Before launching B2B visitor identification, document why you are tracking, what data each tag or vendor collects, which pages and triggers are in scope, how consent or opt-out behavior is configured, where signals move in the CRM, who can access them, how long they are retained, and what sales is allowed to say. Treat this as a privacy-owner review packet, not legal advice or proof of compliance.
Consent mode for visitor identification should be treated as a configuration and routing control, not proof that tracking is lawful or that an anonymous visitor is a named buyer. Before a visitor-identification tag fires or sends signals to sales, document the consent state the tag reads, the cookie or similar technology involved, the trigger scope, the evidence label that will enter analytics or CRM, and the stop rule for sales follow-up. If consent is missing, unclear, or outside the reviewed scope, hold the visitor-identification tag, keep only permitted aggregate or internal review signals, or escalate to the privacy owner before routing anything to sales.
For data minimization in visitor identification, collect only fields tied to a reviewed purpose, source label, owner, access boundary, and retention review.