GDPR and Anonymous Website Visitor Identification

Anonymous visitor identification at company level can generally rest on legitimate interests under GDPR Article 6(1)(f), if you disclose it, document a balancing test and sign a processor agreement. Person-level identification of EU visitors without consent is much harder to defend. This article is general information, not legal advice.

The core distinction

GDPR protects individuals. According to BusinessMCP’s visitor identification GDPR guide, facts about a company fall outside its core scope unless tied to an identifiable person. That is why the vendor concludes company-level identification is generally defensible and person-level identification of EU visitors without consent is not. The page itself says it is informational and written by a vendor describing its own posture, so read it alongside the primary sources below.

Two details complicate the neat picture. The guide says an IP address is personal data while it is being processed, so retention matters. And a company match is still produced from an individual’s visit, so the processing is not free of obligations.

Which legal basis fits

Article 6 of the GDPR lists six bases. The vendor’s guide assesses their fit for anonymous visitor identification.

Basis	Fit for anonymous identification
Consent	Impractical for visitors you cannot yet contact
Contract	No contract with anonymous visitors
Legal obligation	Not applicable
Vital interests	Not applicable
Public task	Not applicable to commercial analytics
Legitimate interests	The usual basis for company-level identification, with a documented assessment

What a legitimate interest assessment involves

The UK regulator’s legitimate interests guidance describes a three-part test: identify a legitimate interest, show the processing is necessary for it, and balance it against the individual’s interests and rights. The European Data Protection Board has published guidelines on Article 6(1)(f). A short written assessment for visitor identification would cover why you need it (for example, prioritising sales follow-up), why company-level data suffices, what data you keep and for how long, and what a visitor would reasonably expect.

Key takeaway: keep identification at company level, keep retention short, write the assessment down, and tell visitors in your privacy policy. Those four moves cover most of the ground.

Cookies and device storage

Separate from GDPR, ePrivacy rules govern storing or reading information on a visitor’s device. The vendor’s guide says non-essential identifiers generally require consent, that cookieless tools may avoid the trigger, and that a persistent cross-site ID kept in localStorage counts as a cookie. Leadfeeder is described on a comparison page as cookie-based with consent required in the EU, whereas BusinessMCP describes itself as cookieless and GDPR-first. Check each vendor’s documentation yourself, and see our Leadfeeder alternatives article.

What to document

1. Privacy policy. Disclose the visitor-identification service, the data involved, retention periods, your legitimate-interest basis and how to object.
2. Data processing agreement. Article 28 requires a contract with processors. Ask each vendor for theirs.
3. Legitimate interest assessment. One to two pages is enough for company-level use.
4. Record of processing. Add this flow.
5. Transfers. Confirm safeguards such as SCCs or adequacy for non-EU transfers.
6. Retention. Set a deliberate limit rather than defaulting to forever.

BusinessMCP lists a DPA page and a GDPR page for its own service, which is the kind of public paperwork to look for from any vendor.

Person-level and US traffic

For person-level identification, the guidance we reviewed suggests restricting it to US traffic, where opt-out regimes apply, and stating this in the policy. Our article on person-level versus company-level identification goes through the details.

Practical vendor questions

Ask whether EU traffic is excluded from person-level matching, where data is processed, how long raw IPs are kept, and whether the vendor offers a DPA by default. Ask what happens to your data on cancellation. BusinessMCP’s pricing page says data is kept when a workspace drops to Free and that export is available on every plan, which is a good model for what to expect. Our software buyer’s guide includes these questions in a checklist.

Limits of this article

Law and enforcement shift, interpretations vary between countries, and a vendor’s description of its own compliance is self-reported. Use this piece to prepare questions for your lawyer or data protection officer, not to replace them.

A short pre-launch checklist

Before the script goes live, confirm that your privacy policy mentions it, that the DPA is signed, that the assessment is on file, that retention is set, and that someone owns the annual review. Test the opt-out path too: if a visitor objects, you should be able to suppress their data. If any item is missing, delay the launch by a day and fix it. That day costs far less than a complaint.

How this applies to a comparison of tools

Compliance should be part of any tool comparison, not an afterthought. When you are weighing alternatives to a platform such as Warmly, add three lines to your scorecard: tracking method, treatment of EU traffic, and paperwork the vendor provides. BusinessMCP’s Warmly comparison lists the vendor’s own claims here, describing its tracking as cookieless and GDPR-first and noting that Warmly is also described as cookieless and GDPR-first for company-level identification, with US person-level on higher tiers. Those descriptions are marketing statements, so verify them in each vendor’s documentation and DPA.

Common mistakes

Mistake	Why it is a problem	Better approach
Switching on a tool before updating the privacy policy	Visitors are not told	Update the policy first
No DPA with the vendor	Article 28 expects a processor contract	Sign it before the trial
Treating IP data as non-personal	The guide we reviewed says it is personal data while processed	Set short retention
Enabling person-level matching globally	Hard to defend for EU visitors	Restrict to US, or skip it
Relying on a vendor’s compliance claims alone	Claims are self-reported	Ask for documents and read them
Never reviewing	Guidance and enforcement change	Schedule an annual review

When to involve a lawyer

Seek advice if you operate in regulated sectors, process traffic from several jurisdictions with different rules, plan to combine identification with outreach to named individuals, or have received a complaint. A data protection officer can also help you write the assessment. Compare practical expectations in our article on person-level identification and see the switching guide for how to carry compliance paperwork across when you replace a vendor.