Is Website Visitor Identification Legal Under UK GDPR?

Not legal advice

This page is a factual explainer of what the law and the ICO's guidance say, written for marketers. It is not legal advice, and it cannot tell you whether your own set-up is compliant. That depends on what your tool does, what data it returns and how you use it. Take advice from a qualified data protection professional before you switch a tool on.

How we checked it: we read every ICO page cited here in a browser on 3 November 2026 (the ICO's site blocks automated fetches), and read the legislation in its revised form on legislation.gov.uk on the same day.

This page is part of our guide to website visitor identification. For the mechanics of how a visit becomes a company name, see how IP-to-company lookup works.

The rules that apply

Three pieces of law matter for a UK website that identifies its visitors.

The UK GDPR and the Data Protection Act 2018 govern any processing of personal data, including IP addresses where they relate to an identifiable person.
The Privacy and Electronic Communications Regulations 2003 (PECR) govern storing information on, or reading it from, a visitor's device: cookies, pixels, local storage, fingerprinting and similar technologies. PECR applies whether or not the information is personal data.
The Data (Use and Access) Act 2025 amended both. It replaced regulation 6 of PECR¹⁴ and added a new Schedule A1 of exceptions, in force from 5 February 2026⁶ ⁷, and it added an explicit list of example legitimate interests to Article 6 of the UK GDPR³.

Are IP addresses personal data?

They can be. The UK GDPR includes "online identifiers" in its definition of personal data, and the ICO's guidance lists internet protocol (IP) addresses first among the examples, alongside cookie identifiers¹. The test is whether the identifier, on its own or combined with other available information, can be used to distinguish one person from another. The ICO adds that this can mean a named individual or "simply" a unique user of internet services¹.

Where it is genuinely unclear, the ICO's view is that, as good practice, you should treat the information as personal data anyway¹. In practice, every visitor identification tool starts by processing the visitor's IP address, so plan on the UK GDPR applying even if the output you see is only a company name.

Company data versus individuals

The ICO is clear that information about a limited company or another legal entity is not personal data, and nor is information about a public authority. But the UK GDPR does apply to information about individuals acting as sole traders, employees, partners and company directors, wherever they are individually identifiable and the information relates to them as individuals².

That distinction matters more for visitor identification than vendors' marketing suggests. A report saying "a visitor from Acme Ltd, a 2,000-person firm, read your pricing page" is about a company. The same report about a three-person partnership, a one-person consultancy or a sole trader can, in effect, describe an identifiable person.

What the tool shows you	Likely to relate to a person?	Why
A large company name and the pages viewed	Less likely	Information about a legal entity is not personal data², although the IP address processed to get there may be
A sole trader, a small partnership or a micro-business	Often	The "company" may be one or two identifiable people²
Named employees or contact details suggested for the visiting company	Yes	A name and a work email address relate to a particular individual²
A named individual matched to the visit	Yes	The visit is now linked to a specific person's browsing

Some tools sold mainly in the US go further than company level and name the individual visitor. That is a different proposition in the UK: it is plainly processing personal data about a specific person's behaviour, usually by matching data from several sources, and it touches several of the factors that the ICO says can make a data protection impact assessment necessary (see below). If you are considering person-level identification for UK or EU visitors, take specific advice first.

Choosing a lawful basis

Every processing activity needs one of the lawful bases in Article 6 of the UK GDPR. For company-level visitor identification, most organisations look at two: consent, or legitimate interests.

Legitimate interests and the three-part test

Legitimate interests (Article 6(1)(f)) is the most flexible basis, but it puts the burden on you. The ICO breaks it into a three-part test, to be applied in order⁴:

Purpose test. Do you have a legitimate interest? Be specific. "Understanding which organisations show interest in our services, so that we can prioritise follow-up" is a purpose; "marketing" is not.
Necessity test. Is processing the personal data necessary for that purpose, or is there a less intrusive way to reach it?
Balancing test. Do the visitor's interests, rights or freedoms override your interest? Reasonable expectations carry a lot of weight here: the ICO notes that without a pre-existing relationship, it is harder to show that people would reasonably expect what you plan to do⁴.

You must be able to pass all three parts before you start the processing, and the ICO says it is not enough simply to state that the processing is in your legitimate interests⁴.

Since the Data (Use and Access) Act 2025, Article 6(11) of the UK GDPR lists direct marketing as an example of processing that may be necessary for a legitimate interest³. That is an example, not a free pass: the ICO's guidance says you must still meet the rest of the three-part test and comply with PECR⁴. The Act also created a separate "recognised legitimate interests" basis (Article 6(1)(ea)), but it covers a fixed list in Annex 1, such as national security, emergencies, crime and safeguarding vulnerable individuals¹⁵. Marketing analytics is not on it.

Write a legitimate interests assessment

The ICO calls the written record of the three-part test a legitimate interests assessment (LIA). The UK GDPR does not require one by name, but the ICO says you should do one anyway, before you start, as part of being accountable⁵. It publishes a sample LIA template. A visitor identification LIA would usually cover:

the exact purpose, and what you will and will not do with the results (for example, no named individuals, no sale of the data);
what data the tool processes: IP address, pages, timestamps, any cookie or device identifiers, and what it returns to you;
why company-level data is needed, and why aggregate analytics would not do;
who your visitors are, and how many are likely to be sole traders or very small firms;
what visitors would reasonably expect, and what your privacy notice tells them;
safeguards: short retention, no person-level enrichment, limited internal access, an easy way to object;
the outcome, including the factors that cut against it.

When consent is the better fit

If the tool needs PECR consent anyway (because it sets cookies or similar technologies for this purpose), some organisations find it simpler to ask for consent for the identification itself, through the same consent mechanism. The ICO's storage and access guidance explains how PECR consent and the UK GDPR lawful basis relate⁹. Either way, decide and record the basis before the tool goes live.

PECR: cookies and similar technologies

PECR is a separate question from the UK GDPR, and it is the one many visitor identification set-ups get wrong.

What regulation 6 now says

Since 5 February 2026, regulation 6 of PECR says that, subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user⁶. Two details in the new wording matter here:

it includes instigating the storage or access, which catches a third-party script you put on your site; and
unless the regulations say otherwise, gaining access includes "collecting or monitoring information automatically emitted by the terminal equipment"⁶.

The ICO's final guidance on storage and access technologies, published on 29 April 2026, covers cookies, tracking pixels, link decoration, device fingerprinting, web storage and scripts, and reflects the 2025 Act's changes⁹ ⁸.

The five exceptions, and why analytics does not cover identification

Schedule A1 sets out five exceptions where consent is not needed: transmitting a communication, strictly necessary services, statistical purposes, adapting appearance or functionality to the user's preference, and emergency assistance⁷ ⁸.

The statistical purposes exception is new, and it is tempting to read it as covering visitor identification. The ICO says it does not. The exception is about how a service is used, not who uses it, and "is not for identifying, tracking or monitoring people or groups of people who use your service"⁸. Among the activities it says still need consent is "tracking or profiling individual visitors or categories of visitors", giving IP address as an example⁸. The exception also requires that the information is shared only with someone helping you improve the service, that visitors get clear information, and that they have a simple, free way to object⁷; and the ICO says a third-party provider must be a processor, not a joint controller, for it to apply⁸.

In practice, if your visitor identification tool sets a cookie, writes to local storage, or reads device characteristics in order to identify or follow visiting companies, plan on putting it behind consent. When you ask for that consent, the ICO says you must provide the identity of any third parties you share data with, and that the visitor must take a positive action to opt in before non-exempt technologies are set¹⁷.

What about "cookieless" tools?

Some vendors describe their tracking as cookieless. Whether a particular script engages regulation 6 depends on exactly what it stores and reads on the device, and the new wording on information automatically emitted by the device is broad. Do not rely on the label: ask the vendor, in writing, what its script stores, what it reads, and what it sends back, and take advice on the answer. Even where PECR is not engaged, the UK GDPR still applies to the IP address.

Enforcement is changing

The ICO says the 2025 Act aligns PECR's enforcement regime with the UK GDPR's, and that it will publish new guidance on its approach once the changes are in force; until then its Regulatory Action Policy applies¹⁰.

Transparency: what the privacy notice should say

The right to be informed applies whatever lawful basis you use. The ICO lists what privacy information must include, among it the purposes and lawful basis, the legitimate interests relied on, the recipients of the data, and how long you keep it. Where data comes from a source other than the individual, you must also say what categories of data you obtained and where from¹¹. For visitor identification, that usually means saying, in plain words:

that you identify the organisations visiting your website from their IP address, and why;
which provider does it, and whether it is your processor or a controller in its own right;
whether any cookies or similar technologies are used for it, and how consent is managed;
how long you keep the results, and how someone can object.

An example of the kind of plain wording that works (adapt it, and check it with your adviser):

Example wording

"When you visit our website, our provider [name] uses your IP address to work out which organisation, if any, the visit came from. We use this to understand which organisations are interested in our services. We do not use it to identify you personally. We rely on our legitimate interests for this, and we keep the results for [period]. You can object at any time by emailing [address]."

Keep it near the top of the notice. The ICO notes that an explanation buried in a long, hard-to-read policy is unlikely to show that people reasonably expected the processing⁴.

Do you need a DPIA?

A data protection impact assessment is required when processing is likely to result in a high risk to individuals, whatever the lawful basis⁵. The ICO's list of processing that needs one includes three items close to visitor identification¹²:

Tracking: tracking an individual's behaviour, including online;
Data matching: combining, comparing or matching personal data from multiple sources;
Invisible processing: processing data not obtained directly from the person, where telling them would be impossible or disproportionate.

For tracking and invisible processing, the ICO says a DPIA is required when they are combined with one of the other criteria in the European guidelines; it also notes that two factors together usually indicate the need for one, and that doing one with a single factor is good practice¹². A small company-level set-up may not cross the line, but person-level identification, enrichment with contact data or large-scale tracking is likely to. If you are unsure, doing a short DPIA is the safer record.

Vendor roles: controller or processor?

A controller decides the purposes and means of processing; a processor acts only on a controller's instructions; two organisations that decide those things together are joint controllers¹³. Which one your vendor is changes your contract and your privacy notice.

If the vendor only uses your visitors' data to provide your reports, it may be your processor, and you need an Article 28 contract (a data processing agreement).
Many visitor identification vendors build and improve their own IP-to-company database from all their customers' traffic. For that use, the vendor is likely to be deciding purposes of its own, which points to it being a controller (or a joint controller with you) for that part.
Where the vendor stores data outside the UK, ask how international transfers are covered.

Ask the vendor to state its role for each use of the data, and check that its own privacy notice and terms say the same. The ICO also reminds website operators that they have primary responsibility for the technologies used on their own sites, including third-party ones¹⁶.

A checklist before you switch a tool on

Find out exactly what the tool does: what it stores and reads on the device, what it sends to the vendor, and what it returns to you.
Decide whether you need company-level data only. Turn off any person-level or contact enrichment you do not need.
Choose and record your lawful basis. For legitimate interests, write the LIA before launch.
Work out whether PECR consent is needed and, if so, add the tool to your consent mechanism under a named category, off by default.
Screen for a DPIA against the ICO's list, and record the outcome either way.
Agree the vendor's role and sign the right contract. Check where the data is stored.
Update the privacy notice in plain words, near the top, with a way to object.
Set a retention period, and review the set-up when the tool or the law changes.

For choosing a tool once the legal groundwork is clear, see our guide to visitor identification software for small B2B teams, and for setting one up, how to see which companies visit your website.

Where Artiweave fits

Company-level visitor identification is in development at Artiweave and not live yet. When it is, we will publish what it processes, our role, and the wording we suggest for your privacy notice, so you can work through the checklist above for it like any other tool.

Frequently asked questions

Is company-level visitor identification legal in the UK?

It can be done lawfully, but it is not automatically lawful. The tool processes IP addresses, which may be personal data, so you need a lawful basis, a clear privacy notice and the right contract with the vendor, and PECR consent if the tool stores or reads information on the visitor's device. This is not legal advice.

Does the new analytics exception in PECR cover visitor identification?

According to the ICO, no. The statistical purposes exception is about how a service is used, not who uses it, and the ICO lists tracking or profiling visitors based on their IP address among the activities that still need consent.

Are sole traders treated differently?

Yes. Information about a limited company is not personal data, but information about sole traders and partners can be, because the business is in effect an identifiable person. A visitor report that names a sole trader may be personal data about that person.

Do I need consent or legitimate interests?

That depends on the set-up. Some organisations rely on legitimate interests for company-level identification, backed by a written legitimate interests assessment; where PECR consent is needed for the tool's cookies or similar technologies, some choose consent for the whole activity. Record the decision before launch.

Sources

ICO pages read in a browser on 3 November 2026; legislation read in its revised form on legislation.gov.uk on 3 November 2026.

Evidence first, and open with your visitors.

Artiweave continuously improves the website your B2B company already has, with every change approved by you and measured honestly. Company-level visitor identification is in development. It is in private beta.

Join the waitlist