# See which companies visit, within the consent they gave

> A small tracker that respects consent, honours Global Privacy Control and Do Not Track, names companies only where that is lawful, and records one touch per visit with the campaign, post or e-mail behind it.

One snippet records visits, the pages that signal intent and the campaign, post or e-mail that brought each visitor. In strict mode it stores nothing on the device before consent, it treats Global Privacy Control as a refusal, and it names a company only where you have a lawful basis to.

## The snippet

```html
<script>window.demander=window.demander||{q:[]};['init','track','identify','consent','page'].forEach(function(m){
window.demander[m]=window.demander[m]||function(){window.demander.q.push([m].concat([].slice.call(arguments)))}})</script>
<script async src="https://app.demander.to/t/demander.js" data-site-key="pk_…" data-endpoint="https://app.demander.to" data-consent-mode="strict"></script>
```

Paste it into the head of every page; Website tracking, Add site gives you the snippet with your own site key. Calls made before the script loads are queued and replayed. The script is under 5 KB gzipped and loads asynchronously.

## Three consent modes

| Mode | Before consent | After consent |
| --- | --- | --- |
| strict (the EU default) | Nothing stored on the device. The server works with a cookieless key that rotates daily. | A persistent first-party id |
| balanced | A session id in sessionStorage | A persistent first-party id |
| off | A persistent id at once, for sites where consent is handled elsewhere or not needed | The same |

Call demander.consent() from your consent banner. Global Privacy Control and Do Not Track always count as no marketing consent. Ad click ids such as gclid, fbclid and li_fat_id are kept only with marketing consent, and withdrawing consent deletes what the tracker stored.

## What the tracker records

- **Page views.** Including single-page apps and hash routes: the tracker follows history changes and the back and forward buttons.
- **Engagement.** Scroll depth, outbound clicks, downloads, video plays and completions.
- **Forms.** Form starts and submits. The only form value ever captured is the e-mail field, and only when you switch form capture on and the visitor gave marketing consent.
- **Intent pages.** Pricing, demo, docs, case studies, comparisons, careers and blog pages, classified on the server from the URL in several languages, with the page title as a fallback.
- **Where the visit came from.** UTM parameters and, with marketing consent, ad click ids from the landing URL.

## Companies by default, people only when they say who they are

Company identification runs only with a documented legitimate interest assessment for the workspace or the visitor’s marketing consent, and never when the browser sends Global Privacy Control. Visits through internet providers, mobile carriers and data centres are filtered out. IP addresses are never stored raw: Demander keeps a salted hash that rotates daily, and a truncated prefix (/24 for IPv4, /48 for IPv6) for the lookup.

Demander first uses evidence it owns: IP ranges registered to the company itself in the internet registries, prefixes your own contacts have identified themselves from (trusted once two different contacts back the same company, kept for 180 days), and reverse DNS as weak evidence. Dealfront, IPinfo and Snitcher can be connected on top.

A person becomes known only by identifying themselves: a form, an identify() call with marketing consent, or a reply. The public tracker can never grant e-mail consent. An opt-in ticked on your site sends a double opt-in e-mail, and consent is recorded only when the person confirms.

## From a visit to a touch

1. **Batches.** Events go to Demander in small batches every few seconds, and with sendBeacon when the page closes.
2. **One touch per visit.** The first batch of a visit creates one touch for its source: a campaign and ad, an organic post, a sequence step or a referrer. Later batches merge into it (pages, strongest intent, demo flag, the contact once known), and a form fill turns it into a form touch.
3. **Lineage.** Paid clicks resolve to the campaign and ad through utm_campaign and utm_content, organic posts through utm_medium, and e-mail clicks through the sequence and step tags in your outreach links.
4. **Signals and score.** The account gets intent signals that fade over time and feed its score, its lifecycle stage and the [retargeting](https://demander.to/features/retargeting/) lists.

> **The legal detail.** The [cookie notice](https://demander.to/legal/cookies/) and the guide to [company identification and GDPR](https://demander.to/resources/company-identification-gdpr/) explain the lawful bases. Landing pages and the hosted blog that Demander serves include your tracker already.

## Questions

**Does the tracker store anything before consent?**

In strict mode, nothing on the device: the visit is held in memory and the server derives a key that changes daily. In balanced mode it keeps a session id in sessionStorage. After analytics consent it sets a persistent first-party id.

**Can Demander tell me which person visited?**

Only when that person identified themselves, for example through a form or a reply. Anonymous visits stay anonymous, and identification by IP stops at the company.

**Will it slow my site down?**

The script is under 5 KB gzipped and loads asynchronously. Conversion rules are limited in length and complexity, so a rule cannot slow a page down.

**Do we need a legitimate interest assessment?**

For company identification without marketing consent, yes. The workspace records that the assessment is done; without it, companies are identified only for visitors who gave marketing consent.

## Related

- [Conversion tracking](https://demander.to/features/conversion-tracking/)
- [Attribution](https://demander.to/features/attribution/)
- [Company identification and GDPR](https://demander.to/resources/company-identification-gdpr/)
- [Security and data](https://demander.to/security/)
- [Tracking snippet notice](https://demander.to/legal/cookies/)

---
Source: https://demander.to/features/website-tracking/ · Demander · reviewed 2026-10-02