The short answer
B2B website visitor identification can be legal under GDPR and UK GDPR when it is done properly. The company name a tool shows you is usually not personal data, but the IP address and browsing data used to find it can be. In the UK and EU, most trackers store or read something on the visitor's device, which means you need the visitor's consent through your cookie banner first. You also need a clear privacy notice and an easy way for people to withdraw consent or object.
Not legal advice
This page is general information about how the rules work. It is not legal advice. Speak to your data protection officer or a data protection professional about your own set-up.
Is company-level identification personal data?
The result usually is not. Personal data is information about an identified or identifiable living person. A company name, industry, size and location describe a business, not a person, unless the business is a sole trader or a partnership, where details about the business can identify the individuals behind it.
The inputs can be personal data. The UK GDPR lists IP addresses as an example of online identifiers, and the ICO says online identifiers are personal data when they can be used to tell one user from another. So treat the IP address and page views your tracker collects as personal data, even if all your team sees is a company name.
Named people are personal data in every case. Warm AI shows only the company for UK and EU visitors.
Do you need consent?
In the UK and EU, usually yes.
In the UK, the Privacy and Electronic Communications Regulations (PECR) cover any technology that stores information, or reads information stored, on a visitor's device. That includes cookies, local and session storage, pixels, scripts and fingerprinting. You need consent unless an exception applies. The UK has five exceptions: communication, strictly necessary, statistical purposes, appearance and emergency assistance. The statistical purposes exception does not help here. The ICO says it "is not for identifying, tracking or monitoring people or groups of people who use your service."
The EU has a similar rule in the ePrivacy Directive, but with only two exceptions: sending a communication, and strictly necessary. The UK's statistical, appearance and emergency exceptions do not exist under EU law.
So if a visitor identification tool stores or reads anything on the device, plan on consent through your cookie banner for UK and EU visitors. Our cookie consent guide covers this in detail.
What lawful basis should you use?
Where your tracker needs consent under PECR, the ICO says that consent should also be your lawful basis under the UK GDPR for what you do with the data afterwards. It says trying to apply another basis, such as legitimate interests, on top is unnecessary and may even make your consent request invalid.
Legitimate interests, Article 6(1)(f), is mainly relevant where no device storage or access is involved, or where a PECR exception applies. In those cases the ICO sets out a three-part test:
- Purpose: are you pursuing a legitimate interest?
- Necessity: is using the personal data necessary for that purpose?
- Balancing: do the person's interests override yours?
The ICO says you should keep a record of this legitimate interests assessment.
Whichever basis you use, explain the visitor identification in your privacy policy and give people an easy way to withdraw consent or object.
UK GDPR vs EU GDPR: what is different?
The two are closely aligned, with largely the same lawful bases, transparency duties and rights for individuals. The differences that matter for visitor identification:
- Cookie exceptions: the UK now has five exceptions to cookie consent. The EU has two. In practice both still require consent for visitor identification that uses the device.
- Lawful bases: the UK added a "recognised legitimate interests" basis in 2025, through the Data (Use and Access) Act 2025.
- Regulator: the ICO in the UK. Each EU country has its own data protection authority.
- Domestic law: the UK GDPR sits alongside the Data Protection Act 2018 and PECR.
- Data flows: the European Commission renewed its decisions that the UK protects personal data adequately in December 2025, so personal data can continue to flow from the EU to the UK. The renewed decisions run to December 2031.
If your website gets visitors from both the UK and the EU, assume both sets of rules apply. One well-documented, consent-first approach usually covers both.
How Warm AI handles this
- Company level only in the UK and EU. UK and EU visitors are shown as companies, never as named individuals. Named people, with LinkedIn profile and email address where available, are shown for US visitors only.
- Consent first in the UK and EU. In the UK, EU, EEA and other regions that require consent, Warm AI's tracker waits for your cookie banner to signal consent before it records a visit.
- No cookies, no fingerprinting. The tracker sets no HTTP cookies and does no device fingerprinting. It keeps a short session token in session storage, which is cleared when the browser tab closes.
- Data processing agreement. Available to every customer on request.
- ICO registered. WARMAI LIMITED is registered with the UK Information Commissioner's Office (ZC135250).
The full technical details are in our tracker privacy notice.
Your checklist
- Set up your cookie banner so the tracker only runs for UK and EU visitors after consent.
- Record your lawful basis and your reasoning. Where the banner gates the tracker, that basis is consent.
- Explain the visitor identification in your privacy policy.
- Give people an easy way to withdraw consent or object.
- Sign a data processing agreement with your vendor and check where it stores data.
- Prefer company-level identification for UK and EU visitors.
Frequently asked questions
Is website visitor identification GDPR compliant?
It can be. The main requirements are cookie consent where a tracker uses the device, a recorded lawful basis, a clear privacy notice, an easy way to withdraw consent, and company-level identification for UK and EU visitors. This is general information, not legal advice.
Is it legal to identify website visitors in the UK?
It can be, when done properly. If the tracker stores or reads information on the visitor's device, you need consent under PECR, and the ICO says that consent should also be your lawful basis under the UK GDPR.
Is an IP address personal data?
It can be. The UK GDPR lists IP addresses as online identifiers, and the ICO says online identifiers are personal data when they can tell one user from another. It is safest to treat them as personal data.
Do I need consent to identify website visitors?
In the UK and EU, usually yes if the tool stores or reads anything on the visitor's device. The ICO's analytics exception does not cover identifying or tracking people.
Will I see the exact person who visited from the UK or EU?
Not with Warm AI. UK and EU visitors are shown at company level only. Named people are shown for US visitors only.
Does Warm AI offer a data processing agreement?
Yes. A data processing agreement is available to every customer on request.
Start your 14-day free trial. No card needed.
Related guides
Part of our UK website visitor identification guide. Explore the rest of the series.