How does website visitor identification work?

Your analytics can tell you which pages people read last month, which ad they clicked and whether they were on a phone.

It can’t tell you who they were. (Which is the one thing sales keeps asking.)

Website visitor identification gets you part of the way. It looks at the network each visit came from and works out which company is behind it. That means companies, not people, and never every visit, whatever the homepage says.

What does your website already know about a visit?

More than you’d think, and none of it is a name.

Every visit arrives with a few things attached: the page that was asked for, the time and the device. There’s also where the visitor came from (a Google search, an ad, a link in an email). That’s what your analytics reports are built from.

It also arrives with an IP address. That’s the number of the network the visitor is on, and your site needs it for the same reason a letter needs a return address. Without it, it wouldn’t know where to send the page.

Google Analytics isn’t interested in that address. It uses it to work out roughly where the visitor is, then throws it away. So if five people at the same company spend a month reading your site, your reports show five unrelated users. (Ten, if they also read you on their phones.)

The only time your site learns who someone is, is when they type it into a form, and most people never do. They read, compare you with two competitors and leave.

Who owns an IP address?

Usually an internet provider. Sometimes the company itself.

IP addresses are handed out in blocks, and most of those blocks go to internet providers and mobile carriers. They pass the addresses on to their customers.

Your office gets one that stays the same. Your home gets one that changes every so often. Your phone shares one with a lot of other phones.

Only very large organisations hold blocks of their own. Banks, universities and governments, mostly.

Who holds each block is public. The record is called WHOIS, and any “IP lookup” site will search it for you for free. So it’s tempting to think you can do this yourself: take the address that keeps reading your pricing page, look it up and see who it is.

Try it, and your hottest lead turns out to be a broadband provider in Ohio. Technically true. Not much help.

You can test this on yourself. Search “what is my IP” from the office and paste the number into a WHOIS site. Unless you work at a bank, you’ll meet your own internet provider.

The other free lookups have the same problem:

All three tell you about the line. None of them tells you which company is on the end of it.

So how does a tool get from the provider to the company?

It uses a database that someone has spent years building.

It’s called an IP-to-company database, and it’s a record of which business is using which addresses. That’s possible because of something you just read: an office address stays the same.

The same company sits behind it this week, next week and usually next year. Once someone has worked out who it is, they can write it down.

Working it out is the hard part, and it’s where vendors differ. They all start from the public records.

The good ones add their own evidence over time and keep re-checking it, because companies move office and providers hand old addresses to new customers. A database that was right last year is wrong in places today.

Once the database exists, the rest is simple. You add a small script to your website, the same way you added Google Analytics, and for every visit it does three things:

1. It looks up the address. Is a business behind this network, or just a provider?
2. If it’s a business, it adds what’s known about it: the name, the website, the industry, the size and the location. (You’ll see this called enrichment.)
3. It files the visit under that company, next to everything else the company has done on your site.

That’s all visitor identification is. You’ll also hear it called IP intelligence or de-anonymisation, which are different names for the same thing.

What do you actually get?

For each company that’s matched, you get a record of who they are and what they did.

The “who” is the company’s name and website, plus its industry, size and location. The “what” is everything it did on your site. That’s which pages it read, how long it stayed, how often it’s been back and how it found you.

That’s enough to answer the question your analytics couldn’t. Say your pricing page had 38 visits this week. Now you can see that eleven companies read it, four of them came back for a second look and one is a deal you lost in the spring.

What it can’t tell you is why they were there. A company that spends six minutes on your pricing page might be about to buy. It might also be a competitor checking what you charge, or a student writing an essay.

You still have to look at who the company is before anyone picks up the phone.

Why can’t it identify every visitor?

Because a lot of visits don’t come from an office.

Remember that only an office address stays put with one company behind it. Everything else belongs to a provider, and the provider isn’t your lead. So how easy a visit is to match depends on where the visitor is sitting:

The address alone only gets you so far. Snitcher adds its own signals on top, so we can often match people working from home too, when we’ve seen their connection or device before. Phones on mobile data and consumer VPNs stay hard for every tool.

Nobody identifies every visitor, us included, and if a vendor says they do, ask them what they’re counting.

What does differ between tools is how many of your visits they catch, and how often the company they give you is the right one. You can’t tell that from a demo. The only real test is to run two tools side by side on your own site for a couple of weeks and compare the lists.

And don’t read anything into the visits that stay anonymous. It doesn’t mean they weren’t interested. Your next customer might be reading your docs on the train.

What do cookies add?

Memory. The company match works without one.

A cookie is a small file your site leaves in the visitor’s browser. In this case it holds a random ID and nothing else: no name, no email.

That ID is what lets a tool tell two visitors from the same company apart. Without it, “one company, 14 pageviews” could be one person reading everything or five people each reading your pricing page, and those are very different weeks. With it, you can see which.

It’s also what recognises someone coming back. The person who read your pricing page on Monday and your integrations page on Thursday shows up as one visitor returning, not two strangers.

What a cookie can’t do is tell you who that visitor is. It knows it has seen this browser before, and that’s all.

One practical thing: because a cookie is stored on the visitor’s device, it’s the part of all this that your cookie banner covers.

Can it tell you who the person was?

Not unless they tell you themselves.

This is the part people mix up most, so it’s worth being exact. A tool can know three different things about a visit:

• The company. The visit came from this company’s network. That’s the lookup described above.
• A likely contact. Someone at that company has the kind of job you sell to. This comes from a contact database, and it does not mean that person was on your site.
• A known visitor. This person filled in a form, logged in to your product or clicked a link in one of your emails, so the visit is theirs, unless they forwarded your email. From then on, their earlier visits are theirs too.

The mistake is treating the second as if it were the third. You know someone at the company read your pricing page. You’ve found their head of operations on a list.

That doesn’t mean she was the one reading. If you email her “I saw you were looking at our pricing”, she’ll wonder how you know. (So would you.)

Some tools go further and promise a name for visitors who never told you anything. They work by matching the visit against a large pool of profiles collected from other websites.

What you get back is the most likely person, not a confirmed one. It’s often close. Sometimes it’s someone who has never been on your site. We looked at how that plays out in our comparison of person-level tools.

Our take: treat a name like that as a hint and work out the rest yourself. If a visitor hasn’t told you who they are, what you really know is the company.

So, how does website visitor identification work?

By looking up where each visit came from. Every visit carries the address of a network. If that network is a company’s office, a tool can match it to the company and show you what that company read.

A home connection needs more than the address, so Snitcher adds its own signals and can often match people working from home too, when we’ve seen their connection or device before. A phone on mobile data or a consumer VPN usually stays anonymous, whichever tool you use.

Everything else is built on top of that. Cookies let a tool tell visitors apart and recognise them when they come back. Forms and logins are the only reliable way to get from a company to a person.

So when a vendor tells you they can identify your visitors, they’re all telling the truth, more or less. The useful questions are the next ones:

• Which visitors can’t you identify, and what will I see for those?
• How often do you re-check which company is behind an address?
• Can I run you next to another tool on my own site?

Curious which companies are on your site right now? Try Snitcher for a week. Then look for your own office in the list. (Everyone does.)