How company identification works
Every visit arrives from an IP address. Some address ranges are registered to the organisation that uses them: a bank’s head office, a university, a software company with its own network. Look up who holds the range and you know which organisation the visit came from, without knowing who was at the keyboard. This is reverse IP lookup.
Most addresses do not work that way. People at home, on mobile networks, behind VPNs or on cloud desktops share ranges with thousands of others, and the registered holder is the provider. A careful system recognises those ranges and refuses to name a company from them, so match rates are partial. Vendors report company-level matches for roughly 30 to 65 percent of US business traffic, by their own figures.
A second source is first-party. When several people from one company sign up or fill in a form with their work address from the same network, that network can be linked to the company for later visits.
Where the evidence comes from in Demander
| Source | How it works | Limits |
|---|---|---|
| Self-identification | A form or a sign-up with a work e-mail names the company by its domain | Free-mail and disposable domains never name a company |
| Learned prefixes | Network prefixes (/24 for IPv4, /48 for IPv6) where people identified themselves with a business e-mail | Trusted after two different contacts from the same company, kept per workspace, deleted after 180 days without new evidence |
| Registry records | The regional internet registry’s record (RDAP) of who holds the range | Internet providers, mobile carriers, VPNs and hosting pools are filtered out |
| Reverse DNS | The host name the network owner set for the address | Weak evidence, used with low confidence |
| Optional vendors | IPinfo, Dealfront or Snitcher receive the address and return a company | Only if you connect one |
What counts as personal data
The IP address does. In Breyer (C-582/14) the Court of Justice of the EU held that a dynamic IP address is personal data for a party with legal means to identify the person behind it, and whoever runs the tracking script sees raw addresses. Cookie ids, device ids and ad click ids are personal data as well.
Data about a company as such falls outside the GDPR, which protects natural persons. Three things bring it back in. A sole trader’s business is a person. A very small company can make a visit identifiable in practice. And once you join a company visit to a named contact’s record, the result is about that contact.
That is why identification should stop at the company. Person-level de-anonymisation, matching a visit to a named individual from third-party data, has no workable lawful basis for EU visitors: it fails the transparency rules and would need consent nobody gave.
Consent or legitimate interest
Two rules apply to a tracking script in the EU. Article 5(3) of the ePrivacy Directive requires consent for storing or reading information on the visitor’s device unless that is strictly necessary, and the EDPB’s Guidelines 2/2023, final since October 2024, read it broadly enough to cover scripts that make the browser send data for identification, cookies or not. The GDPR then needs a lawful basis for processing the IP address.
| Approach | What it means | Trade-off |
|---|---|---|
| Identify after consent | Companies are identified only for visitors who accepted marketing tracking in your banner | The safest reading of the guidelines; visitors who decline stay anonymous |
| Legitimate interest with an assessment | Every visit is identified at company level under a documented balancing test, disclosed in your notice | The basis most identification tools rely on; leaves some ePrivacy risk that a regulator may not accept |
Either way: company level only, raw IP addresses discarded, provider ranges filtered, the practice named in your privacy notice, and a data processing agreement with every vendor involved. Ad pixels are a separate matter and fire only after consent.
Consent modes in the Demander tracker
The snippet has three modes. Your consent banner calls demander.consent() when the visitor chooses.
| Mode | Before consent | After consent |
|---|---|---|
| Strict (EU default) | Nothing stored on the device; the server counts the visit with a cookieless key that rotates daily | A persistent first-party id |
| Balanced | A per-visit id in sessionStorage | A persistent id |
| Off | A persistent id at once, for sites where consent is collected elsewhere or not required | The same |
Marketing consent is separate from analytics consent. Ad click ids, linking visits to a person and capturing an e-mail typed into a form all need marketing consent. Withdrawing consent deletes what the tracker stored.
How Demander handles identification
Company identification runs only where there is a basis for that visit: the workspace has recorded a completed legitimate interest assessment, or the visitor gave marketing consent. It stays at company level. A visit is linked to a person only when that person identifies themselves, through a form, a sign-up or a reply, and never by inference.
Raw IP addresses are never stored. Demander keeps a salted hash that rotates daily and the truncated prefix (/24 or /48) it needs as a key. Ranges held by internet providers, mobile carriers, VPNs and data centres are filtered out before any company is named.
Global Privacy Control and Do Not Track
Global Privacy Control (GPC) is a browser signal telling sites that the person does not want their data sold or shared. Some US state laws, California’s among them, require sites to treat it as an opt-out. In the EU it has no fixed legal meaning yet, but ignoring an explicit signal is hard to square with a legitimate interest balancing test.
Demander treats GPC and Do Not Track as no marketing consent, whatever the banner says: no click ids, no linking of visits to a person, no capture of form e-mails. GPC also stops company identification for that visit, and a contact who sent GPC on a linked visit is never used to seed lookalike audiences. Do Not Track on its own does not stop company-level identification under a completed assessment.
How long to keep what
-
01
IP addresses
Do not keep them. Truncate or hash at collection; Demander never stores the full address.
-
02
Learned company ranges
Deleted after 180 days without new evidence, and trusted only once two different people from the company have identified themselves.
-
03
Visit data
Keep it only as long as the purpose in your notice needs, and state that period. In Demander it stays until you delete it or the workspace; it does not expire on a schedule, so the period you state is yours to keep.
-
04
Backups
Deleted data leaves Demander’s backups within the backup retention period, 14 days by default.
-
05
Consent records
Keep the time, source and wording of each consent for as long as you rely on it.
A checklist before you switch it on
-
Choose the basis
Consent, or legitimate interest with a written assessment that weighs your interest against the visitor’s. Have counsel look at it for the markets you serve.
-
Update your notice
Name company identification, the sources and vendors it uses, the retention period and the right to object.
-
Pick the consent mode
Strict stores nothing before consent and is the default for EU sites. Wire your banner to the snippet so choices take effect.
-
Sign the agreements
A data processing agreement with Demander and with any identification vendor you connect.
-
Respect the signals
The tracker honours GPC and Do Not Track on its own. Do not override them in other tools, and do not try to identify individuals.
Questions people ask
Is company identification legal in the EU?
It can be, done at company level with a lawful basis and a clear notice. The open question is ePrivacy: identifying only visitors who consented is the safest reading, and legitimate interest with a documented assessment is defensible with some residual risk. Ask your counsel which one you are comfortable with.
Does Demander identify individual visitors?
Never by inference. A visit is linked to a person only when that person identifies themselves, for example with a form or a sign-up, and the tracker links visits to a person only with marketing consent.
Do I still need a cookie banner in strict mode?
Strict mode stores nothing on the device before consent, but you need a banner to get persistent ids, click ids and, if consent is your basis, company identification. The cookieless daily key still processes the IP address and user agent, so it needs a legitimate interest, and some authorities may see it as covered by ePrivacy as well; check with counsel for your markets.
What about visitors from the US?
Company-level identification is low risk under US law. State privacy laws give people a right to opt out, which is what GPC signals, so honour it. Person-level identification of US visitors carries a risk of wiretap-style lawsuits, and Demander does not do it.