Website visitor identification and your privacy policy
Visitor identification tools match anonymous traffic on your website to business contact records, so you can see the name, title, company, and LinkedIn profile of people who never filled out a form. Because that collects personal information from someone who took no action, your privacy policy has to say so. This page covers what to disclose, what your ongoing obligations are, and gives you language you can paste into your policy today.
The guidance applies to any tool in this category. Use it whichever vendor you run.
How these tools work
- A script runs on your pages, usually loaded by a tag manager or bundled into another widget you already installed.
- It uses the visitor's IP address, device signals, and identifiers to match them against a database of business contact information. A first-party identifier in the browser's local storage connects repeat visits from the same person.
- Matched visitors show up in a dashboard with their name, title, company, LinkedIn profile, and often a business email and phone number. Match rates are highest for visitors in the United States and fall off sharply elsewhere.
What you are required to do
- Update your privacy policy to disclose visitor identification before you switch the feature on. Template below.
- Honor opt-outs. If a visitor asks you to delete their information or stop identifying them, delete what you hold and forward the request to your vendor so they can suppress the record at the source. Deleting your own copy is not enough by itself, since the next visit would re-identify them.
- Keep the follow-up legal. Email to identified visitors has to comply with CAN-SPAM, which means accurate headers, honest subject lines, a physical address, and a working unsubscribe. Calls and texts fall under the TCPA and state telemarketing rules. Identified data may not be used for decisions about credit, insurance, employment, or housing, which is FCRA territory and carries real penalties.
Copy-paste privacy policy language
Add this to your privacy policy and replace the two bracketed placeholders. Adjust the tone to match the rest of your policy. The substance to keep is what gets collected, what it is used for, and how someone opts out.
Visitor identification. We use [VENDOR NAME] to help us understand which businesses visit our website and to follow up with them. When you visit our site, a script may collect your IP address, the pages you view, and a first-party identifier stored in your browser's local storage, and match that information against business contact databases to identify you and your employer (for example: your name, business email address, job title, company, and LinkedIn profile). We use this information for business-to-business sales and marketing follow-up. We do not use it to make decisions about credit, insurance, employment, or housing. To opt out of identification or request deletion of your information, contact us at [YOUR CONTACT EMAIL].
Most vendors also want their own contact address listed as a second route for opt-out requests. Check your vendor's documentation and add it after your own.
Using No Lead Lost?
Replace [VENDOR NAME] with No Lead Lost (noleadlost.com) and add one more sentence at the end: You may also email No Lead Lost directly at support@noleadlost.com. Our Terms require this disclosure to be in place before identification is active on your site.
Common questions
What about visitors from Europe?
These tools are built for United States audiences. In the EEA and the UK this kind of processing generally requires prior consent, and legitimate interest is a hard argument to sustain for identifying someone who never made contact. If a meaningful share of your traffic comes from those regions, talk to counsel before you rely on identification for those visitors.
Does it set cookies?
Implementations vary. Many store a first-party identifier in local storage rather than a cookie, which changes how it appears in a cookie banner but does not change your duty to disclose it. Your vendor's script may also use its own identifiers under its own privacy policy.
What about visitors who use privacy controls?
Global Privacy Control is the signal that matters here. A well-behaved implementation skips identification entirely for a browser that broadcasts GPC, and several state privacy laws now treat GPC as a valid opt-out you are obliged to respect. Confirm your vendor honors it rather than assuming. Ad blockers will also prevent identification for some share of your traffic.
Do I need this if I only identify companies, not people?
Company-level identification, where you learn the employer but never the individual, carries a much lighter disclosure burden because it is not personal information in the same sense. The moment a named person, their title, or their work email lands in your dashboard, treat it as personal information and disclose it.
Who publishes this
No Lead Lost is a widget for your website that qualifies visitors with a short set of questions and books the ones worth your time. Your first 5 leads are free, forever, and setup takes a few minutes with no credit card.
Visitor identification is on our roadmap for the Pro and Scale plans and is not available yet. We wrote this guide because the compliance side of it is poorly documented across the whole category, and the answer does not depend on whose tool you run.
This page is practical guidance, not legal advice. Your obligations depend on where you and your visitors are located. When in doubt, have your counsel review your privacy policy.