Visitor identification and GDPR: a sober assessment

Anyone researching visitor identification reads contradictory statements. Some providers say consent is always needed. Others promise that with their solution you need nothing at all. Both are too sweeping. This article shows the steps with which you can prepare the question for your own website. It is an assessment, not legal advice. It does not replace a review by your data protection officers or lawyers.

Status of the sources: 06.11.2026. Check the current wording before making a decision.

Two separate tests

Visitor identification raises two questions that are often mixed up:

1. May the script access the visitor's device? In Germany this is governed by § 25 TDDDG, in Austria by § 165 Abs. 3 TKG 2021. Both rules derive from the ePrivacy Directive. Storing or reading information is in principle permitted only with consent, unless the access is strictly necessary for an expressly requested service to work.
2. May the processing of the data take place? The GDPR answers this if the data is personal. You need a legal basis under Art. 6(1), such as consent (point a) or legitimate interest (point f).

Both tests apply side by side. A legitimate interest under the GDPR does not replace consent for device access. Conversely, consent for the script does not automatically make the processing lawful if it goes beyond what was consented to.

A script that stores or reads nothing on the device may not touch the first question. Whether that applies depends on the technology and is assessed differently. Ask your provider specifically what the script does. Have it described to you in writing.

Is the IP address personal data?

In short: often yes. In case C-582/14 (Breyer), the Court of Justice of the European Union ruled that even a dynamic IP address can be personal data if the operator has legal means of reaching the person via third parties (such as the access provider). The question therefore depends on the individual case. Authorities tend to set the threshold low. The detailed version is in IP address and GDPR: is it personal data?.

For visitor identification this means: expect that the moment the address arrives at the server already counts, even if it is discarded afterwards.

Company, person, pseudonymous

B2B visitor identification claims to recognise only companies and no people. That is a good approach, but not a free pass:

• The company level helps. If the result is the name of a business, no individual is at the end of it. That lowers the risk, especially in the analysis.
• Sole traders, freelancers and small offices are company and person at once. A result such as „Schmidt Beratung“ can refer to a specific person.
• Home office. Someone browsing from home via a company VPN appears as a company although a specific person is behind it. More on this in Home office, VPN and mobile networks: who you cannot see.
• Linking. As soon as you look for a contact person for the company or merge the behaviour with other data, a personal link can arise.
• Pseudonymisation is a safeguard, not a way out. Pseudonymised data remains personal as long as the person can be identified with additional information.

Anyone using mouse recordings or behaviour profiles moves even closer to the person. On this: Session replay and data protection: using mouse recordings properly.

Roles and contracts

• You as the operator of the website are generally the controller within the meaning of the GDPR. You decide whether and for what purpose the data is collected.
• The visitor identification provider generally processes the data on your behalf and is then a processor. For this you need a contract under Art. 28 GDPR. Check whether the provider also uses the data for its own purposes, because then the role changes.
• Subprocessors (hosts, databases, company data providers) must be listed and contractually bound. Ask about the server location and whether data flows to third countries.

Information obligations

Visitors must learn what is happening. The privacy policy should contain at least:

• that visitor identification is used and what for
• which data is processed (for example pages viewed, times, origin, time spent)
• the legal basis
• how long the data is stored
• the recipient or category of recipients, that is, your provider
• the rights of data subjects: access, deletion, objection, complaint to the supervisory authority

A general sentence on „web analytics“ is not enough if a company assignment is behind it. Describe it as a separate item.

Switzerland

With the revised Data Protection Act (revDSG), Switzerland has its own rules, which have applied since 1 September 2023. They are less consent-centred and more transparency-oriented:

• You must inform data subjects appropriately about the collection and processing of their personal data.
• Processing must be proportionate and purpose-bound.
• Where someone expressly objects, their data may be processed further only with a justification.
• For cookies and similar technologies, information obligations under telecommunications law are added.

If your offer also targets visitors from the EU, the GDPR can apply in addition.

Checklist for operators

1. Describe in writing which data the solution collects, when and where it is stored.
2. Clarify whether the script accesses the end device. Then decide whether to obtain consent for it.
3. Choose a legal basis for the processing and document the balancing.
4. Conclude a data processing agreement and have the subprocessors named.
5. Check the server location and possible transfers to third countries.
6. Add a separate section to the privacy policy.
7. Set retention periods and check that deletion takes place.
8. Block sensitive areas such as checkout, account and forms with health data.
9. Set up a way to handle access and deletion requests.
10. Decide whether a data protection impact assessment is needed. Record the result.
11. Enter the processing in the record of processing activities.

How to set up the selection process is shown in Comparing visitor identification: 12 criteria for choosing.

Open questions for your legal adviser

Some points are not conclusively settled or depend on your case. Take them with you:

• Is consent to the „statistics“ category enough for device access, or is a separate consent needed?
• Is legitimate interest viable for a company assignment? How does the balancing turn out for small companies and sole traders?
• From what size or legal form is a result clearly „not personal data“?
• How exactly must visitors be informed about the company assignment?
• How do you handle objections when the IP address is not stored?

An answer exists only in the individual case. Anyone who promises you across the board that no legal risk remains is selling you a guarantee that nobody can give.

How a provider can handle this

As a practical example: Whovisit discards the IP address after the lookup, stores only companies and institutions and sets no cookie. Where the data is located and who is involved is described on the Privacy principle page. How long what is stored is explained in the help centre under Retention and deletion. Whether that is sufficient for your website is something you decide with your legal adviser.

In short

Assess visitor identification in two steps: device access and processing. The company level reduces the risk but does not eliminate it. Clarify roles and contracts, provide your own information and delete early. And take the open questions into a conversation with someone who knows your business.