Visitor identification for ABM: what reverse-IP can and can't tell you
How website visitor identification works for B2B, what share of visits it can name, where it fails, the privacy questions to settle first, and how to turn identified companies into ABM actions without spamming sales.
Visitor identification names the company behind a website visit by matching the visitor's network to the organisation that owns it. For ABM it answers a specific question: which companies on our list, and which ones not on it yet, are reading our site? It identifies companies, not people, and only for visits from business networks. Treat it as a strong account signal with known blind spots, settle the privacy basis before you switch it on, and route it into stages and campaigns rather than straight into sales inboxes.
How it works
Every web request comes from an IP address. Some address ranges belong to internet providers and mobile networks; others are registered to, or consistently used by, specific organisations. Visitor identification looks up which organisation is behind the network a visit came from.
In IntentBid the path is:
- Page view. A small script sends the page path, referrer and campaign parameters.
- Filters. Bots, crawlers and excluded networks are dropped.
- Worth a lookup? Ad clicks and visits from AI answers are looked up at once. Other single-page visits wait for a second page or 15 seconds on the page, because most quick bounces aren't buyers.
- Network check. Home broadband, mobile networks and cloud servers are recognised and skipped.
- Company lookup. For business networks, the company is resolved and cached for 30 days.
- Company record. The company appears with the pages it read, the source that brought it and its stage.
The detail is in How company identification works.
What it can tell you
- Which companies visited, with industry, size and location from the company record.
- What they read: which pages, how many, and whether they reached pricing, demo or contact pages.
- Where they came from: LinkedIn Ads, ChatGPT Ads, an AI answer, organic search, direct.
- When, and whether they're coming back more often.
- Whether they're on your target list, and whether they've already seen your LinkedIn ads.
For ABM, the last point is the useful one. A target account that saw your LinkedIn ads for three weeks and then read the pricing page twice is a different conversation from a cold account.
What it can't tell you
Who the person is
Reverse-IP identifies the network, which belongs to a company. It doesn't identify a person, and a responsible setup doesn't try. If a vendor promises names and email addresses of anonymous visitors, ask exactly how, and what legal basis they rely on.
Visits that don't come from a company network
This is the big one. Visits from home broadband, mobile data and VPNs show the internet provider's or VPN's network, not the employer's. No one can tie those to a company from the IP alone. With hybrid and remote work, that's a large share of B2B traffic. In IntentBid's experience, typically 15 to 30% of business visits can be identified; see Why some visits have no company.
Vendors quote very different match rates, often as "up to" figures. The number that matters is the share of your own traffic identified, measured on your site.
Which office, which subsidiary
Large groups route traffic through central networks. A visit may resolve to the parent company even if the reader works at a subsidiary on your list, or the other way round. Check how your target list handles groups before you judge coverage.
Intent beyond your site
Visitor identification only sees your website. It doesn't see what a company read elsewhere, or what it saw in your ads if it never visited. That's what LinkedIn's company reporting adds: impressions and engagement by company, even without a visit.
Privacy: settle it before you switch it on
Treat this as a legal question, not a technical one, and get advice for your markets. The points that usually matter in Europe:
- IP addresses can be personal data. The EU Court of Justice held in the Breyer case that dynamic IP addresses can be personal data for a website operator (Bird & Bird). Processing them needs a legal basis under GDPR; many B2B companies rely on legitimate interest, which requires a documented balancing test.
- Cookies and device storage. Storing or reading data on the visitor's device generally needs consent under ePrivacy rules. A script that doesn't set cookies or use local storage avoids that part of the question, but not the GDPR question about the IP.
- Data minimisation. Keep what you need (the company), drop what you don't (the IP, the individual).
- Transparency. Say in your privacy notice that you identify companies from visits, and how.
IntentBid's approach is built around minimisation: no cookies, no fingerprinting, no tracking for browsers that send Global Privacy Control, the plain IP never stored (kept encrypted for at most 24 hours while a lookup is pending, then deleted), and no attempt to identify individuals. See Script speed, cookies and data collected.
How to act on identified companies
The failure mode is easy to predict: every identified company becomes a Slack alert, sales calls the first ten, three are students at a university network and one is a competitor. Sales stops reading the channel by Friday.
Filter first
- Exclude customers, competitors, partners, your own company and internal traffic.
- Ignore one-page bounces. Require at least two pages or real time on page.
- Check fit. An identified company outside your ICP is a curiosity, not a lead.
Then route by stage, not by visit
| Signal | Stage it suggests | Action |
|---|---|---|
| Target account, first visit, one or two pages | Interested | Add to a LinkedIn retargeting audience |
| Target account, several visits in 30 days | Considering | SDR researches the account, warm outreach referencing the theme |
| Any ICP account on pricing, demo or contact | Selecting | AE outreach within a day |
| Non-target ICP company, repeated visits | Candidate | Add to the next TAL refresh |
| Customer reading docs | None | Leave to customer success |
This is the logic of ABM stages: a visit moves an account forward only in combination with other signals and within a time window. See ABM stages sales will trust.
Feed it back into ads
Identified visitors are an audience. Companies that visited your site but haven't engaged with your LinkedIn ads are good candidates for a LinkedIn campaign aimed at the buying committee: the person who visited may not be the decision maker, but now you know the company is looking.
In IntentBid, Pixel · All identified visitors is a company source you can tick in a LinkedIn campaign, and any filtered set of accounts in Account engagement can be saved as an audience.
Send it where sales works
Push identified companies, their stage and the pages they read into the CRM rather than a separate tool. IntentBid writes companies with score, stage, source and pages read to HubSpot, and posts hot-account alerts to Slack or Teams. See integrations.
Measure it honestly
- Identified share of business visits per channel. It tells you which channels bring traffic from company networks.
- Target accounts that visited this month vs. the 30 days before your ads started.
- Pipeline from identified accounts, as influenced, not caused.
FAQ
Is reverse-IP lookup the same as tracking people?
No. It identifies the organisation behind a network, not a person. It should never be combined with other data to single out individuals.
Why does a visit show no company?
Because it came from home broadband, mobile data, a VPN or a cloud server, or it was a quick one-page bounce that wasn't looked up. These visits still count in your traffic reports.
Can I identify visitors from ChatGPT Ads?
Yes, when they arrive from a company network. ChatGPT Ads themselves don't report by company, so identification on your site is how you see which companies clicked.
Do I need a cookie banner for visitor identification?
Not for a script that sets no cookies and stores nothing on the device, as far as ePrivacy is concerned. You still need a GDPR legal basis for processing the IP address and a clear privacy notice. Check with your counsel.
How many identified companies will I get?
It depends on your traffic and its mix of office and remote visitors. IntentBid plans include a monthly number of identified companies, from 150 on Starter; see pricing.