Is identifying companies that visit my website allowed under privacy law?

This page may contain affiliate links from which Blur Studio earns commissions.

Anyone running or considering a company-level visitor identification tool eventually asks the same question: is this actually allowed? It's a reasonable thing to worry about, since the tool is reading something about your visitors without them explicitly opting in the way a cookie banner usually requires. The honest answer has two parts: what the technology actually does, and what the law says about data like that, which is less settled than either side of the debate tends to admit. How these tools work is covered in seeing which companies visit your site.

What does the tool actually collect?

Company-level identification works differently from the kind of tracking most people worry about. It doesn't read cookies you've set, doesn't capture anything a visitor types, and doesn't build a profile of an individual person across visits. Instead, it reads the visitor's IP address and matches that against a database that maps IP ranges to the business networks they belong to. Diginius's own positioning on this is specific: it states its script "collects only non-personally identifiable attributes and the IP address," and that "an individual cannot be identified via the IP address or any attribute; neither is that the purpose." The output is a company name, not a person's name. A wider view of finding buyers is in finding companies ready to buy.

The tool also depends on cookies functioning normally to work at all, which creates a built-in opt-out: if a visitor rejects cookies, Lead Intelligence disables itself for that specific visit. This means privacy-conscious visitors who actively manage their cookie preferences are automatically excluded from identification, without the business having to do anything extra to honor that preference. Diginius also states visitor data is stored on Amazon Web Services' UK and Ireland servers, which is relevant if EU data residency specifically matters to your compliance posture.

Why this isn't as simple as the vendor's page makes it sound

The vendor framing, "it's not personal data, so it's not covered by the strict rules," is a genuinely contested position in privacy law, not a settled fact. Under GDPR specifically, an IP address can be considered personal data in some circumstances, particularly if it's capable of being linked back to an identifiable individual through other means available to someone. Whether a company-level match (not an individual match) crosses that line is exactly the kind of question regulators and courts in different jurisdictions have taken different views on over the years, and the answer can depend on details like how the data is combined with other information you hold, not just the tool's own technical design in isolation.

This is why "the vendor says it's compliant" and "a lawyer reviewed my specific use case and confirmed it's compliant" are genuinely different levels of assurance. A vendor has an obvious incentive to frame its own product as compliant, and vendor compliance pages are written to sell the product, not to serve as your legal defense if a regulator or a visitor ever raises a complaint.

It's also worth noting that this isn't a niche or unusual question specific to one vendor. Company-level website identification as a category, across every vendor offering it, has faced this exact scrutiny for years, and the industry's general answer has settled into something like "lawful in most cases, with real edge cases that depend on your specific jurisdiction and setup." That's a meaningfully different statement from "always lawful everywhere," which is closer to how some marketing pages frame it.

How does this differ by region in practice?

In the United States, there's no single federal privacy law covering this the way GDPR covers the EU, so the practical risk for a US-only business running this kind of tool is lower, though state-level laws (California's CCPA and its successor CPRA, along with newer state privacy laws in places like Virginia and Colorado) have been steadily expanding what counts as regulated personal information, and some of them explicitly cover IP addresses in certain contexts. A US business shouldn't assume "no GDPR" means "no privacy law applies at all."

In the UK and EU, GDPR and UK GDPR set a higher bar, and regulators there have historically taken an expansive view of what counts as personal data, including IP addresses in many contexts, specifically because an IP address combined with other information (which an internet service provider typically holds, even if the website operator doesn't) can sometimes be used to identify an individual indirectly. Whether a company-level-only match avoids that concern is the specific nuance a vendor's compliance page glosses over and a genuine legal review would actually test against your setup.

The questions worth actually asking before you turn this on

Question	Why it matters
Do you serve UK or EU visitors specifically?	GDPR and UK GDPR carry the strictest, most tested interpretation of what counts as personal data; US-only businesses face a meaningfully lower-risk landscape, though not zero risk
Does your current cookie banner disclose this kind of tracking?	If your consent banner only mentions analytics cookies and doesn't disclose company-identification technology, that's a gap worth closing regardless of the underlying legal question
Does your privacy policy mention it?	Most privacy policies were written before tools like this existed on a given site; an outdated policy is a separate, easily fixed risk on top of the underlying compliance question
Are you combining the company match with other personal data you hold?	Linking an anonymous company match to a named contact you already have in your CRM changes the data-protection analysis; the moment it becomes linkable to an individual, different rules likely apply

Walking through these four questions with your own lawyer, rather than relying on a vendor's compliance page, is the actual due diligence step here. None of this means the tool is illegal or that you should avoid it; plenty of businesses run this kind of identification lawfully. It means the certainty needs to come from your own review, not a marketing page.

A fifth question worth adding to that list, often overlooked: how long is the data retained, and is it deleted on a defined schedule, or does it build up indefinitely? Most privacy frameworks care not just about whether data collection is lawful in the first place, but whether you're keeping it longer than you have a genuine reason to. Ask your vendor directly what their retention period is and whether you can configure or shorten it, rather than assuming indefinite storage is the default or that it's fine simply because the vendor hosts the infrastructure.

What I'd actually tell you

If you're a small UK or EU business already running visitor identification without having had a lawyer look at it, that's worth fixing, not because I think you're definitely doing something wrong, but because "probably fine" isn't the same as "confirmed fine" when a regulator or a visitor complaint could force the question later. The fix is usually quick: an hour with someone who knows data protection law, reviewing exactly what the tool collects, how your cookie consent and privacy policy currently read, and whether anything about your specific setup (combining the data with other systems, for instance) changes the picture. Once it is cleared, see following up on pricing page visits.

If you're outside the UK and EU and have no plans to serve customers there, the practical risk is meaningfully lower, though "meaningfully lower" still isn't "zero," and US states have been adding their own privacy rules in recent years that touch similar ground. Either way, updating your privacy policy and cookie banner to actually disclose this kind of tracking is a cheap, sensible step regardless of which legal interpretation ultimately applies to your situation.

A practical scenario worth thinking through: imagine a small UK-based agency runs this kind of identification on its site for a year with no issue, then a visitor from a company that was matched files a complaint after noticing a suspiciously well-timed, specific sales email referencing something they'd browsed. That complaint alone doesn't mean the agency broke the law, but it does mean the agency now needs to demonstrate its practice was lawful, after the fact, under scrutiny, rather than having confirmed it calmly in advance. The cost of a proper review up front is almost always smaller than the cost of defending the same question reactively once someone's already unhappy.

How I'd approach this

I build the technical side of this kind of thing for clients, connecting identification data into CRMs and outreach workflows, but I'm not a lawyer and I won't pretend the compliance question is simpler than it is. What I'd actually suggest: get the legal review done first if you serve UK or EU visitors, update your privacy policy and cookie disclosure to match what's actually running on your site, and only then build the automation on top of a tool like this. I can help with the technical build once the compliance groundwork is settled; that part isn't something to skip to save time. If you're still at the evaluation stage, reading the vendor's own current terms and data-handling pages directly, rather than relying on a summary like this one, is the right next step before anything else. The sales side is in getting warm leads from your website.