Is Website Visitor Identification Legal? GDPR/CCPA Map

Is website visitor identification legal?

"Is website visitor identification legal?" is the question buyers ask vendors, and vendors are the wrong people to answer it. The defensible answer depends on what your deployment identifies, where your visitors are, what your notices say, and which lawful basis your organization is prepared to document and defend. That determination belongs to your legal or privacy owner. What this guide does is map the review so you bring that owner a complete, honest packet instead of a marketing PDF — with links to the primary texts and regulator guidance they will actually use.

To be explicit: this is a review map, not legal advice, and it does not conclude that any tool or configuration is lawful or unlawful anywhere.

The question behind the question: is it personal data?

Under GDPR, everything turns first on whether what you process is personal data. Article 4 defines personal data as information relating to an identified or identifiable natural person, and its definition of identifiers explicitly includes online identifiers. Recital 30 adds that online identifiers — IP addresses and cookie identifiers among them — may, especially in combination, contribute to identifying natural persons.

That framing matters for visitor identification in both directions. A tool that claims to name individual visitors is straightforwardly making a personal-data claim for in-scope traffic. But even "company-level only" deployments typically process IP addresses and device identifiers on the way to a company match, so the processing pipeline can involve personal data even when the sales-facing output is a company name. Your legal owner needs to see the pipeline, not the dashboard. The company-level vs person-level guide explains the evidence difference between those output types; the legal review must cover both the output and the ingredients.

The review map

Copy this table into your review packet and fill in the right-hand column for your actual deployment before the legal conversation.

Review question	Why it decides the answer	Primary reference to hand your legal owner	Your deployment's answer
What data does the pipeline touch (IP, cookies, device IDs, profiles)?	Determines whether GDPR-style personal-data rules apply at all, and where.	GDPR Art. 4; Recital 30.	—
Which visitors are in scope (EU/UK, California, elsewhere)?	Obligations attach to the visitor's protections, not your office address.	GDPR territorial framing; CCPA (California AG).	—
What lawful basis would you document for in-scope processing?	GDPR Art. 6 requires one; the EDPB's SME guidance says decide and document before processing.	GDPR Art. 6; EDPB SME guide.	—
If legitimate interests: has the three-part assessment been done?	The ICO describes a purpose, necessity, and balancing test — a documented assessment, not a checkbox. Recital 47 notes direct marketing may be a legitimate interest, which starts the analysis rather than ending it.	ICO legitimate-interests guidance; Recital 47.	—
Does the tag store or access anything on the visitor's device?	Cookie/storage rules (PECR in the UK, ePrivacy-derived rules across the EU) apply separately from, and in addition to, GDPR lawful basis.	ICO PECR cookies guidance.	—
What do your privacy notice and consent banner actually say?	In the US, the FTC's baseline business expectation is that companies keep the privacy promises they make; a notice that omits visitor identification is a promise problem everywhere.	FTC privacy and security guidance.	—
Does your pipeline sell or share personal information, and does it check for an opt-out signal?	"Sell" and "share" are separate, specifically defined triggers for the same consumer opt-out right, and the regulations require honoring a qualifying browser signal without a separate form.	Cal. Civ. Code §1798.140(ad)/(ah), §1798.120; Cal. Code Regs. tit. 11 §7025.	—
What rights requests can you honor (access, deletion, opt-out), and does your notice at collection say what you actually do?	California's CCPA gives consumers rights over personal information collected about them, and requires disclosure of categories collected and whether they are sold or shared before collection happens.	Cal. Civ. Code §1798.100(a)(1); Cal. Code Regs. tit. 11 §7012; California AG CCPA page.	—
For California visitors: does the tag, or the vendor's script, read what visitors type or send (form fields, chat, session replay), collect addressing data such as IP addresses for a third party, and does it load before consent?	California's Invasion of Privacy Act (CIPA) carries a private right of action with $5,000 per violation and no need to show actual damages, and website tags have been sued under both its wiretap section and its pen-register section.	Cal. Penal Code §§631(a), 637.2, 638.50(b), 638.51; SB 690 (2025-26); the court documents in the CIPA section below.	—
Is the output company-level or person-level, and per which geography?	Vendors themselves draw jurisdictional lines — RB2B's homepage scopes person-level output to US IPs. Your obligations follow what is actually produced where.	Vendor documentation, verified in writing.	—

What do "sale" and "sharing" mean under the CCPA, specifically?

The California AG's overview page is a fine starting point, but the operative text for a visitor-identification deployment is the statute itself. The CCPA defines "sell" and "share" separately, and a vendor relationship can trigger either one on its own.

"Sell" means disclosing personal information to a third party "for monetary or other valuable consideration" (Cal. Civ. Code §1798.140(ad)). Paying a visitor-identification vendor a subscription fee in exchange for matched names or companies is disclosure for consideration on your side of the relationship, and depending on how the vendor's own data changes hands, the vendor's sourcing can independently be a sale on its side — that is a question for your legal owner and the vendor's data-processing terms, not something this guide concludes. "Share" is defined separately and does not require money to change hands at all: it means disclosing personal information to a third party "for cross-context behavioral advertising" (§1798.140(ah)). A retargeting pixel that feeds an ad network is a share under that definition even when no invoice exists.

Both definitions point at the same consumer right. Section 1798.120 gives a consumer "the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information." Two regulatory mechanics follow from that right, and both are things a deployment either does or does not do — they are not judgment calls:

• Notice at collection. The statute requires telling consumers, at or before collection, what categories of personal information will be collected and whether that information is sold or shared (§1798.100(a)(1)). The CPPA's regulations add the operational detail: the notice must be "readily available where consumers will encounter it at or before the point of collection," naming categories, purposes, sale/sharing status and retention criteria (Cal. Code Regs. tit. 11 §7012).
• Opt-out preference signals. A business that sells or shares personal information must treat a qualifying signal sent by the visitor's browser as a valid opt-out request, without requiring a separate visit to a form (Cal. Code Regs. tit. 11 §7025). The Global Privacy Control is the signal the CPPA names by name as an example of one that qualifies (cppa.ca.gov FAQ). If your visitor-identification pipeline has no step that checks for this signal before a match is made or shared onward, that gap belongs in the review packet the same way a missing lawful-basis decision does on the GDPR side.

None of this tells you whether your specific deployment sells or shares personal information, or what your notice should say — that turns on your vendor contract, your ad-tech stack, and what your privacy notice currently discloses, all of which your legal owner needs to see directly.

California's wiretap and pen-register claims (CIPA)

Besides the CCPA, website tags in California face lawsuits under the state's Invasion of Privacy Act, a wiretap statute written for telephone lines. This section sets out what the statute text and the court documents say, as of 2026-09-26. It is a map for your legal owner, not a verdict on any tool, and several of the questions are still being decided.

What the statute says.

• Wiretap, §631(a). It covers anyone who, without the consent of all parties to a communication, reads or attempts to read or learn its contents while it is in transit, and anyone who aids or conspires in that. It is written for telegraph and telephone lines. In Javier v. Assurance IQ (9th Cir. 2022, No. 21-16351, an unpublished memorandum), the Ninth Circuit said §631(a) applies to internet communications and predicted that the California Supreme Court would require consent before the recording: agreeing to a privacy policy after the session was recorded did not count.
• Pen register, §638.51. Since 2016, a person may not install or use a "pen register" or "trap and trace device" without a court order; the only exceptions are for communication-service providers, including where the service's user has consented. §638.50(b) defines a pen register as a device or process that records "dialing, routing, addressing, or signaling information", but not the contents of a communication.
• Damages, §637.2. Anyone injured by a violation of the chapter may sue for the greater of $5,000 per violation or three times actual damages, and actual damages are not a prerequisite. The three federal cases below were all filed as class actions.

What the courts have said about website tags.

• The vendor as the site's tool, or as a third party. In Graham v. Noom (N.D. Cal. Apr. 8, 2021, No. 20-cv-06903-LB, Dkt. 51), the court dismissed, with leave to amend, a §631 claim over a session-replay vendor (FullStory on noom.com), because there were no allegations that the vendor used the data itself: it was an extension of the site, like a tape recorder. The court contrasted vendors that mined data from many sites and sold it. For a visitor-identification tool the practical question is the same: does the vendor use your visitors' data for its own purposes, for example to build the identity graph it sells to other customers?
• IP addresses as pen-register data, at the pleading stage. In Shah v. Fandom (N.D. Cal. Oct. 21, 2024, No. 24-cv-01062-RFL, Dkt. 34), the court denied a motion to dismiss a §638.51 claim about third-party trackers that sent visitors' IP addresses to ad-tech companies. It held that the plaintiffs had plausibly alleged the trackers were pen registers and that visitors had not agreed to the dissemination by visiting the site. That is a ruling on the complaint's allegations, not a finding of liability.
• A contrary tentative view in the state appeals court. In Variety Media, LLC v. Superior Court (Cal. Ct. App., 2d Dist., Div. 3, No. B350578), the court issued a tentative ruling ahead of oral argument (the copy we read is labeled 2026-08-21). It tentatively agreed that the pen-register definition reaches internet communications, but concluded that a visitor's IP address identifies the source of a communication, not its destination, so collecting it did not state a pen-register claim; it proposed leave to amend. A tentative ruling is not an opinion and can change. We found no filed opinion on the court's published-opinions page on 2026-09-26.

A bill waiting for the Governor. SB 690 (2025-26) passed the Legislature on 2026-08-28 and was presented to the Governor on 2026-09-04; on 2026-09-26 the official bill history shows no action since. As enrolled, it amends §637.2 so that a pen-register claim under §638.51 against a private actor, arising from conduct on a website or app, can be brought only by the Attorney General, and applies that to pending claims in actions filed within two years before it takes effect. It does not change §631 wiretap claims.

Questions for your legal owner, each answerable from your own deployment:

1. Which scripts on the site read content visitors type or send (form fields before submit, chat, session replay), and which only receive addressing data such as IP address and URL?
2. Does any of them load for California visitors before the visitor has consented? §631 claims turn on consent before the recording, not after.
3. Does each vendor use the data only for you, or also for itself (an identity graph, data sold to other customers)? The contract and the vendor's DPA answer this; the vendor DPA comparison shows which published terms make the vendor a controller for part of the data.
4. If SB 690 is signed, which of your exposures does it change (pen-register claims by private plaintiffs) and which does it not (wiretap claims, the CCPA)?

Person-level identification: where caution concentrates

The sharpest legal questions in this category attach to person-level identification of visitors who never filled out a form. Notice what the market itself tells you: at least one prominent person-level vendor publicly limits its identification output to US IP traffic on its own homepage. That is a vendor drawing a jurisdictional line in public. Whatever tool you evaluate, make the vendor state in writing what depth of identification it produces in each geography you receive traffic from, and hand that statement to your legal owner unedited.

Two practical corollaries. First, never let a person-level claim launder itself into outreach that pretends the person consented — the no-contact decision tree exists because "technically obtainable" and "safe to act on" are different tests. Second, if your deployment cannot explain how a person would exercise rights over their data (access, deletion, opt-out), that is a finding for the review packet, not a detail to skip.

What a defensible deployment tends to include

Across the regulator guidance cited here, the recurring expectations are boringly consistent, and they map to work this site covers in implementation depth:

• A documented decision: what you process, why, under which basis, decided before the tag ships (EDPB's ordering, not ours). The privacy checklist is the working version of that packet.
• Consent plumbing that matches the decision: if your counsel concludes consent is required for storage/access or for the vendor's processing, your tag must actually respect it — the consent mode decision tree covers the mechanics.
• Minimization: keeping only fields sales can use safely shrinks both risk and review time — the data-minimization guide has the field-by-field method.
• Vendor paper: data-processing terms, sub-processor lists, retention and deletion behavior — the core of the vendor due-diligence checklist. The vendor DPA comparison shows where eight vendors' published terms differ, including which ones take a controller role for part of the data.
• Honest notices: your privacy notice describes what actually happens, in language a visitor could understand.

If a vendor's answer to any of this is a compliance badge on a pricing page, treat that as the beginning of diligence. Comparison shopping is the moment you have leverage to demand real documentation — the Leadfeeder vs Lead Forensics comparison grid builds those proof requests into the buying decision itself.

Claim ledger

Claim used in this guide	Source boundary	Review rule
GDPR defines personal data to include online identifiers; Recital 30 names IP addresses and cookie identifiers as identifiers that may contribute to identification.	GDPR Art. 4 and Recital 30 texts, observed 2026-09-13.	Quote the definition; never conclude scope for a specific deployment.
GDPR Art. 6 lists lawful bases including consent and legitimate interests; Recital 47 notes direct marketing may be a legitimate interest.	GDPR Art. 6 and Recital 47 texts, observed 2026-09-13.	Present as the menu the legal owner chooses from, never as a conclusion.
The ICO describes a three-part legitimate-interests assessment and treats cookies/storage tech under PECR separately from lawful basis.	ICO guidance pages, observed 2026-09-13.	UK-specific guidance; other regulators may differ — flag, don't generalize.
The EDPB SME guide expects a documented lawful-processing decision before processing.	EDPB SME guide, observed 2026-09-13.	Use for ordering (decide first), not for outcome.
California's CCPA provides consumer privacy rights; the FTC expects companies to keep their privacy promises.	California AG CCPA page and FTC business guidance, observed 2026-09-13.	Flag as US review topics; make no compliance determinations.
The CCPA defines "sell" (disclosure for monetary or other valuable consideration) and "share" (disclosure for cross-context behavioral advertising, with or without consideration) separately, and gives consumers the right to opt out of either at any time.	Cal. Civ. Code §1798.140(ad)/(ah) and §1798.120, observed 2026-09-25.	Explain the two triggers for the same right; never conclude whether a specific deployment sells or shares.
The CCPA requires notice at collection naming categories, purposes and sale/sharing status; the CPPA's regulations require honoring a qualifying opt-out preference signal (e.g., Global Privacy Control) without a separate form.	Cal. Civ. Code §1798.100(a)(1); Cal. Code Regs. tit. 11 §§7012, 7025; cppa.ca.gov FAQ, observed 2026-09-25.	Describe the mechanics as requirements, not as a statement that any deployment meets them.
RB2B publicly scopes person-level output to US IP traffic.	Current RB2B homepage, observed 2026-09-13.	Used as evidence that vendors draw jurisdictional lines, nothing more.
Cal. Penal Code §631(a) covers reading or learning the contents of a communication in transit without the consent of all parties; §638.51 bars installing or using a pen register without a court order, with provider exceptions including user consent; §638.50(b) defines a pen register as recording addressing or signaling information but not contents; §637.2 allows the greater of $5,000 per violation or treble damages, without actual damages.	Official statute text on leginfo.legislature.ca.gov, read 2026-09-26.	Paraphrase and cite; never state that a tool is or is not a pen register.
Javier v. Assurance IQ (9th Cir. 2022): §631(a) applies to internet communications; consent must come before the recording.	Ninth Circuit memorandum No. 21-16351, filed 2022-05-31, not precedent under 9th Cir. R. 36-3; read 2026-09-26.	Label as unpublished.
Graham v. Noom (N.D. Cal. 2021): a session-replay vendor with no allegation it used the data itself was an extension of the site, not a third-party eavesdropper.	Order, No. 20-cv-06903-LB, Dkt. 51, filed 2021-04-08, govinfo.gov; read 2026-09-26.	One district court's reasoning; used to frame the vendor-use question.
Shah v. Fandom (N.D. Cal. 2024): motion to dismiss a §638.51 claim over IP-collecting trackers denied.	Order, No. 24-cv-01062-RFL, Dkt. 34, filed 2024-10-21, CourtListener RECAP copy; read 2026-09-26.	Pleading-stage ruling only.
Variety Media v. Superior Court (Cal. Ct. App. No. B350578): tentative ruling that an IP address identifies the source, not the destination, so collecting it did not state a pen-register claim.	Court's tentative ruling ahead of oral argument (copy labeled 2026-08-21), hosted by a plaintiffs' firm blog (cipaworld.com); no filed opinion found on courts.ca.gov on 2026-09-26.	Always call it tentative; replace with the opinion when filed.
SB 690 (2025-26) passed 2026-08-28, presented to the Governor 2026-09-04; enrolled text limits website and app §638.51 claims against private actors to the Attorney General, retroactive to pending claims in actions filed within two years.	Official bill history and enrolled text, leginfo.legislature.ca.gov, read 2026-09-26.	Recheck the Governor's action by 2026-10-05 and update.
No statement in this guide concludes any tool or deployment is legal or illegal.	Not applicable.	Preserve this boundary in every edit.

FAQ

So is website visitor identification legal or not?

There is no universal yes or no. Company-level and person-level identification raise different questions; EU/UK and US visitors trigger different rules; and the defensibility of any deployment depends on lawful basis, notices, storage-technology handling, and rights-request plumbing that only your legal owner can sign off. The review map above is how you get to your answer.

Is identifying companies (not people) automatically fine under GDPR?

Do not assume so. Even when the output is a company name, the pipeline typically processes IP addresses or similar online identifiers, which GDPR's own recitals recognize as potential contributors to identifying natural persons. The pipeline, not the dashboard, is what the legal review must see.

Does "legitimate interest" cover B2B visitor tracking?

Legitimate interests is one of the Article 6 bases, and Recital 47 notes direct marketing may qualify — but the ICO's guidance describes a documented three-part assessment (purpose, necessity, balancing), and storage/access technologies are regulated separately under PECR-style rules regardless of the basis you choose. "We have a legitimate interest" is a claim you document, not a phrase you cite.

What about visitors from California?

California's CCPA gives consumers rights over personal information collected about them, and the state Attorney General publishes an accessible overview, but the operative text is the statute and the CPPA's regulations. If your pipeline sells personal information for consideration or shares it for cross-context behavioral advertising, the consumer has the right to opt out at any time (Cal. Civ. Code §1798.140, §1798.120), your notice at collection has to say so before you collect it (§1798.100(a)(1); Cal. Code Regs. tit. 11 §7012), and you must honor a qualifying opt-out preference signal such as the Global Privacy Control without making the visitor find a form (Cal. Code Regs. tit. 11 §7025). Your review should establish what personal information the tool collects on California visitors, whether that collection is a sale or a share under the statutory definitions, and how you would honor rights requests and preference signals. Other US states have their own laws — enumerate your traffic geography honestly for your counsel.

Does SB 690 end CIPA risk for visitor identification?

No, even if it is signed. As enrolled it only removes private lawsuits for pen-register claims (§638.51) about websites and apps, leaving them to the Attorney General. Wiretap claims under §631, which concern reading what visitors type or send without prior consent, are unchanged, and so is the CCPA. On 2026-09-26 the bill was with the Governor; check the official bill history for the outcome.

What should we bring to our lawyer before buying a tool?

The filled-in review-map table, the vendor's written statement of identification depth per geography, the vendor's data-processing documentation, your current privacy notice, and your consent-banner configuration. That packet — plus the privacy checklist — turns a vague "is this okay?" into a review your counsel can actually complete.