How to identify B2B website visitors without cookies

You can find out which companies visit your website without setting a single cookie. The trick is the IP address, which every browser already sends with every request.

Here's how it works, what it misses, and the privacy part people tend to skip.

How IP-based identification works

Every device on the internet talks through an IP address. Each address belongs to a network, and each network has an owner.

Most of the time the owner is an internet provider: Swisscom, BT, Comcast, Vodafone. Sometimes it's a cloud host like AWS or Google Cloud. And sometimes it's a company that runs its own network, like a bank, a manufacturer or a university.

That last group is what B2B teams care about. When someone at one of those companies opens your pricing page from the office, the request comes from an IP that belongs to their employer.

So the process looks like this:

1. A small script on your site tells your visitor ID tool that a page was viewed.
2. The tool reads the IP from the request, on its own server.
3. It looks the IP up in an IP intelligence database (Knownly uses IPinfo).
4. If the network belongs to a business, it saves the company and the page. If it doesn't, the visit gets thrown away.

No cookie gets set, nothing is stored in the browser, and nobody gets fingerprinted. The tool doesn't need to recognise a returning visitor. It only looks at where each page view came from.

The filtering matters more than the lookup

Looking up an IP is easy. Deciding which results to trust is where the work is.

A raw lookup will happily tell you "Deutsche Telekom visited your site 340 times". Those are hundreds of different households sharing one provider. You can't call any of them.

So a decent tool drops:

• home and mobile internet providers
• hosting and cloud providers (mostly bots and scripts)
• VPNs, proxies and Tor
• anycast and CDN networks
• anything whose user agent or hostname looks like a crawler

What's left is shorter, and far more useful.

What you won't see

IP-based identification only works when the visitor is on a company network. Remote workers on home Wi-Fi show up as their internet provider. People on their phones show up as their mobile carrier. Both get filtered out.

It also identifies companies, never people. You'll know someone at Acme read 3 pages about pricing. You won't know who. (For B2B, that's usually enough to decide who to follow up with.)

More on this in why most of your website visitors stay anonymous.

No cookies still means some privacy work

This is the bit to get right, especially if you have visitors in the EU.

Skipping cookies keeps you clear of browser storage and fingerprinting. But EU rules cover more than cookies.

The European Data Protection Board's guidelines on Article 5(3) of the ePrivacy Directive, adopted in October 2024, say the rule can apply to JavaScript that makes the browser send requests with information, and in some cases to tracking based on IP only. Whether you then need consent, or an exemption applies, gets assessed case by case.

In practice:

• Mention it in your privacy notice. Name the tool, say what it collects (IP, page URL, user agent) and why.
• Check whether you need consent for EU visitors. Ask your lawyer or data protection officer. The answer depends on your country and how you use the data.
• Don't try to identify people. Matching company visits to individuals is a different legal situation entirely.

I'm not a lawyer, and this isn't legal advice. But if someone tells you "cookieless means no consent, ever", they're skipping the fine print.

Getting started

If you want to try it:

1. Sign up for Knownly (free during beta).
2. Add your domain and paste the snippet before </head>.
3. Wait for some traffic. Companies show up as they visit, with the pages they read and an intent score from 0 to 100.

Install takes a couple of minutes. Useful data takes a bit longer, depending on how much business traffic your site gets.