GDPR-compliant visitor identification
Most visitor-identification tools resolve anonymous traffic to a named individual. For companies with European visitors or European legal review, that model is a non-starter. Company-level identification is the defensible alternative.
The short answer
- Identifying an anonymous EU visitor as a named person, without consent, processes personal data with no clear lawful basis under GDPR.
- Identifying the visitor's company is not personal data in the same way — a limited company is not a data subject.
- Targetlytics identifies the organisation, then suggests the likely buying-committee contacts by role and persona rather than de-anonymising the specific visitor.
- This keeps the in-market signal a sales team needs while staying inside what a European DPO will approve.
Why person-level identification is a GDPR problem
GDPR governs the processing of personal data about identified or identifiable individuals. When a tool matches an anonymous visitor to a specific named person and their profile, that is processing personal data — and doing it without consent, without notice, and without the individual's knowledge is exactly the pattern regulators have acted against.
The common defence, legitimate interest, is weak here: the visitor has a strong expectation of privacy when browsing anonymously, and there is a less intrusive way to achieve the same commercial goal.
The company-level model
Company-level identification resolves the visitor's IP or network to an organisation. A company is a legal entity, not a data subject, so identifying it does not carry the same GDPR weight. You learn that a mid-size logistics firm in Rotterdam viewed your pricing page three times this week.
To make that actionable, Targetlytics then suggests contacts on the likely buying committee by persona — the Head of Operations, the RevOps lead — drawn from business-contact data with its own lawful basis, rather than claiming to know which individual was behind the anonymous session.
What you still get
The output a sales team actually uses is unchanged: an in-market account, the pages viewed, the intent trend, firmographics, and a shortlist of people to contact. What you give up is the false precision of a named visitor you were never lawfully entitled to identify — plus the risk that comes with it.
Person-level vs company-level under GDPR
The same commercial goal, two very different compliance positions.
| Aspect | Person-level ID | Company-level ID |
|---|---|---|
| What is identified | A named individual + profile | An organisation |
| Is it personal data? | Yes | Not in itself |
| Lawful basis needed | Consent, realistically | Standard legitimate interest for B2B |
| DPO approval in the EU | Usually withheld | Routinely granted |
| Consent banner impact | Material | None |
| Sales usefulness | High, if lawful | High |
An in-market signal your DPO will sign off on
Identify the companies on your site and the buying-committee contacts to reach — without de-anonymising individuals.