context behavioral advertising" (same source). Sending visitor data to a third party that builds profiles can raise this question.
- Opt-out signals. Businesses must honor signals like Global Privacy Control. They must stop selling or sharing "no later than 15 business days" after the request (CPPA).
Other states have similar opt-out rights.
Wiretap and CIPA lawsuits over tracking tech#
Plaintiffs have sued many site owners under California's Invasion of Privacy Act (CIPA), claiming tracking scripts let third parties intercept visits. One law firm counted about 4,000 CIPA suits in California as of July 2026 (Goodwin).
Governor Newsom signed SB 690 on September 30, 2026, according to law firm Mayer Brown. It removes private lawsuits under CIPA's "pen register" section for websites and apps from January 1, 2027 (Mayer Brown). Pen register claims often centered on things like IP addresses.
That doesn't end the risk. Goodwin notes the wiretap sections "SB 690 leaves intact," along with federal and other state laws (Goodwin). A script that captures what visitors type or click is closer to those wiretap claims.
EU visitors: GDPR and the ePrivacy rules#
For EU visitors, the ePrivacy Directive covers reading or storing data on their device. The EDPB's 2024 guidelines say tracking pixels fall under Article 5(3). IP-only tracking can too, unless you can show the address doesn't come from the user's device (EDPB). Consent isn't required in every case, but marketing identification rarely fits the exemptions.
FTC and data brokers#
The FTC has acted against data brokers over how data was collected and sold. In January 2025, it finalized an order banning Mobilewalla from selling sensitive location data (FTC). It wasn't about B2B visitor tools, but the lesson holds: buy identity data and you inherit questions about how it was gathered.
The better path: first-party identification tied to revenue#
The most accurate way to know a visitor: they tell you. Then you tie them to the campaign that brought them and what they paid.
| Method | What you get | Effort |
|---|---|---|
| Sign-up or free trial | Email, plus the first-touch source you stored | Already exists for most SaaS |
| Gated free tool or calculator | Email in exchange for a result people want | 1–2 weeks to build |
| Login | A known user on every later visit, across devices | Already exists |
| "How did you hear about us?" field | Sources no tracker sees, like podcasts or a friend | One form field |
| Demo request form | Name, company and intent, in their words | Already exists |
Store the source when they do. Capture UTMs and click IDs on the first visit, then stamp them on the user at sign-up. The steps are in SaaS marketing attribution: tie every campaign to real revenue.
Send the result from your server. Server-side tracking explained covers the options and consent rules.
Ask, too. A self-reported source field catches what tracking can't. See "How did you hear about us?" Self-reported attribution done right.
You get fewer names than a lookup tool, but each is real and linked to revenue. That's the list that changes budget decisions.
How to do this in Kratly#
Kratly sells in the attribution category, so weigh that. To be plain: Kratly does not de-anonymize visitors. It doesn't do reverse IP lookup, and it doesn't buy identity data. Optional probabilistic matching only links visits within your own first-party data, and you can turn it off.
What it does is the first-party path above:
- Connect website tracking, Stripe or Shopify, Google Ads and Meta Ads. Kratly links each sign-up and payment to the campaign, page or email that brought it.
- Review revenue by campaign and page. You see which sources bring paying customers, not just visits.
- Approve suggested changes. Kratly suggests budget moves; you approve them, and each change is logged and reversible.
Questions, answered
Can you see who visited your website?
Partly. Analytics shows visits, pages and sources, but not names. Reverse IP tools show some companies, mostly from office networks. Person-level tools claim names, with more legal risk and accuracy you can't easily check. You reliably know a person only when they sign up, log in or fill in a form.
Is reverse IP lookup legal?
Often, but it depends on where your visitors are and what the tool does with the data. In the EU, the EDPB says reading IP addresses from a device can fall under consent rules. In the US, state privacy laws and wiretap suits may apply. This is not legal advice; check with a privacy lawyer.
How accurate is company identification?
It varies, and the vendors I checked don't publish one number. Matches work best for visitors on office networks. Home internet, VPNs and mobile networks usually return an internet provider or nothing. With about a fifth of US workers teleworking, expect many visits to stay unmatched. Test any tool on your own traffic.
Does SB 690 end CIPA lawsuits over website tracking?
No. SB 690 removes private suits under CIPA's pen register section for websites and apps, starting January 1, 2027, with some pending cases covered. Wiretap claims under other CIPA sections remain, as do federal and other state laws. Law firms expect plaintiffs to shift to those claims. This is not legal advice.
Does Kratly identify anonymous visitors?
No. Kratly doesn't do reverse IP lookup, person matching or identity data purchases. It ties sign-ups and payments people make on your site to the campaigns, pages and emails that brought them. That gives you fewer names than a lookup tool, but each one is first-party and linked to real revenue.
Written by
Priyansh Kumar
Priyansh Kumar has spent more than a decade in growth, scaling brands from 1 to 10 and from 10 to 100. He now builds Kratly, an autonomous growth team that ties every campaign, page and email to the revenue it brings.
Sources
- California Attorney General: California Consumer Privacy Act (CCPA)
- California Privacy Protection Agency: Opt-out preference signals (PDF) · Updated monetary thresholds in CCPA
- EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive, v2 (Oct 2024)
- FTC: FTC finalizes order banning Mobilewalla from selling sensitive location data (Jan 2025)
- BLS: 22.6 percent of workers teleworked in March 2026 (Apr 2026)
- Mayer Brown (law firm): California invalidates private lawsuits for pen register website claims (Oct 2026)
- Goodwin (law firm): California curbs CIPA "pen register" suits (Sep 2026)
- Clearbit: The future of Clearbit's free tools (Feb 2025)
- Vendor pages (checked Oct 2026): HubSpot Buyer Intent · Leadfeeder (Dealfront) · 6sense anonymous website visitor identification
Was this article useful?