GDPR-Compliant Website Visitor Tracking: A Practical Guide

GDPR-compliant visitor tracking depends on what you collect, your lawful basis and how you handle cookies under ePrivacy rules. Company-level identification from network signals is generally lower risk than person-level reveal, but nothing is automatically compliant. This is general information, not legal advice, so confirm your setup with a qualified adviser.

Three separate rules people blur together

Teams often say “GDPR” when they mean three different legal layers.

1. ePrivacy and cookie rules. These govern storing or reading information on a visitor’s device. In the UK, the ICO publishes guidance on storage and access technologies. EU countries implement the ePrivacy directive nationally, so details differ.
2. GDPR lawful basis. Processing personal data, which can include IP addresses, needs one of the bases in Article 6, such as consent or legitimate interests, plus transparency and data subject rights.
3. Direct marketing rules. What you do after identification, such as emailing a named contact, falls under separate rules about consent and opt-out.

Mixing these up leads to two errors: assuming no cookies means no obligations, and assuming a consent banner solves everything.

Company-level versus person-level

The legal risk profile changes sharply with what the tool reveals.

Approach	What it identifies	Typical risk level	Notes
Company-level from network signal	The organisation behind a network	Lower, still needs transparency	Home and mobile visitors resolve to providers
Email-domain stitching after form fill	Company, via a voluntary disclosure	Lower	Visitor supplied the address
Person-level reveal	A named individual	Higher	BusinessMCP calls EU use without consent indefensible
Cross-site tracking via cookies	Browsing across sites	Highest	Consent central

BusinessMCP’s guide describes person-level resolution as US-only and says EU person-level identification without consent is not legally defensible. Its Leadfeeder comparison adds that its own person-level reveal works only if you connect your own RB2B or Leadpipe key, US-only. We cannot verify every legal claim, so this is a reason to ask, not a legal conclusion.

Key takeaway: the more specifically a tool identifies a person, the more consent and justification you need. Company-level data from a network signal sits at the cautious end of the spectrum.

Cookies and the consent trade-off

BusinessMCP’s comparison describes Leadfeeder as cookie-based and requiring consent in the EU, and BusinessMCP as cookieless and GDPR-first. The practical consequence is about data volume: if a visitor declines the banner, a consent-gated tracker never loads, so those visits stay anonymous.

A cookieless tracker can still see the visit, but that does not exempt you. You must still tell people what you collect and why, and decide whether your basis for processing network addresses stands up. Some regulators treat device access and IP processing differently, so check your national authority.

The business effect is concrete. If your European audience declines banners at high rates, a consent-dependent tool under-reports. If you choose a cookieless one, you trade some cross-session recognition for broader coverage. Neither is free of obligations.

A vendor checklist

Ask each provider the following and keep the answers.

• Does the tracker set cookies or use local storage, and is consent required?
• What data is processed: IP address, user agent, pages viewed, email?
• Where is data stored and for how long?
• Is there a data processing agreement and a published sub-processor list?
• Is person-level data offered, where, and on what basis?
• How do visitors opt out, and how are deletion requests handled?
• What does the vendor say about EU and UK visitors specifically?

BusinessMCP lists privacy, DPA and GDPR pages on its site, which is the kind of documentation to look for, but read the documents yourself.

What to do on your side

• Update your privacy notice to name the tool category, purpose, basis and retention.
• Record your decision. Keep a short note on why you believe your basis holds.
• Limit what reaches sales. Passing company names to sales is different from passing personal contact data.
• Respect opt-outs. Make sure suppressions apply across your tools.
• Review when you add features. Turning on person-level reveal or ad-audience export changes your risk.

Where this connects to buying decisions

Privacy approach is a legitimate reason to compare tools, as covered in our list of Leadfeeder competitors. It also affects measured volume, which feeds into cost per useful lead in our worth-it framework.

What we cannot tell you

We are a publication, not a law firm. Rules differ by country, change over time and depend on facts about your business. A company-level, cookieless setup can be a reasonable choice, but only your adviser can tell you whether it is right for you. Start with your national regulator’s published guidance, document your reasoning and revisit it whenever your tooling changes.

Documents worth having on file

A small compliance folder protects you more than any single technical choice. Keep a short record of processing that names the tool, the data it handles and your reasoning for the lawful basis. Keep the vendor’s data processing agreement and sub-processor list. Keep a copy of your privacy notice as it read on the date you switched tracking on, and a note of how a deletion or objection request would be handled in practice.

Review the folder when something changes: a new region of traffic, a new feature such as ad-audience export, or a vendor change of sub-processors. Also check whether your analytics tool and your identification tool both run, since two scripts mean two sets of obligations.

If your use case includes outreach to people at identified companies, read the vendor’s own privacy material as well, for example BusinessMCP’s visitor identification page, which describes company-level matching and the US-only limit on person-level reveal. Use it as a question list for your adviser, not as proof that your setup is compliant.