Is website visitor identification legal?

Naming the company is broadly allowed with notice. Naming the person is mostly US only, with notice and opt-out. Not legal advice.

Updated October 2026

By region

Company-level

Person-level

What most tools do

	United States	Canada	EU and UK
Company-level	Generally permitted, with notice	Generally permitted, with notice	Legitimate interest, with notice
Person-level	Allowed with notice and opt-out	Restricted	Restricted
What most tools do	Name people and companies	Companies only	Companies only

Limit person-level identification to the United States, and treat an unknown country as not the US.
Skip session replay, keystrokes and form contents, which carry much more risk than page views.
Use the IP address for the lookup and never store it.
Honour Global Privacy Control, and offer a public opt-out.
Keep each customer’s data separate, rather than pooling it into a shared identity graph.

Say in your privacy policy that you use visitor identification, what it collects and how to opt out.
Have a reason to contact the people you identify, and use business channels for it.
Follow email law when you reach out. In the US, B2B email is opt-out, and the sender is responsible.
Ask your counsel about your own situation, especially for health, finance or anything sensitive.

Escendo does all of the first list and gives you the privacy-policy wording. Details.

Generally yes, with a privacy-policy notice and an opt-out. California treats Global Privacy Control as an opt-out.

Company-level is commonly run under legitimate interest. Naming individuals without consent is why tools exclude the EU and UK.

Ask your counsel. Escendo works either way and never identifies a browser sending Global Privacy Control.

General information only, not legal advice. Laws in this area change; check with counsel before relying on it.

One script tag, a couple of minutes. 7 days free, card required, cancel before it ends and you pay nothing.