Explainer
How to identify anonymous website visitors
Anonymous visitors are identified by matching signals from your traffic against identity data. Company-level tools match the visitor’s IP address to a business and typically identify 30–65% of traffic; person-level tools match cookies and device signals against US-centric identity graphs and typically identify 5–40%. No tool identifies everyone.
The mechanism, without the smoke and mirrors
Buyers regularly ask whether this category is “just smoke and mirrors,” and the skepticism is earned — most vendor pages describe outcomes, not mechanisms. Here is what actually happens: a small script on your site observes each visit and attempts a match against identity data. There are only two fundamentally different ways that match is made.
Company-level: IP-to-business matching
Every visit carries an IP address. Businesses register IP ranges, and enrichment databases map addresses to the companies behind them. When a visit comes from a matched range, the tool names the account — deterministically enough to route territories and trigger plays. Consumer ISP and mobile traffic is filtered out rather than guessed at.
Person-level: identity-graph matching
Person-level tools match cookies and device signals against identity graphs assembled from data partnerships. When a visitor’s signals appear in the graph, the tool names the individual. The matching is probabilistic, the graphs are US-centric, and accuracy is the most common complaint with reveal tools — which is why we treat person-level output as a lead, not a fact.
Company-level vs. person-level identification
| Dimension | Company-level | Person-level |
|---|---|---|
| What it tells you | Which business is on your site (the account) | The individual visitor's name, title, and LinkedIn |
| How the match is made | The visitor's IP address is looked up against business IP registration data and enrichment databases | Cookies and device signals are matched against identity graphs built from data partnerships |
| Typical match rate | 30–65% of traffic (Factors.ai, 2026) | 5–40% of traffic (Factors.ai, 2026) |
| Geography | Works on global traffic | Effectively US-only — RB2B's own site describes its identity graph as US-only |
| What weakens it | Remote workers on residential IPs, VPNs, and mobile carrier networks | Cookie consent and blocking, non-US traffic, and stale identity-graph data |
| Privacy posture | Matches an IP to a business, not a person — generally the lower-risk approach | Processes personal data — stricter obligations under GDPR and US state privacy laws |
Match-rate ranges are from Factors.ai’s 2026 guide to visitor identification. Your numbers depend on your traffic mix — test on your own site before buying.
What match rate should you actually expect?
According to Factors.ai’s 2026 guide to visitor identification, roughly 98% of website visitors never fill out a form, person-level tools typically identify 5–40% of traffic, and company-level tools identify 30–65%. Geography moves those numbers hard: as Satellyte’s 2026 RB2B review put it, “RB2B’s match rate on US visitors is materially higher than on EMEA or APAC visitors.” If a vendor quotes you one universal match rate, ask which traffic mix it was measured on — and see our buyer’s guide to visitor identification software for how the major tools compare on exactly this.
Identification is step one — the work is after the match
A reveal that ends in a Slack ping still leaves the research, deduplication, and outreach to your team. Lumitra identifies the companies on your site, stitches their visits into account timelines, enriches them with company intelligence, and hands them to GTM agents that validate, dedupe, and write to your CRM with audit trails. If you are comparing reveal-first tools, start with our Lumitra vs. RB2B breakdown.
Frequently asked questions
Can I really see who visited my website?
Partially. No tool identifies every visitor. Company-level tools can name the business behind a meaningful share of your B2B traffic; person-level tools can name some individual US visitors. The honest framing: you are buying a sample of your traffic, and the useful question is what you do with the visitors that do match.
Does visitor identification work with remote work and VPNs?
Remote work is the biggest headwind for IP-based matching: an employee working from home shows up on a residential ISP address, not their company's registered IP range. Office traffic, VPN egress through corporate ranges, and cloud-hosted egress still match. This is a structural limit every vendor shares, whatever their marketing says.
Is identifying anonymous website visitors legal?
Company-level identification (matching an IP to a business) is generally treated differently from person-level identification, which involves personal data and stricter obligations under GDPR and US state privacy laws. Where your visitors are located and how the vendor sources identity data both matter — review the vendor's data practices and consult your counsel before deploying person-level reveals.
Why do vendors quote such different match rates?
Because match rates depend on your traffic, not just the vendor: geography (US vs. global), audience (B2B office traffic vs. consumer), and company size mix all move the number. As one RevOps buyer on Reddit put it, the only test that matters is to run the same ICP slices through each vendor and compare what actually matched. Any vendor quoting one universal number is quoting their best case.
What should happen after a visitor is identified?
Identification is raw material, not pipeline. The account still needs research, deduplication against your CRM, and a decision about the play. That after-the-match work is where most teams stall — and it is the part Lumitra automates with GTM agents that enrich, validate, and write to Close, HubSpot, or Salesforce with audit trails and optional human approval.
See who is on your site right now
Book a 30-minute demo and we’ll show you the companies visiting your site today — measured on your real traffic, not a vendor’s best case.