Last updated 12 November 2026. Website deanonymization is the process of matching anonymous website visits to the company, and sometimes the individual person, behind them. It works by reading signals the visit already carries (the IP address, a token in the browser, a login or a tagged link) and matching them against business registries or identity data that people agreed to share.
Most B2B sites convert a small share of visitors through forms, so the rest leave without a name. Deanonymization is how sales teams find out who those people were. This guide covers how the methods work, how company-level and person-level results differ, what the law allows in the US, UK and EU, and how to test a vendor before you commit. If you want the product view first, our website visitor identification page explains it in one screen.
How website deanonymization works
Every tool in this category does three things. A script on your pages records the visit. A matching step tries to resolve it. A delivery step pushes the result into your leads, CRM or Slack. The matching step is where vendors differ, and it uses one or more of four methods.
1. IP-to-company matching (reverse IP)
Company networks are registered to their owners. When someone browses from an office connection, the IP address can be looked up and resolved to the company: name, domain, industry, size and location. It is fast and works in every country, but it only ever names a company. It also breaks on shared connections. Ten firms in one serviced office share one address, and a remote worker on a home broadband line resolves to an internet provider, not an employer. Our reverse IP lookup accuracy comparison explains where it fails and why.
2. First-party signals
These are the visits you can already name yourself: a customer who logs in, a prospect who fills in a form, someone who clicks a tracked link in your own email. They are the most accurate signals you have, and the smallest set.
3. Opt-in identity networks
This is how person-level identification works. A partner website (a free tool, a template download, a webinar) asks people for their name and business email and for consent to share them. An encrypted token is stored in that browser. When the same person later lands on your site, your pixel reads the token and asks the provider who it belongs to. The answer comes back server to server: name, business email, phone, LinkedIn and company.
4. Probabilistic matching
Some vendors guess from patterns: device attributes, timing, behaviour across sites. Browser fingerprinting falls in this group. Check any match built this way by hand before you act on it, and ask the vendor how much of their person-level data comes from it.
Related: Email Waterfall Enrichment: How It Works
Company-level vs person-level deanonymization
The difference decides what your sales team can do the same afternoon. A company-level result tells you that someone at Acme read your pricing page three times. A person-level result tells you it was their Head of Operations, with an email address you can write to.
- Company-level comes from reverse IP. It covers office traffic in every country and leaves you to work out who to contact.
- Person-level comes from opt-in identity data. Coverage depends on the country and on how large the provider's network is, and it is not available for EU and EEA visitors with providers that follow GDPR strictly.
- Suggested contacts sit in between: the visiting company plus the person there who matches the job titles you sell to. That person is the right one to talk to, not necessarily the one who clicked.
For a longer breakdown with examples, read person-level vs company-level visitor identification.
Is website deanonymization legal?
Yes, in most markets, as long as the method fits the visitor's country. Two questions apply everywhere: is the tracking script itself allowed, and is the identification allowed?
United States
US privacy law (CCPA and CPRA in California) works on notice and opt-out rather than prior opt-in. You describe the visitor identification service in your privacy policy, link an opt-out and, in California, honour the Global Privacy Control signal. Person-level data that comes from people who opted in to share it is the usual basis.
United Kingdom
Person-level identification is possible on the same opt-in basis. The tracking script belongs in the marketing category of your cookie banner under PECR, and business email addresses can be contacted without prior opt-in as long as you give a clear way to object.
EU and EEA
GDPR treats IP addresses and cookie identifiers as online identifiers (Recital 30), and the Court of Justice confirmed in Breyer (C-582/14) that a dynamic IP address can be personal data. In practice, careful providers resolve EU visits to the company only and never try to name the person. Contacting a decision-maker at that company then rests on legitimate interest under Article 6(1)(f), provided the message is relevant and easy to opt out of. Our GDPR guide to visitor identification goes through each step.
Whatever the country, four things belong on your site: a privacy policy line, a cookie notice entry, an opt-out link and a data processing agreement with your vendor. This is general information, not legal advice; share it with your legal team.
Related: Anonymous Website Visitor Identification: Name the Person, Not Just the Company
What match rate should you expect?
Match rate has no standard definition, which is why vendor numbers range so widely. One vendor counts companies, another counts sessions, a third counts only US traffic. Leadfeeder publishes its own figure of 38% of visits identified at company level across its core regions in August 2026. Person-level rates are lower everywhere, because they depend on whether that visitor is in an opt-in network at all.
Three things move your number more than the vendor does:
- Where your visitors are. US traffic resolves to people far more often than EU traffic, which stays company-level.
- How they reach you. Office traffic resolves well by IP; mobile and home connections rarely do.
- Whether the script is on every page. A pixel on the homepage alone misses the visitors who land deep in the site from search.
The only reliable test is your own traffic. Run two tools side by side for 30 days on the same pages and compare named, correct results, not raw counts.
Deanonymization vs Google Analytics
Google Analytics counts and describes visits in aggregate. Its terms forbid sending personally identifiable information, so it will never show you a company or a person. Deanonymization tools answer the question GA cannot: who was it? Most teams run both. GA tells you which pages and channels work, and the visitor identification tool tells sales who to call about them.
How to evaluate a website deanonymization tool
- Ask what share of person-level matches is opt-in and what share is probabilistic. Only the first is a fact you can act on.
- Check country coverage. If half your traffic is from Germany, a US-only person-level product will give you companies at best.
- Check what happens when nobody can be named. A company with no contact is a research task; a company with a suggested contact by job title is a lead.
- Read the compliance pages. Look for an opt-out page, a DPA and clear wording on what is identified in the EU.
- Test on your traffic for 30 days and spot-check 20 named visitors by hand against LinkedIn.
How Happierleads handles deanonymization
Happierleads, a UK-based company, identifies the exact person visiting your website (name, business email, phone and LinkedIn) plus their company and every page they viewed. A pixel on every page records the session first, then matches it by an opt-in browser key from a partner network, server to server. This is the Exact Visitor result, available in 174 countries including the US and the UK.
For visitors in the EU and EEA it deliberately stops at the company and adds a Suggested Contact: the person there who matches the job titles you sell to. There is no setting to switch person-level on for the EU. The legal basis for each region is set out on the Is it legal? documentation page, and anyone can opt out at happierleads.com/opt-out. If you are weighing it against an IP-based tool, see Happierleads vs Leadfeeder.
What to do with visitors you cannot identify
Some visits will never resolve: mobile data, VPNs, EU visitors who never meet your ICP, people who blocked the script. Don't chase them one by one. Use them in aggregate instead. Retarget them with ads, watch which pages they read, and make sure the pages they read have a clear next step. Cookie changes in Safari and Chrome affect this group most; our note on cookieless visitor tracking covers what still works.
Frequently asked questions
What is website deanonymization?
Matching anonymous website visits to the company, and sometimes the person, behind them, using signals such as the IP address, a consented browser token, a login or a tracked link.
Is website deanonymization legal?
Yes in most markets when the method fits the visitor's country. The US works on notice and opt-out, the UK allows person-level data on an opt-in basis, and in the EU and EEA careful providers identify the company only and rely on legitimate interest to contact a decision-maker there.
Can deanonymization identify the actual person or only the company?
Both exist. Reverse IP only names the company. Person-level results come from opt-in identity networks and depend on the visitor's country and whether they are in that network.
Do I need a cookie banner for a visitor identification script?
In the UK and the EU, put the script in the marketing category of your consent banner. In the US, a privacy policy line and an opt-out link are the usual requirement, plus Global Privacy Control handling in California.
How is deanonymization different from Google Analytics?
Google Analytics reports visits in aggregate and does not allow personal data, so it never shows who visited. A deanonymization tool names the company or person so sales can follow up.
What is a realistic match rate?
There is no standard definition, so compare vendors on your own traffic. Company-level rates are much higher than person-level ones, and both depend on where your visitors are and how they connect.
