Can you see who visits your website

You can see the visit.
The name is theirs to give.

Yes, you can see the visit. No, you can’t see the visitor, unless they tell you who they are. A site can see where a visit came from, which device it used and which pages it read. A name or an email appears only when the visitor types one into a form, a chat or a booking, or logs in. Tools that name anonymous visitors are matching the visit against someone else’s data. Here is what you can know at each step, what you owe visitors, and how to set it up with Builderify User Journey.

See what you can know Start free
An IP address Names nobody it addresses a connection

By the Builderify team Not legal advice

01 A visit brings a place, a device and a source 02 Reading on adds pages, still no name 03 A name arrives when they give one
01 / The short answer

Can you see who visits
your website?
The visit, yes. The name, no.

You can see what a visit looks like, not who is behind it. Every visit tells your site the visitor’s IP address, the device and browser, the page they asked for and, usually, the page that sent them. From that, a tool can work out a country and often a city. A counting script adds which pages they read and for how long. None of it includes a name.

A name arrives only when the visitor hands it over: in a form, a chat, a booking or a login. Until then a visitor is a line on a timeline, or a label such as “Silver Kestrel”. That isn’t a limit of your tool. It is how the web works, and how the law treats it.

Any visitor, any siteChecked 29 October 2026
You can see
  • Their country, and sometimes their city
  • Their device and browser
  • The page that sent them
  • The pages they read, in order
  • Whether the same browser came back
You can’t see
  • Their name, email or phone number
  • Their employer, from an IP address alone
  • Which person in a home or an office
  • What they do on other sites
Only if they tell you
  • A name, email or phone number, typed into a form, chat, booking or login
  • Their company, from a work email or a field they fill in
  • Who they are in your own customer records, once they log in
Why every site has the address
Court of Justice of the EU, press release on the Breyer judgment, 19 October 2016

“When a website is consulted, the IP address of the computer seeking access is communicated to the server on which the website consulted is stored.”

So you always have the address. What it tells you is the question: it points at a connection, which can be a home, an office, a phone network or a VPN, not at a person.

02 / What a site sees

What your website sees
about every visitor.

Most of what arrives with a visit is about the connection and the device. Only the last two rows can name a person, and only if the visitor gives them. Here is where each one comes from and how far to trust it.

What a website sees about a visitor, where it comes from, how far to trust it and whether it names a person
What you seeWhere it comes fromHow far to trust itNames a person?
IP address Sent with every request, so the page can find its way back. Exact, but it addresses a connection: a home, an office, a phone network or a VPN. No
Country Looked up from the IP address in a location database. About 99.8% right, by MaxMind’s own estimate. A VPN shows the VPN’s country. No
City The same lookup. A guess: about two in three US cities are right within 50 km. Never a street or a household. No
Device, browser and screen Sent by the visitor’s browser. Reliable for what it is: a type of device, not a person. No
Language and time zone Also sent by the browser. A hint. A VPN user’s time zone can disagree with the country of their address. No
Where they came from The page that sent them, or the tags on the link. Often missing. A visit without a referrer is counted as direct. No
Pages and time on each A counting script on your pages. Exact for the visitors it counts. No
Whether they came back An ID kept in their browser. The same browser only, and only until they clear it. No
Internet provider, VPN, data centre A network lookup on the IP address. Good at flagging the kind of connection. Says nothing about who. No
Name, email, phone What the visitor types. As true as what they typed. Yes, if they give it
Employer A work email, or a field they fill in. Only if they tell you. Yes, if they give it

An IP address names nobody, and it is still personal data. The European Commission lists an IP address and a cookie ID among its examples of personal data. Google’s own help says they aren’t what it calls PII, but “may still be considered personal data” under the GDPR. So “I can’t tell who they are” doesn’t mean “no rules apply”: chapter 05 has the rest. European CommissionGoogle

Google Analytics won’t show you a name either. Google forbids sending it names or email addresses, and in GA4 an IP address is used to work out the location and then discarded before anything is logged. For the names, see the next chapter. For more on the paths of single visitors, see the user journey tracking guide. Google PIIGoogle GA4 IPs

03 / The ladder

Who is visiting my website?
What you can know at each step.

Each step up the ladder adds one thing you know and one thing you owe. Pick how far a visitor went. The panel shows what you can see, what you still can’t, and what to do with it. Under it, ask about one thing at a time.

How far did the visitor go?Step 1 of 4
Step 1 of 4

Anonymous visit

How a visitor gets here: Nothing to do. It happens on every visit.

In User JourneyCounted in your totals, with no page of its own.
  • Place The country, from the IP address. A city only when the lookup finds one. Yes
  • Device Mobile or desktop, the browser and the system. Yes
  • Source The site, search, ad or tagged link that sent them, or none. Yes
  • Pages Added to your totals. No path for this one visitor. No
  • Comes back Not recognised. Tomorrow they look new. No
  • Name Not known. No
You still can’t know
  • Who they are, or whether they came before.
  • Which pages this one visitor read, and in what order.
  • Their company, from an IP address alone.
What to do with it
  • Count and compare: sources, pages, countries and devices.
  • Tell visitors what you count. An IP address is personal data in the EU, the UK and California, so even a bare count belongs in your privacy notice.European CommissionICOCalifornia
  • Counting that stores nothing on the visitor’s device has nothing to ask a yes for. Check how your tool recognises a repeat visit: the EDPB reads “access” to a device widely.EDPB
1 / 4
Step 2 of 4

Allowed analytics

How a visitor gets here: The visitor allows analytics, or no banner asked them. An ID is kept in their browser.

In User JourneyA visitor page with a readable label, such as Silver Kestrel.
  • Place The country, and the city when the lookup finds one. Yes
  • Device Mobile or desktop, the browser and the system. Yes
  • Source The source that first brought them, and the page they landed on. Yes
  • Pages Each page in order, with the time spent on it. Yes
  • Comes back Yes, in the same browser, until they clear it. Yes
  • Name Not known. A made-up label stands in for it. No
You still can’t know
  • Who they are. An ID follows a browser, not a person.
  • That the phone and the laptop are one person.
  • Anything from before they cleared their site data.
What to do with it
  • EU and UK: ask first. The ICO says its statistics exception “is not for identifying, tracking or monitoring people or groups of people who use your service”.ICO
  • US: state privacy laws don’t ask for a yes to run analytics, but they do ask you to say what you collect.Legal 500
  • Keep what you record short, and be ready to delete a visitor who asks.
2 / 4
Step 3 of 4

Gave their details

How a visitor gets here: The visitor types an email or a name into a form, a chat, a booking or a popup.

In User JourneyThe made-up label turns into their email.
  • Place The country, and the city when the lookup finds one. Yes
  • Device Mobile or desktop, the browser and the system. Yes
  • Source The source that first brought them, and the page they landed on. Yes
  • Pages Their earlier pages too, if they had allowed analytics. If allowed
  • Comes back In the same browser, if they had allowed analytics. If allowed
  • Name Whatever they typed: an email, maybe a name or a phone number. Yes
You still can’t know
  • Whether it is real. Anyone can type someone else’s email.
  • What they read before, if they refused analytics: those pages stay anonymous.
  • What they didn’t type, such as their employer, role or budget.
What to do with it
  • Use it for what the form said it was for, such as answering the enquiry or sending what they asked for.
  • Tell them, where you ask, what you will do with it, how long you keep it and who it is shared with.ICO
  • Keep the details together with the page they came from, so “where did this person come from?” has an answer.
3 / 4
Step 4 of 4

Logged in

How a visitor gets here: The visitor signs in to an account you run, such as a shop, a members area or a client portal.

In User JourneyYou pass their email to your tracking when they sign in.
  • Place The country, and the city when the lookup finds one. Yes
  • Device Mobile or desktop, the browser and the system. Yes
  • Source The source that first brought them, and the page they landed on. Yes
  • Pages On every device where they sign in, if you record it against the account. Yes
  • Comes back Across devices, because the account is the same one. Yes
  • Name Your own customer record. Yes
You still can’t know
  • What they do on other sites.
  • Anyone who browses without signing in.
  • Anything they did before signing in, unless an ID was already in their browser.
What to do with it
  • Use the account’s details for the account and the service they signed up for.
  • If you also link their browsing to the account, say so in your privacy notice.ICO
  • Don’t send their name or email to Google Analytics. Google’s policies count full names and email addresses as PII, which its contracts say you may not pass to it.Google
4 / 4

Or ask about one thing.

Each answer says from which step you can know it. Press a step to see it on the ladder.

  • Which country are they in?

    From the IP address, and usually right: MaxMind, a supplier of this data, estimates 99.8%. A VPN shows the VPN’s country, not the visitor’s.

  • Which city?

    A guess. For US addresses MaxMind estimates about two in three are right within 50 km, and says the data is “never precise enough to identify or locate a specific household, individual, or street address”.

  • What device and browser?

    Sent by the browser with every visit. It describes a kind of device, not a person.

  • How did they find me?

    From the page that sent them, or the tags on the link. Often missing: a visit with no referrer is “direct”, which the direct traffic guide unpicks.

  • Which pages did they read?

    Totals work without an ID. The path of one visitor needs an ID kept in their browser.

  • Did they come back?

    Needs an ID in their browser, so it recognises the same browser and nothing more.

  • What is their email?

    Only what they type, and only as true as what they typed.

  • What is their name?

    From a form, a chat, a booking or your login. Nothing about the visit says it.

  • Which company are they from?

    Only if they say so, for example with a work email. A match from the network is a guess about the network, not about the person (chapter 04).

  • What have they bought?

    From your shop or your accounts, where you already know who is signed in.

  • Who are they, if they never told me?

    Nobody honest can say. A data-broker match is someone else’s record of them, not something they told you.

    Never
04 / Tools that name visitors

Can you see which company
visits your website?

Sometimes: when the visit comes from an office network that a database can match to a company. A person only if a vendor matches your visitor to its own profile of them. Neither reads a name off your site. What follows is from the vendors’ own pages, read on 29 October 2026.

Company

A company, from the network

How it works

The visit’s network address is matched against a database of companies. Leadinfo describes it as analysing “the network connection (IP, ASN, location)” and matching it with a European business database of 220 million organisations.Leadinfo

What you get

A company’s name, size and sector for a visit that comes from its office network, and the pages that company read.

What it can’t do

Name a person, or match a visit from home, a mobile network or a VPN. Leadinfo says mobile visits are attributed to the operator, not the visitor’s employer, and puts its own identification rate at 35 to 40% of website traffic. Leadfeeder says individual visitors are not shown by default.LeadinfoLeadfeeder

The catch

An IP address is personal data (chapter 02), so you and the vendor still have duties, and the visitor still has to be told.ICO

Person

A person, from a data match

How it works

A tag on your pages sends the visitor’s IP address, browser fingerprint, page URL, referrer and timestamp to the vendor, which matches them against its own data graph. A reseller’s addendum lists what can come back: a first and last name, a business email, a LinkedIn URL and a job title.Syft Data

What you get

A name and a work email for some visitors, when the match works.

What it can’t do

Cover visitors outside the US. RB2B says its database only holds profiles matched to US home addresses, and that it uses “IP ringfencing to only resolve US traffic”.RB2B

The catch

The visitor never told you. RB2B’s terms say the service may amount to a “sale” of personal information under some state laws, and give you wording for your privacy policy about online data partners that “associate these activities with other personal information they or others have about you”, plus an opt-out link.RB2B terms

Name given

A name they gave you

How it works

The visitor types it into something you made: a form, a chat, a booking, a popup or your login.

What you get

The name or email they chose to share, tied to the pages they read if they had allowed analytics.

What it can’t do

Reach visitors who never type anything.

The catch

The duty is the usual one: tell them, where you ask, what you will do with the details (chapter 05).ICO

Which one do you need? If you want to know which pages and sources turn visitors into leads, you don’t need a name at all: tie each lead to the pages that came before it (chapter 06). If you sell to companies and want to know which accounts visit, a company-level tool is the usual route: ask the vendor where it stores data, what it relies on to process visits and how a company can opt out. Before you add a tag that names individuals, read the vendor’s own compliance page. It says what you must disclose and where it does not run.

05 / What you owe

Is it legal to see
who visits your website?
Yes. What you do next has rules.

Counting visits is normal. The rules cover what you keep, how you follow people and what you tell them. Four things to know, from the primary texts and the regulators’ own pages.

Checked 29 October 2026
General information, not legal advice. For your own site, read the sources or ask whoever advises you.
Four dutiesChecked 29 October 2026
  1. 01

    An IP address is personal data.

    The European Commission lists an IP address and a cookie ID among its examples of personal data. In 2016 the Court of Justice held that a dynamic IP address can be personal data for a website operator that has the legal means to identify the visitor. The ICO’s test is whether you can “distinguish an individual from other individuals”, whether or not you know their name. California’s privacy law names “Internet Protocol address” among the identifiers that count when they can reasonably be linked to a consumer or household. So “I can’t tell who they are” doesn’t switch the rules off.

    European CommissionCourt of JusticeICOCalifornia
  2. 02

    Following one browser needs a yes in the EU and the UK.

    Counting how many people read a page is statistics. Recognising one browser from visit to visit is tracking. The ICO says its statistics exception “is not for identifying, tracking or monitoring people or groups of people who use your service”. In the EU, storing an ID on a visitor’s device needs a yes unless it is strictly necessary, and the French CNIL says most large audience-measurement tools fall outside its narrow exemption. US state privacy laws don’t ask for a yes to run analytics; they ask you to say what you collect. The cookie banner guide sets out the rules place by place.

    ICOCNILLegal 500
  3. 03

    Tell people what you keep.

    The ICO says people must be given your purposes, “your retention periods for that personal data, and who it will be shared with”, at the time you collect it. For a counting tool, that means naming it, saying what it records, saying how long you keep it, and saying what happens when someone gives you an email.

    ICO
  4. 04

    Treat an anonymous visitor as anonymous.

    Don’t match their IP address or browser against other lists to put a name on them. That is the step the data-match tools in chapter 04 sell, and the one that brings their disclosure and opt-out duties. If someone wants to be known, a form is how they say so.

    RB2B terms
06 / In Builderify

How to see who visits your website
in Builderify.

Journey names a visitor when they give you a name, and never from an IP address. User Journey turns each visit into a readable profile: where, on what, from where, and which pages. It does what chapter 03 describes, and nothing more.

Followed
Who

Allowed analytics. With Wait for cookie consent off, that includes visitors who haven’t been asked.

What you get

A visitor page with a readable label, a place, a device, a source and a timeline of pages. The label turns into their email when they give one.

Counted
Who

Said no, or sent Global Privacy Control. With Wait for cookie consent on, also visitors who haven’t answered yet.

What you get

Added to your totals with no cookie and no stored ID. No page of their own, and not recognised from one day to the next.

Skipped
Who

Sent Do Not Track, while Respect Do Not Track is on. It is on by default.

What you get

Not recorded at all, not even in the totals.

  1. 01

    Turn on User Journey and set the privacy switches

    Switch on User Journey for your website, then open its Settings. Respect Do Not Track is on by default. If you have visitors in the EU or the UK, switch on Wait for cookie consent: nothing is followed until a visitor allows analytics in your Builderify cookie banner. Leave Count everyone else anonymously on to keep your totals complete without any cookie.

  2. 02

    Let visitors give you a name

    Any popup, form, quiz, booking or chat that collects an email ties it to the visitor: their label turns into the email and the signup appears on the page where it happened. On your own sign-in, call the line shown here once the person is known. Only the first email counts, and visitors who are only counted can’t be named.

    Two ways to give a visitor a name
    A popup, form, quiz, booking or chat
    maria@example.com
    Silver Kestrelmaria@example.com
    Your own sign-in, once you know who it is
    builderify('track', 'email', user.email);
  3. 03

    Read one visitor

    Open a visitor to see their label or email, where they are, what kind of connection and device they use, the source that first brought them and each visit as a timeline of pages. Their IP address is kept cut down to its network, never in full. For what the timeline can teach you, see the user journey tracking guide.

  4. 04

    Keep it short, and delete on request

    Under Keep data for choose 7, 14 or 30 days: older visitors, visits and pages are deleted every night. A button on the visitor’s page deletes their profile and every page they visited. Open the exclusion link once in each browser your team uses, so you don’t count yourselves.

Visitors who say no are still counted: the how-to on visitors who reject cookies shows what you can measure without an ID, and Global Privacy Control explains the browser signal Journey honours. To see which campaign brings the leads, follow the campaign how-to.

Honest limits

What it is not.

Better you read it here than find it out later.

  • It never names a visitor from an IP address.

    Journey shows where a visit came from and what kind of connection it is. It doesn’t look up a company or a person, and no setting turns that on.

  • A name needs an email.

    A visitor is named by the first email they give or that you pass in. A name typed into a form stays on the lead, not on the visitor.

  • One person can be two visitors.

    The ID lives in one browser, so the same person on a phone and a laptop appears twice.

  • Visitors who said no stay anonymous.

    If someone refuses analytics and later fills in a form, you get their email, but their earlier pages aren’t tied to it.

  • Locations are estimates.

    A country is usually right, a city is a guess, and a visitor on a VPN shows the VPN’s place.

  • Short memory by design.

    Journeys are kept for 7, 14 or 30 days. It is a way to understand recent visitors, not a long-term customer history.

Each visitor Journey records costs 0.1 credits, once, and page loads with the widget on them cost 10 credits per 1,000. Every account gets 250 free credits a month, enough for roughly 2,000 visitors who read 2.5 pages each. There is no monthly fee: one-time packs start at $9 and never expire. See the pricing page.

Start free
Questions

Seeing visitors, before you ask.

Not by name. You can see that a visit happened: the country, the device and browser, how the visitor found you and which pages they read. A name or an email appears only when the visitor gives one, in a form, a chat, a booking or a login. Tools that put a company or a person's name on an anonymous visitor are matching the visit against a database of someone else's data. They aren't reading the name off your site.

No. Google Analytics shows anonymous visitors: country, city, device, source and pages. Google forbids sending it names or email addresses, so it never shows who someone is, and in GA4 an IP address is used to work out the location and then discarded before anything is logged. To learn a visitor's name you need something they fill in, such as a form.

Yes, in your web server's access logs, if your host keeps them. Most analytics tools don't show them: GA4, for one, discards them after working out the location. An IP address points at a connection, not a person: a home, an office, a phone network or a VPN. It is also personal data in the EU, the UK and California, so what you keep and for how long belongs in your privacy notice.

Only with a tool that matches the visit's network address against a company database, such as Leadfeeder or Leadinfo, and only for visits that come from an office network. Leadinfo says visits over a mobile network are attributed to the operator, not the visitor's employer, and puts its own identification rate at 35 to 40% of website traffic. Builderify doesn't do this. It shows the country, the device, the source and what kind of connection it is, and the visitor's email once they have given one.

Not your name. The site receives your IP address, which points at your connection, plus what your browser sends: browser, system, language and the page that sent you. It learns more only if you log in, fill in a form, or the site runs a tracking script you have allowed. A VPN swaps your address for the VPN's, so the location the site sees is the VPN's, not yours.

Only the ones who give you a name. User Journey shows each visitor with a readable label, such as Silver Kestrel, plus their country, device, source and a timeline of pages. When a visitor leaves an email in a Builderify popup, form, quiz, booking or chat, or you pass it in when they sign in, the label becomes their email. It never looks up names or companies from IP addresses, and visitors who say no to analytics are only counted in your totals.

Sources

Legal and vendor facts checked on 29 October 2026. Laws and products change, so read the current text before you rely on a date or a figure here.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does