B2B company identification and permission-based B2C location insight
Our software helps organisations understand where interest in their websites is coming from without attempting to reveal the identity of individual website visitors. It supports two distinct forms of insight, each designed for a different type of website and business purpose.
| For B2B websites | For consumer-facing and local-service websites |
| The software checks an IP address against a database of known business networks and may identify the company or organisation associated with the visit. | The software asks the visitor to share the current location reported by their device through the browser’s standard permission process. |
| It does not identify which person within that organisation visited. | The location may range from approximate to exact or near-exact, but it does not identify the visitor or establish that the location is their home. |
Part 1: B2B company identification
How B2B company identification works
When somebody visits a website, their internet connection sends an Internet Protocol address, usually known as an IP address, as part of the ordinary technical process needed to retrieve and display the website.
Our B2B software takes that IP address and checks it against a database of networks associated with businesses and other organisations. Where a suitable match can be made, the software may identify the company or organisation associated with that internet connection.
The website operator may then see information such as:
- the possible company or organisation name;
- general company information;
- the pages visited;
- the date and time of the visit;
- the source of the visit; and
- other company-level website engagement information.
The purpose is to help a business understand possible interest from other organisations.
What B2B identification does not do
- identify the individual person who visited the website;
- provide the visitor’s name;
- provide a personal email address or telephone number;
- identify which employee or department made the visit;
- reveal the visitor’s home address;
- place cookies on the visitor’s device;
- fingerprint the visitor’s browser or device;
- follow the visitor across unrelated websites; or
- build a personal consumer profile.
A company match indicates that the website request may have passed through an internet connection associated with that organisation. It is not proof that a particular employee or other named person visited the website.
Why some companies can be identified
Some organisations use internet connections with IP addresses that can be associated with their corporate networks. Business-network databases bring together information about these connections and the organisations believed to use them.
Our software checks the visiting IP address against this type of database. It does not obtain information from an internet service provider about the identity of an individual subscriber.
Why many visits cannot be identified
Not every IP address can be linked to a business. A company match will often not be available where a person is using:
- residential broadband;
- a mobile network;
- home Wi-Fi;
- a virtual private network;
- a shared internet provider;
- a cloud or hosting service;
- a remote-working connection; or
- another network that cannot reliably be attributed to one organisation.
These visits remain unidentified at company level. The software does not attempt to turn an unidentified residential IP address into a person’s name or home address.
Are IP addresses personal data?
An IP address is a technical online identifier. Under UK and European data-protection law, an IP address may be personal data where it relates to an identified or identifiable natural person.
Whether it identifies an individual depends on the context and on what other information is available to the organisation processing it. Our software does not assume that IP addresses are outside data-protection law.
Instead, it processes an IP address for the limited purpose of checking whether it relates to a known business network. It does not obtain the additional subscriber information that might enable an internet service provider to connect an IP address to a named person. The resulting client-facing information is designed to be about an organisation rather than an individual.
The lawful basis for B2B company identification
Where an IP address is treated as personal data, the website operator must identify an appropriate lawful basis for processing it. A B2B website operator may decide that company-level visitor identification is necessary for its legitimate interests.
These interests may include:
- understanding engagement from prospective business customers;
- measuring the effectiveness of B2B marketing;
- improving website content and visitor experience;
- identifying general business interest in products or services; and
- supporting proportionate business-development activity.
Legitimate interests should not be treated as automatic. The website operator should consider:
- whether it is pursuing a genuine and lawful business interest;
- whether processing the information is reasonably necessary for that purpose; and
- whether the visitor’s interests, rights and reasonable expectations override that interest.
This assessment should take account of the fact that the software:
- produces company-level rather than person-level information;
- does not identify the visitor;
- does not place cookies or persistent tracking identifiers;
- does not track individuals between unrelated websites;
- is intended for a B2B context; and
- limits the information made available to the website operator.
Responsible use of B2B visitor information
Company identification should be treated as an indication of possible organisational interest. A website operator should not contact a named employee and claim to know that they personally visited a particular webpage.
The information may instead be used to:
- understand which types of organisations engage with the website;
- measure B2B marketing performance;
- identify trends across sectors or locations;
- improve content for business audiences;
- understand engagement from known target organisations; and
- support proportionate business development.
Any later email, telephone call or other direct marketing is a separate activity and must comply with the laws applying to that communication.
Accuracy of company matches
A company match cannot always be guaranteed to be completely accurate or current. Businesses may:
- change their internet provider;
- share managed office networks;
- route traffic through a parent company;
- use external IT infrastructure;
- use virtual private networks;
- allow employees to work remotely; or
- route traffic through cloud services.
A company name should therefore be treated as a reasonable indication that the visit may have originated from a network associated with that organisation, rather than definitive proof.
Suggested privacy-policy wording for B2B websites
| Company-level website visitor identification We use website visitor identification software to help us understand which businesses and organisations may be visiting our website. When you visit our website, your IP address is received as part of the ordinary technical process used to provide the website. Our software compares that IP address with a database of known business networks. Where a suitable match is available, we may be shown the name of the company or organisation associated with that internet connection, together with information about the pages visited. The software does not identify you personally. It does not provide us with your name, personal email address, telephone number, home address or details of which individual within an organisation visited the website. It does not place cookies on your device, fingerprint your device or track you across unrelated websites. We use this information for our legitimate interests in understanding interest from potential business customers, measuring the effectiveness of our marketing and improving our website and services. A company match is only an indication that a visit may have originated from a network associated with that organisation. It is not proof that a particular person or employee visited our website. You can contact us using the details in this privacy policy if you have any questions or wish to object to this processing. |
Part 2: Permission-based B2C visitor location insight
How permission-based location insight works
For consumer-facing and local-service websites, our software can help an organisation understand the geographical locations from which people are showing interest in its website.
It does not attempt to identify a person’s home address from their IP address. Instead, the website invites the visitor to share the current location reported by their device. The visitor’s browser displays its standard location-permission request, and no browser-provided location is shared unless the visitor actively allows it.
Where permission is granted, the software receives the geographical coordinates supplied by the visitor’s browser or device. These may provide a broad location or a highly precise location, depending on the device, browser, available location services and surroundings.
How precise can the location be?
The precision of the reported location varies. On a mobile phone with GPS and location services enabled, the result can often be very accurate. It very often will provide the exact address at which the device appears to be located or a point very close to it.
On a desktop or laptop computer, the result is often less precise because the device may rely on nearby Wi-Fi networks, network information or other available location signals rather than GPS. Some internet providers do allow very precise location of desktop or laptop users.
Factors affecting accuracy include:
- whether the device has GPS;
- whether location services are enabled;
- the browser and operating system being used;
- the internet provider;
- mobile-network information;
- whether the visitor is indoors;
- the quality of the available location signal; and
- the privacy and accuracy settings selected on the device.
The location should therefore be understood as the position reported by the visitor’s device, with the level of accuracy available at that moment.
A precise location is not necessarily a home address
A highly accurate result may correspond to a particular building or address, but it does not establish that the location is the visitor’s home.
The visitor could be:
- at work;
- visiting another person;
- at a customer’s property;
- in a public place;
- at temporary accommodation;
- travelling;
- using somebody else’s device; or
- close to, rather than inside, the address shown.
The software does not independently determine whether the location is residential, commercial or temporary. It does not obtain the name of the person living at an address, identify the owner or tenant, or establish any relationship between the visitor and the property.
This is not residential IP-address tracking
The software does not take a residential IP address and convert it into:
- a person’s postal address;
- a confirmed home address;
- the name of the internet subscriber;
- the identity of the visitor;
- the identity of the device owner; or
- details of other people at the property.
The location comes from the browser’s standard geolocation facility after the visitor grants permission. This is separate from the B2B company-identification feature, which checks an IP address against a database of known business networks.
The visitor remains in control
Before location information is provided, the visitor’s browser or device presents a permission request. The visitor can:
- allow location access;
- refuse location access;
- ignore or close the request;
- allow access once;
- allow access for the website; or
- change or withdraw the permission through their browser or device settings.
The exact choices shown depend on the browser, operating system and device. If the visitor refuses permission, our software does not receive the browser-provided geographical coordinates.
Where sharing location is optional, the visitor should still be able to use the main website without providing it.
What the website operator may receive
Where permission is granted, the website operator may receive information including:
- the exact address of the person;
- a map location;
- the pages viewed;
- the time of the visit; and
- other information about the relevant website session.
The website operator does not receive the visitor’s name simply because location permission has been granted.
What the permission-based location feature does not do
- obtain the location before browser permission is granted;
- identify the visitor by name;
- confirm who owns or is using the device;
- confirm who owns, rents or occupies a property;
- identify other people at the location;
- prove that the location is the visitor’s permanent home;
- derive a residential address from the visitor’s IP address;
- continuously follow the person after they leave the website; or
- track the person across unrelated websites.
Unless a website separately collects identifying information, such as through an enquiry form, the location alone does not tell the website operator who the visitor is.
Why a website may request location
Depending on the website and service being provided, location information may be used to:
- send printed communications to the address;
- understand which geographical areas generate interest;
- determine whether a visitor appears to be within a service area;
- assess demand in different locations;
- measure the effectiveness of geographical marketing;
- plan future service coverage; or
- improve website content and services.
Suggested privacy-policy wording for consumer and local-service websites
| Permission-based website visitor location Our website may invite you to share your device’s current location. We do not use your IP address to identify your home address. Instead, location information is only provided to us when you actively grant permission through the standard location request displayed by your browser or device. If you refuse, close or do not respond to the request, we do not receive the browser-provided location. Where you grant permission, your browser may provide geographical coordinates and information about the accuracy of the location. Depending on your device and available location services, this may be an approximate area or a highly precise location, including the exact address where the device appears to be located or a point very close to it. The location represents the position reported by the device at that time. It does not necessarily represent your home address and does not tell us your name, who owns the device, or who owns, rents or occupies the property. We use the information to [insert the organisation’s actual purposes, such as understanding geographical demand, checking service-area coverage, providing locally relevant information and measuring local marketing]. We do not use this feature to continuously monitor your movements or track you across unrelated websites. You can refuse the location request or change the permission through your browser or device settings. You can also contact us using the details in this privacy policy if you have questions about how the information is used or wish to exercise your data-protection rights. |
Part 3: How the two methods differ
| Question | B2B company identification | Permission-based B2C location insight |
| What initiates it? | An IP address received as part of the normal website request. | The visitor actively grants permission through the browser. |
| What is checked? | The IP address is checked against a database of known business networks. | The device supplies its current geographical coordinates. |
| What can be shown? | A possible company or organisation associated with the network. | A location ranging from approximate to exact or near-exact. |
| Does it identify the visitor? | No. | No. |
| Does it identify a home address? | No. | It may show an address close to the device, but does not establish that it is the visitor’s home. |
| Does it use cookies? | No. | No. |
| Main purpose | Company-level B2B marketing and website insight. | Geographical demand, local relevance and service-area insight. |
The central privacy principle
Neither method is designed to reveal the identity of the individual website visitor. The B2B method attempts to identify a possible organisation associated with a business network. The permission-based method allows a visitor to share their device’s location without revealing their name or establishing that the location is their home address.
Both methods should be used transparently, proportionately and only for clearly defined purposes.
Responsibilities of website operators
Organisations using the software remain responsible for how it is implemented and how the resulting information is used.
Website operators should:
- explain the relevant method in their privacy policy;
- ensure the description reflects their actual configuration;
- identify an appropriate lawful basis;
- only collect information needed for a defined purpose;
- set appropriate retention periods;
- restrict access to authorised personnel;
- respect objections and visitor choices;
- avoid misleading claims about what the data proves;
- use the information proportionately; and
- comply separately with direct-marketing requirements.
The software provider will normally act as a data processor when it processes website information on the website operator’s documented instructions. The exact roles and responsibilities should be recorded in the relevant contract and data-processing agreement.
Important notice
This page provides general information about company-level website visitor identification and permission-based location insight. It is not legal advice and does not confirm that every use of the software will comply with every law or regulatory requirement.
Website operators should ensure that their privacy notices, lawful-basis assessments, permission messages, contracts, retention arrangements and use of the resulting information accurately reflect their particular website, audience, jurisdiction and software configuration.
