A demo of one of these tools looks like magic. Company names scroll past, each one tied to a page on your site. The rep asks how many of those you would have called.
Then you buy it and open your own account.
The list reads Spectrum, Verizon and a regional hospital.
You can see who visited your website in one narrow sense. What you get is the company that owns the network. And only when your visitor sat on a network worth owning.
We look at these tools with clients most months.
The gap between the demo and the live account is worth ten minutes of your time. Let's take the mechanism apart.
Can you see who visited your website?
No tool hands you a visitor's name from a plain, anonymous visit. What the category sells is company-level matching. Three different questions hide inside the one everybody asks.
Work out which one you are asking.
- Which companies looked at us? Answerable sometimes, through the network the visit came from.
- Which named person looked at us? Never answerable from an anonymous visit, at any price.
- Which of my known contacts came back? Answerable, if they arrived through a tagged link or signed in.
The third question gets skipped in every demo. It is also the one that pays.
A prospect who clicked the link in your proposal email deserves more attention than a stranger on a big corporate network. Answering that depends on lead source tracking being wired up first, which costs far less than a yearly contract. It also depends on your conversion path giving people a reason to leave a name at all.
What do visitor identification tools match?
They compare the visitor's IP address against a database of address blocks and the firms that registered them. The method is reverse IP lookup. It names a network rather than a human being.
The internet's own standards body settled how well that holds up. RFC 6269, the IETF paper on address sharing, puts it plainly.
"Where one public IPv4 address is shared between several subscribers, the IPv4 address no longer uniquely identifies a subscriber."
Sit with that beside a sales demo. The standard says one address may fail to pin down even the billing account. The product is sold on pinning down the person browsing.
| Method | What it identifies | Where it breaks | Honest use |
|---|---|---|---|
| Reverse IP lookup | The organisation that registered the address block | Home broadband, mobile data, coworking, VPNs | Selling to large firms with their own networks |
| Third-party cookie matching | A device seen earlier on another site | Safari and Firefox block it by default | Retargeting ads, rather than identification |
| Form or login capture | The actual person, by their own decision | Only works after they choose to tell you | Every business, and it is the reliable one |
| Email link tracking | A contact already on your list | Useless for strangers | Following up people you know |
| Person-level data matching | A claimed name from a broker's file | Accuracy is unverifiable from your side | Very little a regulated firm should touch |
Notice which row carries no catch. The only method that returns a real person is the one where the person chooses to become one.
Why does this work for some firms and fail for others?
Everything turns on who sits at the other end. A software company selling to buying teams gets useful matches. Those visits arrive from an office network registered to the employer.
A wealth manager does not. Neither does an accountant.
Their buyer reads your site from a sofa on a Sunday. Or from a car park between meetings. Both of those lines belong to a phone company.
Two numbers explain the whole gap.
- 179 to 207 km: The median error a May 2026 location accuracy study found on mobile networks, across MaxMind GeoLite2, IPinfo, IP2Location and DB-IP.
- 3 to 16 km: The same error on fixed lines, in the same test.
That measures place rather than name. It still tells you plenty about names. A database that cannot find a phone inside 180 km will never find the household.
The traffic that gets matched
- Staff at firms big enough to run their own registered network.
- Schools, hospitals, government offices and large public companies.
- Anyone on a work VPN that exits through the employer.
The traffic that does not
- Home broadband, which returns the provider's name every time.
- Mobile data, which returns a carrier and a rough city.
- Serviced offices and coworking floors, which return the building operator.
| Visitor situation | What the address resolves to | Any use to you |
|---|---|---|
| Employee at a 200-plus staff firm | The employer's registered name | Yes, if you sell to firms that size |
| Someone at home on cable or fibre | The internet provider | None |
| Someone on a phone using mobile data | A carrier, placed up to 200 km out | None |
| Coworking or serviced office | The building operator | None |
| Visitor on a VPN or proxy | Wherever the exit point sits | None, and it can mislead you |
| Safari user with Apple's private relay on | A relay address chosen by Apple | None |
Count how many rows describe your last ten enquiries.
For most firms we work with, one row applies. It is not the first one.
What is Google Analytics allowed to show you?
Nothing about identity. The block is written into the contract rather than the code.
Google's policy on personally identifiable information is direct about it.
"no data be passed to Google that Google could use or recognize as personally identifiable information (PII)"
Names, email addresses and social security numbers are listed as examples. So is any location finer than one square mile.
Anyone who claims they can pull visitor names out of your analytics is describing something the account holder is banned from putting in there.
What GA4 does give you is real. Most owners never open it.
- Device and network: Whether the session came from a phone, and roughly what kind of line.
- Place: City and country, at a level useful for staffing rather than selling.
- Source: The search, the referral or the campaign behind the visit.
- Behaviour: Which pages held attention and which lost it.
Those four answer more business questions than a company-name feed does. If you are unsure which website performance numbers deserve weekly attention, start there. The same report is where AI referral traffic shows up.
What is changing that makes this harder every year?
Browsers have started hiding the number the whole method depends on. Google's IP Protection says so in one line.
"IP Protection anonymizes the user's IP address, to help protect it from potential cross-site tracking."
It runs in Incognito. It applies to third-party requests, and tracking scripts are third-party requests.
- Today: A slice of your visitors already arrive with a masked or shared address.
- Next year: That slice grows, because every browser maker is moving the same way.
The direction runs one way. A three-year contract is being priced against a signal that keeps thinning.
How do you test this on your own traffic before you pay?
Run the check on your data before a rep runs it on theirs. Twenty minutes, no cost.
- Open Google Analytics, go to Reports, then Tech, and read the device split for the last 90 days. Write down the mobile share.
- Pull your hosting logs and list the top 50 visiting networks. Count how many are consumer phone and cable brands.
- Take the free trial. Let it run 30 days without acting on a single name.
- Export the matched list. Delete every phone company, every cable brand, every school, every hospital and every government office.
- Count what survives. Divide the yearly price by that number.
Step four is where most trials fall apart. No vendor walks you through it, because the sorted list is a far weaker sales document than the raw one. Step two earns its place too. It flushes out bot traffic, which pads every matched list we have audited.
A four-partner advisory firm on Long Island brought us this exact contract last spring, at $4,800 a year. Over three months it named 212 companies across 6,900 sessions. When we sorted the export, 168 of those names were phone and cable brands, a hospital system, two schools and a county office. Nine were real firms. All nine turned out to be vendors pitching them, and none of it produced a client.
Our limit, stated plainly. We will not recommend one of these tools before pulling 90 days of your own device and network data. We have talked two firms out of the contract this year. We also cannot check a broker's match accuracy from outside, so we treat person-level claims as unproven rather than false.
What should a professional-services firm do instead?
Spend the budget on making the visitor want to be known. It converts better than watching, because a name given freely comes with intent attached.
Three changes do most of the work.
- Give the page a reason to act: A fee range, a checklist or a real answer beats a contact form sitting under a paragraph of positioning.
- Shorten the distance: A multi-step form asks less on the first screen and finishes with more than one long one.
- Tag every outbound link: Newsletter, proposal, signature and social links should all carry parameters, so returning contacts stop hiding inside Direct.
Firms that stall here often have a different problem underneath. When traffic arrives and nobody makes contact, the gap is rarely anonymity. The check for website enquiries that never appear starts somewhere else, and publishing your fees reveals serious buyers faster than any script.
When is a visitor identification tool worth buying?
There is a real case for it, and skipping that would be dishonest. These tools work as built when four things are true at once.
- You sell to firms large enough to run their own registered networks.
- You already do named-account outbound and want timing signals.
- Your deal size supports a call placed on a maybe.
- Somebody owns the list and acts on it within a day.
If two of those four are false, you are buying a report nobody opens.
Which number decides it for you?
Two figures settle this. Both sit in analytics you already pay nothing for.
- Mobile share of sessions: Above half, and reverse IP has lost most of your audience.
- Consumer networks in your top 50: Above thirty, and the matched list will be mostly phone brands.
Run both before your next renewal call. If you would rather have someone read them with you, our free SEO audit starts from your own analytics rather than a product pitch.
Frequently Asked Questions
Do these scripts slow a website down?
Each one adds a third-party request on every page load. On a site already carrying chat, ads and heat mapping, the delay becomes measurable. Audit total script weight first.
What should we check in the contract before signing?
Look for the auto-renewal window, the export rights on your matched data, and whether the match rate is guaranteed or merely shown. Numbers displayed during a demo carry no weight in the contract, and the trial account is rarely the account you end up with.
Will our own staff appear in the matched list?
Almost certainly, and they usually sit at the top. Your office network resolves to your own firm name. Exclude your address ranges during setup, or you will spend a quarter admiring your own browsing.
Can we see who visited from a LinkedIn post?
LinkedIn reports interest on the post itself, including viewer job titles in grouped form. Once someone clicks through to your site, that identity does not travel with them. The two sets of data never join up.
What about visitors who arrive from ChatGPT?
Those sessions land as referrals from an AI domain, and the person behind them stays anonymous exactly as with search. Chatbot traffic also skews toward personal phones and laptops, which makes network matching weaker rather than stronger. Treat it the same way.