GDPR-compliant website visitor identification tools, compared

The short answer

No visitor identification tool is GDPR compliant on its own. What makes it compliant is how it works and how you set it up. For UK and EU visitors, look for a tool that shows companies rather than named people, waits for your cookie banner before it records a visit, stores data in the UK or EU, and gives you a data processing agreement.

The seven tools below all identify companies from UK and EU visits: Warm AI, Leadfeeder, Leadinfo, Albacross, Snitcher, Lead Forensics and RB2B. They differ most on two things: whether they wait for consent, and what they store on the visitor's device.

We make Warm AI, so we have an interest. Snitcher and RB2B are also two of the data providers Warm AI checks. To keep this fair, every fact about another tool comes from that company's own website, checked on 16 October 2026. This page explains the rules as we understand them. It is not legal advice.

The seven tools at a glance

Prices are as shown on each company's pricing page on 16 October 2026, in the currency each one uses. Check before you buy, as they change.

What makes a visitor identification tool GDPR-friendly?

Five things matter. Ask every vendor about each one.

1. It shows companies, not named people. For UK and EU visitors, the tools on this page show which company visited, not who the person was. Naming individual visitors would mean processing far more personal data.
2. It waits for consent before it records a visit. UK rules on cookies and similar technologies cover far more than cookies. The ICO says they apply "whenever the use of scripts and tags accesses or stores information on a user's device". A tracking script that reads or stores anything on the visitor's device usually needs consent first.
3. If you need consent, use it as your lawful basis. Where you need consent for the tracker, the ICO says you should also use consent as your lawful basis under the UK GDPR. Several vendors point to legitimate interests instead, so read the ICO's guidance before you decide.
4. Data is stored in the UK or EU, under a data processing agreement. Check where the vendor stores data, which other companies it shares data with (its sub-processors), and where they are.
5. You know where the contact details come from. Several tools add contacts at the visiting company from a separate database. Those people did not visit your website. Ask the vendor how it collects that data and on what basis.

What you see when a UK visitor accepts, or declines, your cookie banner

Here is how a consent-first tool behaves. Northmere Analytics is an invented company.

• A visitor from Northmere Analytics accepts your cookie banner. The tool records the visit and shows you Northmere Analytics, its industry and size, and the pages it read.
• A visitor from another company declines. The tool records nothing. You will not see that company at all.

So a consent-first tool will show you fewer UK and EU companies than a tool that runs before consent. That is the trade-off for waiting for consent. When you compare tools, compare them on the same consent settings.

The tools in detail

Warm AI

Warm AI identifies the companies visiting your website, and in the US the people. It checks several identification providers at once, including Snitcher and RB2B along with 7 more data sources, and keeps the best match. UK and EU visitors are shown as companies, never as named people.

Its tracker sets no cookies and does no fingerprinting. It keeps a session ID in session storage, which is cleared when the browser tab closes. In the UK, EU and other regions that need consent, it waits for your cookie banner to grant consent before it records anything. It works with Cookiebot, OneTrust, CookieYes, Transcend, Framer's built-in banner, HubSpot's cookie banner, Klaro, Google Consent Mode v2 and IAB TCF v2. Application data is stored in the EU, in Ireland. Warm AI publishes a pre-signed data processing agreement and its sub-processor list, and is registered with the ICO.

• Good fit if: you sell to UK or European companies, want a tracker that waits for consent by default, and want named US visitors in the same dashboard.
• Watch out for: UK and EU visitors only appear after they accept your cookie banner, so you will see fewer of them. Some sub-processors, including one IP lookup provider, are in the US. HubSpot is the only CRM Warm AI connects to directly.
• Price: £89/month for 50 IDs, or £62/month billed annually. A company uses 1 ID and a named US person uses 2. 14-day free trial, no card needed.

Leadfeeder

Leadfeeder, the new name Dealfront took in March 2026, identifies companies. It says individual visitors are not shown by default. It can also show contact details for people who work at those companies, unlocked with credits.

Its tracker sets cookies, including one that lasts a year, and uses local storage. It has a consent mode that holds back its cookies until your cookie banner gives consent, and it names OneTrust and CookieHub as examples. Leadfeeder says that with consent mode on, the tracker still identifies companies. Data is hosted on Amazon Web Services in the EU, and Leadfeeder holds ISO 27001.

• Good fit if: you want a free plan to start and unlimited users on every plan.
• Watch out for: the tracker still identifies companies before consent, so check with your adviser whether that fits your cookie banner set-up.
• Price: free Lite plan for up to 100 companies a month. Paid plans from €79/month billed annually. 14-day trial, no card needed.

Leadinfo

Leadinfo, a Dutch company now part of team.blue, says it "only identifies the companies that visit your website". It also shows contacts at those companies, such as names, job titles and email addresses.

Leadinfo says it identifies companies without placing cookies, and offers two optional analytics cookies, one lasting two years. It says consent or legitimate interest can be your legal basis, and leaves the choice to you. Its tracking code can be set to fire only after consent. Data is hosted on Amazon Web Services in Ireland, and Leadinfo says it holds ISO 27001.

• Good fit if: you want screen recordings (from its Scale plan) and website automation in the same tool.
• Watch out for: Leadinfo's FAQ says you do not need visitors' consent to use it, while its GDPR page recommends getting consent before you switch on its tracking code. Agree your set-up with your adviser.
• Price: Starter is €69/month billed annually, for up to 50 companies. 14-day trial, no card needed.

Albacross

Albacross, based in Stockholm, identifies companies and adds decision-maker contacts from its data partners, unlocked with credits.

Its tracker sets cookies that last a year, and its help centre says "To set cookies in visitors' devices, their consent is required." It tells you to collect consent with a banner, but names no cookie banner integrations. Data is stored in Ireland. It publishes its data processing agreement, which applies when you accept its terms. Its sub-processor list includes one US data supplier, which it says only sends data into the EU.

• Good fit if: you sell across Europe and want a simple, low-cost starting plan.
• Watch out for: the Starter plan includes 10 email and 5 phone credits, and you will need to set up the consent step yourself.
• Price: Starter is €59/month billed annually, or €84 monthly. 14-day trial, no card needed.

Snitcher

Snitcher, a Dutch company, says it "only identifies companies and organizations". It can also show contacts at the companies that visit.

Its tracker sets one cookie that lasts a year and uses local storage. By default it treats consent as granted when the page loads. With its waitForConsent setting on, it holds back the cookie and local storage until consent, but still records page views using a temporary session ID. It works with Cookiebot, CookieYes, OneTrust and Transcend. Data is hosted in Frankfurt, and Snitcher says its ISO 27001 certification is in progress.

• Good fit if: you want a low monthly price and detailed developer documentation for its tracker.
• Watch out for: switch on the consent setting before you go live on a UK or EU website.
• Price: advertised from $49/month. 14-day trial, no card needed.

Lead Forensics

Lead Forensics, based in Portsmouth, identifies companies and adds contacts of decision makers at those companies.

Its privacy policy says data held in its CRM system is processed and stored in the UK, and its website shows an ISO 27001 badge. It does not say whether its tracking code sets cookies or how it works with cookie banners.

• Good fit if: you want a UK-based supplier and prefer to buy through a sales demo.
• Watch out for: ask how its tracking code works with your cookie banner before you sign, as its website does not say. Prices are not published.
• Price: not published. Lead Forensics says cost depends on your website traffic. One-week trial.

RB2B

RB2B, based in Austin, Texas, names individual visitors in the US. Outside the US, it identifies companies only, and it says it will not identify individuals located outside the US.

For company identification outside the US, it says you must use a consent management tool, and it names CookieYes. Its service is hosted in the US, and it says it holds SOC 2 Type 2.

• Good fit if: most of your buyers are in the US and you want named US visitors at a low price.
• Watch out for: data is hosted in the US, and UK and EU visitors are shown as companies only.
• Price: free plan. Paid plans from $79/month. 7-day trial, no card needed.

Does the new UK analytics exception cover visitor identification?

No, as we read the ICO's guidance. The Data (Use and Access) Act 2025 added an exception to the UK consent rules for collecting information for statistical purposes, to improve a website. The ICO says this exception "is not for identifying, tracking or monitoring people or groups of people who use your service". Visitor identification exists to find out who is visiting, so plan on needing consent.

How to set up visitor identification so it fits UK and EU rules

1. Use a cookie banner that lists the tool. Name it in your banner's marketing or analytics category, so visitors know what they are agreeing to.
2. Check the tracker waits. Open your website in a private window, decline the banner, and check with your vendor that no visit was recorded.
3. Update your privacy notice. Say that you use a visitor identification tool, what it does and who supplies it.
4. Sign the data processing agreement. Keep a copy, and check the vendor's sub-processor list.
5. Keep a record. Note which tool you use, your consent settings and your lawful basis, in case anyone asks.

Our guides to cookie consent and whether visitor identification is legal under GDPR go into more detail. For UK buyers, see visitor identification for UK businesses.

So, which GDPR-compliant visitor identification tool should you choose?

If most of your visitors are in the UK or EU, choose a tool that shows companies, waits for your cookie banner by default and stores data in the UK or EU. Then set it up properly, because the settings matter as much as the tool. If your buyers are mainly in the US, a tool that names US visitors and shows companies elsewhere gives you both. For a wider comparison, see our guides to the best website visitor identification software and the best website visitor tracking software.

Frequently asked questions

Start your 14-day free trial. No card needed.