Is website visitor identification legal in Europe? (2026)

Yes, identifying the companies that visit your website can be legal in Europe, but EU law treats it as tracking. The EDPB reads the ePrivacy consent rule (Article 5(3)) as covering tracking scripts and pixels, not only cookies, and the EU Court of Justice has held that IP addresses can be personal data (Breyer, C-582/14). The person-level tools we checked do not name individuals on European traffic: RB2B says "Person-Level ID is US-only", and Warmly lists "no personal-level anonymization in Europe". Company-level tools such as Albacross, Leadfeeder (formerly Dealfront), Leadinfo and Snitcher host data in the EU and have free plans or entry prices under €70 a month billed annually, but they document consent very differently.

Checked on 15 October 2026 against the legal sources and each vendor's own pages. This is not legal advice. Revexa builds Leo, a buying-signal agent that reaches companies through public signals such as hiring, funding and new executives instead of tracking visitors. It does not identify website visitors, so it is the wrong tool if that is what you need, and it is not in the comparison below.

Company level or person level: how identification works

Company level (reverse IP). The vendor's JavaScript sends each visitor's IP address and page data to the vendor, which looks the IP up in an IP-to-company database; most trackers also set a first-party cookie to recognise repeat visits. Leadfeeder's tracker "captures visitor IP addresses, domains, and location data, then matches them against our proprietary IP-to-company databases" (Leadfeeder help). Remote workers are harder to match, since they "usually use dynamic IP addresses that change ownership frequently" (Leadfeeder).

Coverage figures are the vendors' own: Leadinfo identifies companies for "typically around 30% of your total traffic" (pricing), and Warmly gives a "Company identification rate around 60%" (help). We found no independent benchmark.

Person level (identity graphs). These tools match the browser to an identity seen elsewhere. RB2B matches visitors "against a fully-permissioned publisher network using a combination of 1st and 3rd party cookies, device IDs and IP addresses" (RB2B FAQ); Warmly checks for "Cookies, Fingerprinting or the IP Address of the visitor". Both keep it out of Europe: RB2B's person-level ID "will not identify individuals located outside the US (for GDPR and CCPA compliance)", and Warmly does not offer it there.

The EU rules that apply

1. IP addresses can be personal data

In Breyer (C-582/14, 2016), decided under the GDPR's predecessor, the CJEU held that a dynamic IP address registered by a website operator "constitutes personal data" where the operator "has the legal means" to identify the person with data held by the internet provider (judgment). A company match can identify a person too, "for instance when it comes to sole traders", as Albacross notes (privacy policy).

2. The script needs consent before it runs

Article 5(3) of the ePrivacy Directive allows storing or accessing information on a user's device only with consent, unless it is needed to transmit a communication or "strictly necessary" for a service the user "explicitly requested" (Directive 2002/58/EC). In Planet49 (C-673/17, 2019) the CJEU ruled that this applies whether or not the information is personal data (judgment).

The EDPB's Guidelines 2/2023 (version 2.0, adopted 7 October 2024) apply the rule beyond cookies (EDPB). JavaScript that "instructs the browser of the user to send asynchronous requests with the targeted information" falls "clearly" within it, and so does collecting identifiers through tracking pixels. On IP-only tracking: "Unless the entity can ensure that the IP address does not originate from the terminal equipment of a user or subscriber, it has to take all the steps pursuant to the Article 5(3) ePD." The EDPB adds that this "does not systematically mean that consent needs to be collected", because exemptions exist. In our reading, identifying a visitor's employer for sales is not strictly necessary for a service the visitor asked for, so consent first is the safe setup.

3. Follow-up rests on legitimate interest, within limits

Contacting someone at an identified company processes their personal data, and B2B outreach can rest on legitimate interest under Article 6(1)(f) GDPR. A commercial interest can qualify, but the processing must be "strictly necessary" for it and not overridden by the person's rights (CJEU, C-621/22, 4 October 2024) (judgment). The EDPB's draft Guidelines 1/2024 add two limits: where tracking feeds direct marketing, consent "will likely constitute the appropriate legal basis", "thus normally precluding reliance on Article 6(1)(f)"; and the balancing test "would hardly yield" a positive result for "tracking individuals across multiple websites, locations, devices or services" (EDPB).

You must also say where you got the data at first contact at the latest (Article 14(3)(b)) and stop when the person objects (Article 21(3)). National marketing law adds a layer: Germany's UWG §7 requires prior express consent for email advertising, B2B included (our guide). Our GDPR and B2B email guide walks through the balancing test.

4. What may change

The Commission's Digital Omnibus proposal (COM(2025) 837) would move the rule into the GDPR as Article 88a and exempt audience measurement "by the controller of that online service solely for its own use" (proposal). On 15 October 2026 it was still "Awaiting committee decision" in Parliament (Legislative Observatory). In our reading, no proposed exemption covers identifying visitors for sales.

National rules: Germany and Sweden

Germany. Section 25 of the TDDDG (called the TTDSG until 14 May 2024) permits storing or accessing information on a user's device only with consent given under the GDPR, except for transmission or what is strictly necessary for a digital service the user explicitly wants (TDDDG §25). The German regulators' guidance (DSK, version 1.2, November 2024) adds that consent is needed even when no personal data is involved, and must come before any consent-requiring cookie is set (DSK).

Sweden. Chapter 9, section 28 of the Electronic Communications Act (LEK, SFS 2022:482) allows data to be stored in or read from a user's terminal equipment only if the user is told the purpose and consents, with the same two exemptions (LEK). The regulator PTS reads it as covering techniques other than cookies too (PTS). IMY says PTS alone supervises LEK's cookie rules, while the processing of personal data that follows, such as analysis or profiling, falls under the GDPR and IMY (IMY).

Enforcement examples

• France, €150 million (2025). The CNIL fined SHEIN (Infinite Styles Services Co. Limited) on 1 September 2025. Advertising cookies were placed "as soon as they arrived on the website", and clicking "Refuse all" did not stop new cookies (EDPB summary of the CNIL decision).
• Sweden, reprimands (2025). On 30 April 2025 IMY reprimanded three Swedish companies over cookie banners: ATG partly for misleading design, and Aller Media for relying on legitimate interest without justifying it or showing a balancing test (IMY).

What each vendor says about Europe

Listed alphabetically.

Albacross (Stockholm) identifies companies and sells verified email and phone credits, naming Cognism as its contact data partner. Its help centre is the most explicit: "you must obtain valid consent and inform your visitors on your website" about its script (GDPR FAQ, checklist). The data it processes includes a "Fingerprint hash", and once it adds your visitors' data to its own database, "We then become data controllers".

Leadfeeder (formerly Dealfront) identifies companies and sells contacts from its Activate plan. Dealfront became Leadfeeder on 24 March 2026 (FAQ). It says "Yes, Leadfeeder is GDPR compliant" (Leadfeeder), hosts data on AWS in Ireland and concludes its DPA automatically (GDPR page). Its consent mode only delays the cookie: "If the visitor does not grant consent, the tracker will still work and identify companies on your website!" Leadfeeder advises against blocking the whole tracker, since you would see fewer companies (help); under the EDPB reading, blocking it is the conservative setup. Its free Lite plan shows the last 100 companies a month (pricing).

Leadinfo (the Netherlands) identifies companies and offers a "Database with +300M decision makers". It treats the IP address as personal data, hosts on AWS in Ireland, offers "a cookie-free tracking option" and leaves the legal basis to you, while advising: "We also recommend obtaining consent from your website visitors before activating the Leadinfo tracking code" (GDPR page).

RB2B names individuals in the US and companies globally through Demandbase. Its homepage says "Person-Level ID is US-only, GDPR doesn't apply" (RB2B), and its GDPR page says that for global company-level identification "you MUST use a Consent Management Solution" (GDPR page); its help centre advises loading the snippet only after consent where required (help). Two caveats: asked whether it collects EU IP addresses "to know when to fire your script", RB2B calls that collection "incidental"; and the GDPR covers controllers established in the EU "regardless of whether the processing takes place in the Union or not" (Article 3(1)).

Snitcher (the Netherlands) identifies companies and will "surface individual contact details only when you choose to reveal them" (pricing). It relies on legitimate interest under Article 6(1)(f) and hosts on AWS in Frankfurt. Its consent mode delays cookies, not the script: the tracker "does not set any cookies or persistent browser storage until the visitor has given consent" but "only keeps a temporary identifier in sessionStorage" before then (GDPR help).

Warmly names individuals outside Europe and identifies companies in Europe. Customers can "place both the JavaScript and cookie behind a cookie banner" or only the cookie, since "The Warmly JavaScript allows for account identification without dropping a cookie" (compliance).

Comparison table

"Price from" is the lowest listed price for the smallest tier on 15 October 2026. Website visits are one buying signal among several: see our buying signal tools comparison and the intent data guide.

A compliant setup checklist

1. Load the whole script only after consent. Put the tracker, not just its cookie, in your consent tool's analytics or marketing category, and make refusing as easy as accepting. Expect fewer identified companies.
2. Keep EU traffic at company level. Don't switch on person-level features for European visitors, and treat a match to a sole trader as personal data.
3. Sign the DPA and check who controls what. Leadfeeder, Leadinfo and Albacross describe you as controller and themselves as processor; Albacross and Leadinfo also act as controllers when they reuse your visitors' data, so name them in your privacy notice.
4. Update your privacy policy and cookie list. Name the vendor, purpose, data (IP address, pages viewed, cookie IDs), cookie lifetimes and third-party access. Albacross, Leadfeeder, Leadinfo and Snitcher publish sample wording, and RB2B lists what to disclose.
5. Don't email identified people without a lawful basis. Document a balancing test, say where you got the data at first contact, stop on objection and check national rules. Our advice: don't tell a prospect you watched their visit, since you rarely know who it was.
6. Set retention. Decide how long you keep visit data and contacts who never reply, document it (Article 5(1)(e) GDPR) and use the tool's deletion or anonymisation settings, such as Leadfeeder's IP anonymisation.

Common questions

Is website visitor identification legal under GDPR?

Company-level identification can be, if the script runs only after consent, you inform visitors and you have a DPA with the vendor. Person-level identification relies on cross-site tracking, which the EDPB says would hardly pass a legitimate-interest test, and RB2B and Warmly do not offer it in Europe.

Is RB2B GDPR compliant?

RB2B says its person-level ID is US-only, so the GDPR does not apply to it. Outside the US it offers only company-level identification and says you must use a consent tool for it. If your company is established in the EU, the GDPR still applies to your own processing (Article 3(1)).

Is Leadfeeder (Dealfront) GDPR compliant?

Leadfeeder says it is, hosts data on AWS in Ireland and concludes a DPA automatically. Your setup decides the rest: its consent mode delays only the cookie, so the conservative setup blocks the whole tracker until the visitor consents.

How do I identify companies visiting my website in the EU?

Choose a company-level tool that hosts data in the EU (Albacross, Leadfeeder, Leadinfo or Snitcher), load its script through your consent tool, sign the DPA and update your privacy and cookie notices. Follow up only with a documented lawful basis, and test coverage on a free plan or trial first.