Website Visitor Identification: IP vs Device Matching

Website Visitor Identification: Why IP Lookup Names a Network, Not a Buyer 

Website visitor identification can name a company from an Internet Protocol (IP) address, but naming a person takes device-level matching tied to a verified contact record, with consent attached. Even then, the name is one signal to read alongside everything else that account is telling you. That matters because your buyers research from home, on a phone, behind a Virtual Private Network (VPN), and usually as a group, so a visit rarely arrives with a name attached. 

On a first vendor call, someone quotes a 90% match rate, the share of visitors a vendor says it identified, and the right follow-up question is hard to find in the moment. Many visitors leave without filling out a form, so visitor identification has to do the work forms cannot accomplish. This piece covers what an IP address identifies, what a device graph is, and how to test match rates on your own terms. 

An IP address identifies a network, not a buyer 

An IP address identifies a network interface at a moment in time. It doesn’t tell you who was typing. 

Turning that address into a company name is an inference, built from registry records of who was allocated the address block, traffic patterns that tie addresses to a company’s email domain or logins, and commercial datasets that are bought, licensed or traded in. The result is a best guess, refreshed on somebody’s schedule. 

That is why a company-level match answers where to spend, not who to call. We cover when account-level intent is the right call separately. 

Four ways IP-based identification keeps eroding 

Shared office addresses, remote work, VPNs and IPv6 are not edge cases. Each reflects how your buyers research now, and each removes a signal that IP resolution used to rely on. 

1. Corporate NAT puts a whole building behind one address

Network Address Translation (NAT) lets thousands of employees share one public IP. The address can tell you the building, but it can’t tell the Chief Information Security Officer (CISO) from the new analyst two desks over. 

2. Remote work moves research onto home connections

Research from Stanford’s Institute for Economic Policy Research found in 2025 that 21.2% of US paid workdays are worked from home. Buyer research done from home often arrives from a residential address with no corporate mapping. 

3. VPNs and privacy proxies hide the origin

Consumer VPNs, Apple’s iCloud Private Relay and the cloud security gateways through which many companies route staff traffic, all put someone else’s address between the visitor and your server. Some anonymous website visitors reach you with their origin hidden by design, or relabeled as the proxy provider’s network rather than the buyer’s company. 

4. IPv6 and carrier-grade NAT break the old assumptions

IPv6 is the newer internet address format. The Asia Pacific Network Information Center (APNIC) reports that IPv6 use crossed 50% on a widely watched measure for the first time in April 2026. Meanwhile, under carrier-grade NAT, internet providers pool unrelated IPv4 users behind shared addresses. Mappings built for stable, company-owned IPv4 blocks go stale fast under both. Put together, one buying group’s research can arrive from a dozen addresses that never map back to the same company, which is why the account’s story matters more than any single match. 

What your match rate is a fraction of 

A match rate means nothing until you know the denominator. The rate can rise in four ways with no new identification: 

1. Filtering before calculating. Remove heavy consumer traffic, such as Internet Service Providers (ISPs) and mobile carriers, and the rate rises.

2. Counting bots as matches. Some published match rates count bot traffic alongside confirmed company visitors, which puts bots in the numerator.
    
3. Measuring sessions instead of visitors. One matched office worker who returns 20 times produces 20 matched sessions.

4. Reporting confidence-weighted matches as binary. A low-confidence guess counts the same as a verified record once it’s rounded into “matched.” 

Some vendors rightly point out that a high match rate is worthless if the matches are wrong. A wrong match does damage downstream: routing sends a rep to the wrong company, suppression holds back a real prospect, and dashboards show engagement that never happened. 

We don’t quote accuracy benchmark ranges here; a range means little without its denominator. To test a provider’s accuracy claims, use our 10-question framework for vetting contact-level intent. 

 To test a provider’s claims against your own accounts, see our guide to building a contact-signal-first intent stack, which covers checking that signals are individual rather than domain-level and testing match rates on a sample. 

Device-level matching and the device graph, explained 

A device graph is a maintained map that links the browsers and devices one person uses to a single identity, based on identifiers that persist across sessions and sites, and, at lower confidence, on inferred patterns. 

This is the step where B2B identity resolution moves from the company to the person. 

Linking identifiers include first-party cookies, hashed email addresses from logins and form fills, authenticated sessions, and clicks from emails sent to a known address. 

• Deterministic linkage ties a device to a record through a verified event, such as a login or a click from a known inbox. 

• Probabilistic linkage infers a link from patterns, such as shared networks, similar device characteristics and timing. 

Both can be labeled as “contact-level,” but only deterministic links reliably survive a rep checking the name. Ask which links rest on a verified event and which are inferred. 

The graph can’t see a person who clears cookies, uses a device that has never authenticated, blocks tracking, or isn’t in the underlying database. 

That is why a lower match rate measured against every unique visitor, with verified links, is worth more than a higher one measured against a filtered base that counts bots or repeat sessions. No method identifies every visitor. When you see a claim of full coverage, ask what the denominator is. 

Consent and jurisdiction decide whether an identity is usable 

Consent decides whether a resolved identity can be used at all. Treat what follows as orientation, not legal advice: 

• In the EU, regulators treat tracking pixels and tracking links, and some IP-only tracking, as needing consent under the ePrivacy rules, and IP addresses can be personal data under General Data Protection Regulation (GDPR). Check your regulator’s guidance, including in the U.K. 

• In the U.S., state privacy laws such as California’s give people rights over how their information is collected and shared. Check the rules in each state you target for marketing purposes. 

Safari and Firefox block or partition third-party cookies by default, while Chrome still allows them, so the same visitor can be trackable in one browser and invisible in another. 

Consent state has to travel with the resolved identity. If a person lands in your Customer Relationship Management (CRM) without a record of what they agreed to, where, and when, nobody downstream knows whether an email is allowed, however accurate the match. Require consent status, basis, jurisdiction, source and timestamp as fields on every resolved record. 

How to run a website visitor identification test on your own terms 

1. Define your denominator in writing before the trial starts. Set it after results arrive and the vendor’s definition becomes yours. 
2. Supply a holdout of accounts and people you already know visited. Known answers show which matches are wrong. 
3. Measure sessions and unique visitors separately. A large gap shows how much of the rate is repeat traffic. 
4. Require confidence bands, not a single number. A single rate hides how many matches are guesses. 
5. Ask what happens to traffic the vendor cannot resolve. Traffic that quietly drops out of the base inflates the rate. 
6. Check consent fields on every resolved record in the trial export. An accurate match you can’t legally use counts as zero. 

FAQ 

Can website visitor identification tell me which person visited? 

Website visitor identification can name a person only when device-level matching links the visit to a verified contact record and consent is in place. 

Is de-anonymizing website traffic legal? 

It depends on the method and the jurisdiction. European Union rules generally require consent for pixel-based tracking and some IP-based tracking, and other regions differ, so check with your privacy counsel. 

Why do vendors’ match rates differ so much? 

Match rates differ mostly because of denominators: what gets filtered out, whether bots count, and whether the base is comprised of sessions or visitors. Where person-level resolution fits in a wider campaign is covered in our buyer intent data maturity ladder. 

What honest resolution buys you 

Honest resolution will not give you certainty. It gives you a named person you can route to, where consent allows, read alongside the other signals that account is sending, and a reason you can show a rep. 

Our approach connects website activity to people using 350M+ owned, first-party contacts built over a decade of contact-level tracking, instead of stopping at an IP lookup. Within Digitalzone campaigns, our team uses Journey Pixel to connect anonymous touchpoints back to the audience the campaign is already reaching. For a test against a denominator you define, talk to Digitalzone about your visitor data.