Privacy and compliance: visitor identification guides
Review maps, consent-mode decision trees, data minimization and retention schedules to prepare for your legal or privacy owner. These guides do not give legal verdicts.
I need to know which questions our legal or privacy owner must answer before we track.
To hold a visitor-identification script until consent, the consent platform (CMP) must keep it from running until the visitor opts into its category. OneTrust sets the script's type to text/plain with an optanon-category class; Cookiebot uses type="text/plain" with a data-cookieconsent attribute; CookieYes uses a data-cookieyes attribute or a Script URL Pattern. Each CMP holds only what it is wired to hold. A script that runs before the CMP's own blocking script, a Google Tag Manager tag without the vendor's documented consent gate, or a script the automatic blocker has not matched can still fire before consent.
Reviewed September 26, 202621 min read
Is website visitor identification legal? The honest answer is: it depends on what is identified, where the visitor is, and which lawful basis and notice you can actually defend — and that decision belongs to your legal owner, not a vendor's marketing page. This review map walks through the questions that determine the answer: personal data status under GDPR, lawful basis, cookie and tracking-technology rules, US state privacy rights, and the person-level versus company-level line, with links to the primary legal texts and regulator guidance your counsel will want.
Reviewed September 26, 202619 min read
A dated read of eight visitor-identification vendors' own DPAs, subprocessor pages and security pages. It compares controller or processor stance, subprocessor lists and change notice, hosting, transfer mechanism and attestations, and says what each difference means for a privacy review. Every quote comes from a page read on 2026-09-26. No vendor is judged compliant or non-compliant.
Reviewed September 26, 202615 min read
A visitor-identification data retention schedule should set a maximum retention period for each data category the tool collects, tied to why you keep it: raw anonymous page-visit logs need the shortest window, reviewed account-level matches that feed CRM reporting can be kept longer if source-labeled, and any record tied to a specific person needs the shortest, most defensible window of all. GDPR's storage-limitation principle and California's retention regulations both point the same direction: keep personal information only as long as a stated purpose requires it, write the period down, and review it on a schedule. This is a starting template, not legal advice.
Reviewed September 25, 20268 min read
Before launching B2B visitor identification, document why you are tracking, what data each tag or vendor collects, which pages and triggers are in scope, how consent or opt-out behavior is configured, where signals move in the CRM, who can access them, how long they are retained, and what sales is allowed to say. Treat this as a privacy-owner review packet, not legal advice or proof of compliance.
Reviewed September 2, 202615 min read
Consent mode for visitor identification should be treated as a configuration and routing control, not proof that tracking is lawful or that an anonymous visitor is a named buyer. Before a visitor-identification tag fires or sends signals to sales, document the consent state the tag reads, the cookie or similar technology involved, the trigger scope, the evidence label that will enter analytics or CRM, and the stop rule for sales follow-up. If consent is missing, unclear, or outside the reviewed scope, hold the visitor-identification tag, keep only permitted aggregate or internal review signals, or escalate to the privacy owner before routing anything to sales.
Reviewed September 2, 202611 min read
For data minimization in visitor identification, collect only fields tied to a reviewed purpose, source label, owner, access boundary, and retention review.
Reviewed September 2, 202612 min read