Person-Level Website Visitor Identification vs Company-Level

Person-level identification tries to name the individual behind a visit, while company-level identification names only the organisation. Person-level is mostly offered for US traffic, resolves a small share of visitors, and carries heavier legal risk. Company-level covers more regions and is easier to defend, but gives you an account rather than a contact.

What each approach reveals

	Company-level	Person-level
Output	Organisation, often with domain and firmographics	Individual’s name, email, sometimes LinkedIn
Typical coverage	About 20 to 35 percent of B2B traffic (vendor-published)	About 5 to 20 percent of US visitors (vendor-published)
Regions	Global	Mainly US
Privacy risk	Lower	Higher
Typical use	Account alerts, scoring, ABM	Direct follow-up with a named person

The coverage ranges come from BusinessMCP’s visitor identification pages, which also say no vendor identifies every visitor. Treat the percentages as rules of thumb from a vendor, not measurements of every site.

Why person-level is mostly a US feature

The legal reason is simple. Under the vendor’s reading of the law, US regimes such as the CCPA and CPRA and similar state laws are opt-out regimes, so US person-level identification can operate if consumer rights are honoured. The California Attorney General’s CCPA page is the official starting point. In the EU, the same guide says building a profile of a named individual is personal-data processing that typically fails the legitimate-interest balancing test, which is why credible vendors restrict person-level identification to US traffic.

Key takeaway: if a tool offers named individuals for your EU visitors without consent, ask exactly how, and ask for the legal basis in writing.

Tools and where they sit

RB2B is described as person-level for US traffic with alerts sent to Slack, covered in Warmly vs RB2B. Warmly is described as company-level globally with person-level on higher tiers for US traffic. Happierleads is listed as a budget person-level option with US-skewed data, per a comparison of small tools. BusinessMCP is company-level by default, and states that person-level reveal needs your own RB2B or Leadpipe key and covers US only.

Practical considerations beyond the law

Even where legal, person-level outreach has costs. A prospect emailed the same day they viewed a pricing page may feel watched. Data may be stale or wrong, so a message can reach the wrong person. And volume is limited: with US traffic often a small slice of the total, the extra contacts may not justify the extra risk or price.

A balanced approach is to start at company level and add person-level only for US accounts where a rep will genuinely follow up. Our software guide explains product shapes, and the pricing guide shows how the two levels are billed.

If you do use person-level data

1. Restrict it to US traffic, and state that in your privacy policy.
2. Honour opt-outs, including Global Privacy Control signals where state law treats them as binding opt-outs of sale or sharing. See the GPC specification.
3. Suppress opted-out contacts from audience syncs.
4. Keep retention short and documented.
5. Review the setup at least annually, since guidance changes.

BusinessMCP’s guide notes that GPC applies to ad-sharing flows such as conversion APIs and audience uploads, not to first-party analytics, and advises against gating analytics on DNT or GPC. That is the vendor’s view, so confirm it with counsel.

A simple decision rule

Ask three questions. Is more than half of your target market in the US? Do your reps act on a lead within a day? Is your team comfortable defending the practice to a customer who asks? If the answer to any is no, company-level identification is the safer default. If all three are yes, person-level may add value for those accounts. The GDPR article covers the EU side in detail, and BusinessMCP’s Warmly comparison shows how one vendor handles the split. None of this is legal advice.

What to ask a vendor

Request their data sources in plain language, how they handle opt-outs, whether they exclude EU and UK traffic from person-level matching by default, and how they log those exclusions. Ask for a data processing agreement before a trial begins, not after. A vendor that answers these quickly and specifically is usually more trustworthy than one that points you to marketing copy. If you cannot get clear answers, treat that as the answer and use company-level identification only until you can.

Case examples

A US-only SaaS company selling to SMBs. Most visitors are in the US, reps respond within hours and the buyer is often a single decision-maker. Person-level data can shorten the path to a conversation here. Even so, the privacy policy must disclose it and opt-outs must be honoured.

A global B2B firm with half its traffic in Europe. Person-level coverage is limited to the US portion, which might be 5 to 20 percent of total visitors, and then only a fraction of those resolve. The economics rarely justify the effort. Company-level identification across all regions gives more usable signal.

A regulated services firm, such as in finance or health. The reputational risk of naming individuals from a website visit may outweigh any gain. Company-level or form-based identification is the more cautious route, and a lawyer should review any plan.

A founder with a tight budget. RB2B’s monthly billing and alert-first design make a low-commitment trial possible, according to the comparison pages. BusinessMCP’s comparison also notes that a person-level key from RB2B or Leadpipe can be connected for US reveal, which is a way to combine company-level coverage with a limited US person-level layer.

Questions to ask yourself

• Would I be comfortable explaining this practice to the person identified?
• Does my team have the capacity to follow up personally within a day?
• Can I show where the vendor’s data comes from?
• Is my US share large enough to matter?
• What happens if a visitor asks me to delete their data?

If the answers are uncertain, start at company level and add person-level data later. You can always add a layer, and removing one after a complaint is harder. Our match rate article explains why the extra coverage from person-level data is limited in any case.