Website Visitor Identification Platforms: Anonymous Traffic Unmasking, the Resolution Stack and What an Unmasked Visit Proves

Website visitor identification platforms unmask anonymous traffic by taking the facts a page load leaves on your own site (a source IP address, a cookie or device identifier, the page path and the time) and resolving them against an identity database to a company and, on some platforms, to a named person. The visit is a recorded first-party fact. The identity is an inference that carries a confidence. Any intent read from it is a second inference built on the first. This guide keeps the three apart: it names the layer that produced each identity, puts six platforms through one rubric, lists every published match rate with its denominator, and states where an unmasked visit stops being a signal and starts being proof.

Website Visitor Identification Platforms: Anonymous Traffic Unmasking in Short

• The signal type is first-party and observed, with a third-party identity attached. Among the sources compared in how intent data sources differ, website identification is the only one you observe on your own property. The identity, however, comes from the vendor's graph, and Demandbase's own help centre calls its model "probabilistic".
• Company-level and person-level are different products. Company-level resolution matches an IP address to an organisation's network (6sense, Demandbase, Leadfeeder, and Unify through its reveal providers). Person-level resolution matches a cookie, device or e-mail-pixel identifier to a contact record (Warmly, RB2B). RB2B states that its person-level product is "US-Only".
• An unmasked visit is a signal, not proof. Proof of purchase intent is a declared act: a form, a demo request, a trial started with a work e-mail, a reply. The Five-Gate Visit Test below states what a visit has to pass before a rep acts on it, and the Resolution Stack states which layer can ever deliver proof.
• Published match rates do not compare across vendors. The figures read for this guide run from "about 20 percent of B2B traffic" (Demandbase, client-side) to "70-80%" (RB2B with Demandbase). They count different things over different bases. The Denominator Check table lists each claim with its stated unit.
• Identity is not permission. GDPR Recital 30 names "internet protocol addresses, cookie identifiers" as online identifiers; the UK's PECR regulation 6 restricts storing or reading information on a user's device; the CCPA lists an "Internet Protocol address" among personal-information identifiers. Resolution answers who. It does not answer what you may do next.

What an unmasked visit is made of: the Resolution Stack

Every identified visit was produced by one of three layers, and the layer decides how much the identity can bear. The stack below is the device this guide uses to label a reveal; write the layer next to the account or person name before anyone acts on it.

Three points follow from the table.

1. The Network layer names a building, not a person. 6sense's anonymous-visitor page says it plainly: "6sense can identify which companies are visiting your site, even if the individual visitors remain anonymous." Leadfeeder: "Individual visitors are not shown by default." A company-level reveal tells you that somebody on that organisation's network read your pricing page. Who, and in what role, is still open.
2. The Graph layer is a probability, and the vendors say so. Demandbase's FAQ describes "a probabilistic AI model atop a vast identity graph" and adds that "probabilistic models involve some margin of error". A person-level reveal should arrive with a confidence value; if a platform does not expose one, the pilot should ask for it before the contract does.
3. Only the Declared layer is proof. Everything above it is inference about identity, and the intent read is inference about inference. That is the reason the next section exists.

Signal or proof: the Five-Gate Visit Test

A buying signal is an observation consistent with buying and also consistent with other explanations. Buying signals vs intent data sets out that distinction across sources; an unmasked visit sits firmly on the signal side, because both the identity and the motive are inferred. Proof of purchase intent is a declared act whose plainest explanation is an intention to buy: a demo request, a trial activated with a work e-mail, a reply that asks a question, a procurement notice. No visitor identification platform can turn a visit into proof. What it can do is tell you which visits deserve the attention that leads to a declaration.

The Five-Gate Visit Test is the sort this guide applies before a reveal reaches a rep. A visit passes to the next-action map only when all five gates pass.

The test does not invent a window or a threshold, because the right values depend on your sales cycle and on the confidence field your vendor exposes. It does insist that each value be written down before the pilot starts, so that the pilot measures the platform and not the enthusiasm of the week it ran.

Six platforms, one rubric

The brief for this guide named 6sense, Demandbase, Leadfeeder, Unify, Warmly and RB2B. Each row below was filled from the vendor's own page on October 11, 2026, and a cell reads "Not described" when the page did not say. Quotations are verbatim; everything else summarises the page. No row is ranked, and no figure has been audited.

Lead Seeker is not in the table because it is not a website visitor identification platform; the section near the end states what it does instead. For a wider field, the ranking pages read on the day (RevPartners lists six tools, AiSDR nine) add Vector, HubSpot Breeze, Artisan, Leadinfo, Factors.ai, Albacross, ZoomInfo WebSights, Leadlander and Swan; none of those pages was treated as a primary source for any vendor row.

The Denominator Check

Every match-rate figure read for this guide is reproduced below with the unit its publisher attached to it. The table exists because the numbers are routinely quoted side by side as if they measured the same thing.

No two rows share a numerator, a denominator and a geography. The only comparison that holds is a pilot on your own traffic, with each vendor's confidence field exported alongside the reveal, scored against the Declared-layer identities you already hold.

From an unmasked account to a next action: ICP, timing, contact relevance

A reveal that passes the five gates still has to be turned into a decision about one account, one window, one person and one move. The Account-to-Action Map is the second device in this guide. Each row starts from a visit pattern that has already passed the gates.

Two house rules sit under the map. First, the message references the public trigger, never the page the person read, because the visit was never declared to you. Second, "contact relevance" is a test of the person against the pages, not a search for any e-mail at the domain. A programme that joins first-party visits to third-party topic signals and public triggers in one qualification step is what Percepture's B2B intent data services are built for; the primer on what is B2B intent data sets the vocabulary, and intent data to identify sales qualified leads walks the qualification step itself. For how account-level scores are assembled before any visit is attached, see account intent data and how intent data is collected and scored. The vendor field for the third-party side is covered in best intent data providers.

Evidence table: source, timestamp, confidence

Every material claim in this guide is listed with where it came from, the date shown on the source, when it was read, and the confidence this guide assigns to it. "Recorded" means a verbatim statement from the source. "Vendor claim" means a figure published by the party it favours and not audited here. "Survey" means a self-reported result. "Statute" means the legal text as published.

Where identification fails: addresses, browsers and borders

The vendor pages and the platform documents read for this guide name the conditions under which the Network and Graph layers return nothing or return the wrong thing. They are listed here because a pilot that does not segment by them will blame the vendor for the network.

• Dynamic and shared addresses. Leadfeeder states that people working remotely use dynamic IP addresses "that change ownership" and are "more difficult to track". Demandbase lists "Shared IP usage, for example in India" among the reasons its coverage is limited in India, the Middle East and APAC, and notes that its model was adjusted "to account for shared IP addresses among remote workers" during the 2020 lockdowns.
• Mobile and cellular traffic. Demandbase explains that LinkedIn ad engagement is "primarily mobile (about 80 percent)" and that mobile traffic "especially on iOS or cellular networks, is harder to identify" because of limited cookie usage and unknown or shared IP addresses.
• iCloud Private Relay. Apple's support page describes two relays: the second "generates a temporary IP address, decrypts the name of the website you requested, and connects you to the site." A Safari visitor with Private Relay on reaches your Network layer with the relay's address, not their employer's.
• Chrome IP Protection. Google's page says the feature "enhances Incognito mode's cross-site tracking protections, by masking a user's original IP address in third–party contexts" for domains on its Masked Domain List, and that it "will not apply in a first-party context". On a plain reading, a vendor script that calls its own domain from your page is a third-party context; whether any particular vendor domain is on that list was not checked for this guide.
• VPN and zero-trust egress. Demandbase lists "public VPN and ZTNA providers" among the data points in its identity graph, which is the vendor's way of saying that traffic from those egress addresses is recognised as such rather than attributed to the provider's owner.
• Building your own lookup. ARIN's Whois Terms of Use prohibit using the service "for advertising, direct marketing, marketing research or similar purposes". A reverse-IP lookup assembled from registry Whois for sales use sits outside those terms; the vendors above describe their own maintained databases instead.
• Reach. A visitor identification platform sees only the traffic that already found you. Discovery of accounts that have never visited belongs to the sources in how intent data sources differ.

Identity is not permission: the statutory text that attaches

This section restates the texts that were fetched for this guide and nothing beyond them. It is not legal advice; the practical comparison of vendor positions lives in B2B data provider compliance.

• GDPR. Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person", including identification "by reference to an identifier such as a name, an identification number, location data, an online identifier". Recital 30 states that natural persons "may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers", and that such traces "may be used to create profiles of the natural persons and identify them." On a plain reading, the identifiers a tag collects on your site fall inside that text whether or not the vendor ever returns a name.
• PECR (United Kingdom). Regulation 6(1): "a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user", subject to Schedule A1 exceptions. Regulation 6(2) adds that this includes "instigating the storage or access". The EU ePrivacy Directive's parallel text was not fetched for this guide and is not quoted.
• CCPA (California). Section 1798.140(v)(1)(A) lists among personal-information identifiers "online identifier, Internet Protocol address, email address", and subdivision (ak) defines a unique identifier to include "an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology" and "other forms of persistent or probabilistic identifiers".
• What the vendors publish about their own position. Leadfeeder: company-level only, "processed in line with GDPR". RB2B: person-level "US-Only", company-level global with "consent capture" required under GDPR, "CCPA compliant". Swan's data-privacy documentation: "in jurisdictions with cookie-consent requirements you should include the Swan tracking script in your site's consent flow." 6sense: "obtain consent where necessary and provide clear opt-out options." Demandbase: no IP addresses shown "even for accounts that have been identified through engagement". Each of those is the vendor's statement about itself, recorded here, not endorsed.

The order of the Resolution Stack is also the order of exposure. A Network-layer company name attaches the least personal data to a record; a Graph-layer person name attaches more than that without any declaration; the Declared layer is the one where the person knows you know.

A worked example (invented)

Brannock Cold Chain, an invented company, sells temperature-monitoring software to food distributors and runs a company-level identification platform on its site.

On Tuesday the platform reveals Vexley Foods Distribution, an invented account inside Brannock's ICP, with three sessions across two days on the pricing and integrations pages from two cities, and the vendor's confidence field reads high. Gate 1 passes (Network layer, confidence shown), gate 2 passes (evaluation pages), gate 3 passes (three sessions), gate 4 passes (inside the window Brannock wrote down), gate 5 passes (not a customer, supplier or competitor). The reveal is a qualified signal. It is still a building. Contact relevance begins with the pages read: pricing and integrations point at the person who owns operations tooling, so the rep checks public triggers at the account and finds a Director of Cold Chain Compliance role posted twelve days earlier. The first line goes to the vice-president of operations and references the posted role, not the visits.

On Thursday a second, person-level platform names an operations analyst at Vexley from the Graph layer, confidence shown. The title does not own the decision, so the analyst is treated as a door: added to the account record, not sequenced. On Friday the vice-president submits a demo request. That is the Declared layer, and the first proof the account has produced. Three days, three layers, one message sent.

Where Lead Seeker fits

Lead Seeker does not identify anonymous website visitors and installs no pixel; nothing on its product pages describes visitor identification, and this guide makes no such claim for it. It works from the other end of the map. You describe the accounts and roles you sell to and it returns verified decision makers at those accounts, each with "the public signal that surfaced the person" and "the freshness date stamped on the record" (Prospect Dossier page), re-verified "the moment you run the search" (Try free page). The signals it monitors are public buying events in six families: hiring, funding and financial events, tech stack changes, public statements, product and GTM moves, and operational stress; the catalogue is described under buying-signal coverage in the platform. The Try free page describes the data as "Public, source-linked information surfaced at search time. GDPR and CCPA compliant."

In the Account-to-Action Map, that is the step after a company-level reveal passes the gates: the visitor-ID platform names the network, Lead Seeker supplies the people in the roles that own the pages read and the dated public trigger the first line can reference. Pricing was not material to this guide and is not quoted; the live page is at transparent monthly pricing.

Frequently Asked Questions

Is there a way to see who visits your website?

At company level, yes, within limits: website visitor identification platforms match the IP address of a page load to an organisation's network and report the company, the pages and the time. At person level, some platforms match cookie, device or e-mail-pixel identifiers against an identity graph and return a name; RB2B states that its person-level product covers United States visitors only, and Demandbase describes its own model as probabilistic. Neither level sees visitors whose address is dynamic, shared, relayed or masked, and neither level is a declaration by the visitor.

How can I identify anonymous website visitors without a form?

Install a vendor's tag and let it resolve traffic through the Network layer (IP address to organisation) or the Graph layer (cookie or device identifier to person), then label every reveal with its layer and the vendor's confidence value. Run the Five-Gate Visit Test (resolution, page, breadth, recency, exclusion) before anything reaches a rep. Measure the result against the identities you already hold from forms, trials and logins, which is the only ground truth available to you.

What is the difference between company-level and person-level visitor identification?

Company-level identification infers the organisation behind an IP address; 6sense, Demandbase and Leadfeeder describe it, and Leadfeeder states that "Individual visitors are not shown by default." Person-level identification infers the individual behind a cookie, device or e-mail-pixel identifier using a third-party identity graph; Warmly and RB2B describe it. The two differ in what they can name, in how they fail (shared addresses versus blocked cookies and geography) and in the personal data they attach to a record before anyone has declared anything.

Is a pricing-page visit proof of purchase intent?

No. A pricing-page visit is a buying signal: an observation consistent with evaluation and also with benchmarking by a competitor, a journalist, a job candidate or a current customer. Proof of purchase intent is a declared act, such as a demo request, a trial started with a work e-mail or a reply. A visit that passes the Five-Gate Visit Test earns research and a well-timed, trigger-based touch; it does not earn a message that cites the visit.

Is website visitor identification legal under GDPR and CCPA?

The statutes fetched for this guide do not mention visitor identification by name; they define the data it handles. GDPR Recital 30 names "internet protocol addresses, cookie identifiers" as online identifiers and Article 4(1) brings online identifiers inside personal data; PECR regulation 6 restricts storing or accessing information on a user's device; the CCPA lists an "Internet Protocol address" among identifiers. Vendors publish their own positions (Leadfeeder company-level under GDPR; RB2B person-level US-only; Swan asks that its script sit in the consent flow). Whether a given deployment is lawful turns on the layer used, the geography of the visitor and the consent and lawful basis recorded on your site, and that question belongs with counsel.

Which website visitor identification platform should a team choose?

Decide the layer first. A team that needs the account and not the person can pilot a company-level platform (6sense, Demandbase, Leadfeeder, or Unify through its providers) and judge it by the share of its own known accounts it recognises. A team that wants names in the United States can pilot a person-level platform (Warmly, RB2B) and judge it by precision against Declared-layer identities, with the confidence field exported. In both cases, score the pilot with the Denominator Check: the published rates in this guide count different things over different bases and cannot be compared to each other.

Sources

• 6sense, Anonymous Website Visitor Identification, platform page listed as March 12, 2025 in search results: identification methods, the company-level statement, the form-fill figures and the legal-considerations section. Read October 11, 2026.
• 6sense, The Science of B2B: Buyer Identification Benchmark, Kerry Cunningham, dated January 1, 2024: 546 marketers surveyed in late 2023, average form-fill rate 3.7 percent, 72 percent prioritising accounts with multiple leads. Read October 11, 2026.
• Demandbase, Account Identification and FAQs: Account Identification: methods, graph data points, the client-side 20 percent figure, regional coverage, the IP-address policy and the mobile-traffic explanation. Read October 11, 2026.
• Leadfeeder (Dealfront), Website Visitor Identification Software: IP-based recognition, the 45 percent figure, the company-level and GDPR statements, database churn and the remote-work note. Read October 11, 2026.
• Unify, Website visitor intent documentation: Unify Reveal providers, event sources and identify events. The marketing page "Website Visitor Identification: How It Works & Real Match Rates" returned a waitlist form and was not read. Read October 11, 2026.
• Warmly, Website Visitor Identification Software: session data captured, matching methods, the 220M+ figure, the 97 percent and 9 million statements. Read October 11, 2026.
• RB2B, home page: the 70-80 percent statements, the compliance paragraph, the FAQ on use outside the United States and the plan details. Read October 11, 2026.
• Swan, Data privacy documentation: the IP-and-cookie basis and the consent-flow instruction. The Swan solutions page listed by Google returned a 404 on the day. Read October 11, 2026.
• Ranking pages read for the exact phrase on October 11, 2026 (08:39 UTC, logged-out US Google; no AI Overview was shown): Vector, How to identify anonymous website visitors, May 14, 2025; RevPartners, Best Website Visitor Identification Software for B2B, January 29, 2026, updated August 13, 2026; LeadPost, Identify Anonymous Website Visitors, undated; AiSDR, How to Turn Website Visitors into Sales-Ready Leads, May 8, 2026. The Untitled AI result returned a country-block page and was not read.
• GDPR, Article 4, Definitions and Recital 30, via gdpr-info.eu. Read October 11, 2026.
• The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6, legislation.gov.uk. Read October 11, 2026.
• California Civil Code, section 1798.140, leginfo.legislature.ca.gov, text current as of January 1, 2026. Read October 11, 2026.
• Apple, About iCloud Private Relay, published August 31, 2023. Read October 11, 2026.
• Google Privacy Sandbox, IP Protection, last updated October 27, 2025. Read October 11, 2026.
• ARIN, Whois Terms of Use. Read October 11, 2026.
• Lead Seeker product pages: Prospect Dossier, Trigger Signals, How it works and Try free, quoted as published on October 11, 2026.

About the Author

Bob Generale is President of Percepture. He works across SEO, AI search, digital PR, sales intelligence and AI-powered revenue systems, with a focus on connecting visibility, buyer intent and sales action.

Next Steps

Export last week's reveals with the vendor's confidence field, write the Resolution Stack layer next to each one, and run the Five-Gate Visit Test before any of them reaches a rep. For the accounts that pass, pair the network with a person and a dated public trigger: see how Lead Seeker works end-to-end, or claim 5 free verified leads and compare the people it returns against the roles your pricing page was read by.