First Party Data
Website Visitor Identification: How to Identify Anonymous Website Visitors on Your Store
To identify anonymous website visitors, you either recognize them from identifiers they have already shared with you, such as an email at checkout or a click from your own email, or you match them against an opt-in third-party data network to find out who they are. The first is identity resolution on your own data. The second is third-party website visitor identification. Most stores need the first, and the second adds shoppers the first can never reach.
Most of the traffic on a Shopify store is anonymous. A shopper browses on their phone, comes back on a laptop, and only types their email at checkout days later. To your analytics, your email platform and your ad platforms, that looks like several strangers and one buyer. This guide explains what website visitor identification means in B2B and in ecommerce, the two ways to identify anonymous visitors, how to do it step by step with data you already collect, how identity resolution works, and how to choose visitor identification software.
What is website visitor identification?
Website visitor identification, sometimes called anonymous visitor identification, is the process of attaching an identity to traffic that arrives without one. A visitor who has not logged in, signed up or bought anything is just a browser to your site: a cookie, an IP address and a user agent. Identification connects that browser to something you can act on, such as a company, a known customer or an email address.
The phrase covers two quite different jobs:
- Company-level identification is the B2B version. A tag records the visitor's IP address and looks it up in a reverse-IP database that maps addresses to the organizations that own them. Sales teams use it to see which accounts are researching them. It identifies the company, not the person, and it works less well now that many people work from home on residential connections.
- Person-level identification is what ecommerce needs. A store does not sell to companies; it sells to the person holding the phone. The goal is to recognize a returning shopper as the same customer, even on a different device or days later, so the email platform can send the right flow and the ad platforms can credit the right ad.
The rest of this guide is about the person-level version.
Two ways to identify anonymous website visitors
Person-level identification works in one of two ways, and they answer different questions.
| First-party identity resolution | Third-party visitor identification | |
|---|---|---|
| The question it answers | "Is this the same shopper we already know?" | "Who is this shopper we have never met?" |
| Where the identity comes from | Identifiers the shopper gave you: checkout, logins, signup forms, clicks from your own emails | An external data network whose consumers opted in to partner marketing |
| Who it can identify | Returning visitors who shared an identifier at some point | First-time and never-identified visitors who are in the partner network |
| What you do with it | Fire email flows for known subscribers, send fuller conversions to ad platforms, attribute the whole journey | Add new, verified contacts to your email list and send more identified visitors to your ad platforms |
| What to check | How it matches, how long the identity lasts, where it sends it | The data source and consent basis, email verification, duplicates in your email platform, price per identified visitor |
| Examples | Upstack Signal | Upstack Audience, Retention.com, Opensend, Tie |
The two work together. First-party resolution makes sure nobody who has already told you who they are is treated as a stranger. Third-party identification reaches the larger group who never have. If you are weighing the third-party tools, our comparison of Retention.com alternatives checks their prices, trials and integrations side by side.
How to identify anonymous website visitors
Anonymous visitors become identifiable at the moments they share something about themselves. The work is to capture every one of those moments, keep the link, and carry it back to the sessions that came before. Here is how that plays out for a typical shopper:
| Session | What the shopper does | What the store knows |
|---|---|---|
| Monday, phone | Taps an Instagram ad and browses three products | An anonymous browser with a Meta click ID |
| Wednesday, laptop | Searches the brand on Google and adds to cart | A second anonymous browser |
| Thursday, laptop | Clicks a link in a Klaviyo email from an earlier signup | The laptop now has a known email |
| Friday, phone | Comes back and checks out with the same email | The phone now has the same email, so both devices are one person |
Without identity resolution, that is four visitors and one order, and the Instagram ad gets no credit. With it, it is one customer whose journey started with the ad. To get there:
- Capture identity wherever shoppers give it. Checkout, account logins, newsletter and SMS signup forms, quizzes and clicks from your own email and SMS campaigns all carry an email or phone number. Each one is a chance to turn an anonymous browser into a known person.
- Keep a durable first-party identifier on the browser. A first-party cookie, set by your own domain, lets you recognize the same browser when it returns. Safari caps cookies set by JavaScript at seven days, which is why identifiers set from the server last longer than ones set by a script.
- Stitch the session backwards. When a visitor identifies themselves halfway through a session, the earlier anonymous page views and add-to-carts in that session belong to them too. Attach the identity retroactively, not just from that point on.
- Merge devices on deterministic keys. When the same email or phone number shows up on two devices, those devices belong to one person. Merging them is what makes cross-device tracking work.
- Keep the ad click IDs. A shopper's Meta, Google or TikTok click ID is the strongest link between a sale and the ad that started it. Store it with the identity, so a purchase on another device or a week later can still carry it. Our explainer on the Facebook click ID and the
_fbccookie shows where it gets lost. - Send the resolved identity everywhere it is used. Your email platform, ad platforms and attribution reports each need the same answer about who the shopper is.
Even done well, this does not identify everyone. A visitor who never logs in, never buys, never signs up and never clicks one of your emails stays anonymous to your own data. What first-party identification does is make sure every visitor who has shared an identifier with you is recognized every time they come back. Reaching the rest takes third-party visitor identification.
What is identity resolution?
Identity resolution is the process of linking the scattered identifiers that belong to one person, such as cookies, device IDs, emails, phone numbers, customer IDs and ad click IDs, into a single profile. The structure that holds those links is called an identity graph: each identifier is a node, and each piece of evidence that two identifiers belong together is an edge. Our explainer on what an identity graph is covers how one is built and how to judge a provider's.
For an ecommerce brand, identity resolution answers three questions every time an event happens:
- Who is this? The person behind the browser, if they have ever identified themselves.
- What else do we know about them? The email, phone, address and customer ID that belong to that person.
- Where have they been? The earlier sessions, devices and ad clicks that belong to the same journey.
Deterministic vs probabilistic matching
Identity resolution software links identifiers in one of two ways, and the difference matters for accuracy and for privacy.
| Deterministic matching | Probabilistic matching | |
|---|---|---|
| How it links | An exact shared identifier: the same email, phone number, login or customer ID | Statistical likelihood from signals like IP address, device type, screen size, language and timezone |
| Example | The same email is entered at checkout on a phone and clicked from an email on a laptop | Two browsers share an IP address and similar device settings |
| Confidence | High: the shopper supplied the link | Lower: the link is an inference that can be wrong |
| Best use | The basis of a customer record you act on | Extending coverage to sessions no shared identifier connects |
Probabilistic matching links more sessions, but some of those links are wrong, such as two people in one household on the same Wi-Fi. Good identity resolution uses both and keeps them apart: deterministic links anchor the customer record, and probabilistic links extend it where no exact identifier exists. Ask any vendor how it weights the two.
Session stitching and cross-device tracking
Two terms come up in every identity resolution discussion:
- Session stitching connects the events within and across sessions on one browser to the same person, including the anonymous events before they identified themselves.
- Cross-device tracking connects different browsers and devices to the same person, usually because the same email or phone number appeared on each.
Together they turn the four visitors in the table above back into one customer.
Why identity resolution matters for ecommerce
Identity resolution is not a reporting feature. It changes what your tools can do with the visitors you already have.
- Email and SMS flows reach returning visitors. Browse and cart abandonment flows only trigger for shoppers your email platform recognizes. When a returning visitor's identity is resolved on arrival, Klaviyo can send the flow even though the shopper never logged in on that device. Our guide to why identity resolution is the missing link in your Klaviyo performance goes deeper.
- Ad platforms match more of your conversions. Meta, Google and TikTok match conversions to their users with identifiers like hashed email, phone and click ID. More resolved identifiers on more events means better matching, which our guide to Meta Event Match Quality explains in detail.
- Attribution sees the whole journey. A purchase on a laptop can be credited to the phone click that started it, instead of to direct traffic. See our guide to first click vs last click attribution for how journeys turn into credit.
- New and returning customers are counted correctly. A shopper who bought last year on a different device is a returning customer, not a new one. Without identity resolution, new-customer acquisition costs look better than they are.
The effect shows up in the numbers you already track. Haircare brand Champo identified 128% more customers after rebuilding its tracking around identity resolution.
Visitor identification software: the main types
"Visitor identification software" and "identity resolution software" cover several kinds of product that solve different problems. Knowing which kind you are looking at saves a lot of demo calls.
| Type | What it does | Built for | Examples |
|---|---|---|---|
| B2B visitor identification | Resolves visits to companies, and sometimes contacts, from IP addresses and data partners | Sales and account-based marketing teams | Leadfeeder, Warmly, Clearbit |
| Customer data platforms (CDPs) | Unify customer records from many systems into profiles for segmentation | Data and CRM teams with many sources | Segment, Amperity, Tealium |
| Enterprise identity graphs | Match people and households across large third-party and partner datasets | Large advertisers, publishers and data onboarding | LiveRamp, Experian |
| Ecommerce identity resolution (first-party) | Resolve returning shoppers from store data and send the identity to ad and email platforms in real time | DTC and Shopify brands | Upstack Signal |
| Ecommerce visitor identification (third-party) | Match never-identified shoppers against an opt-in consumer network and deliver verified contacts to email and ad platforms | DTC brands growing their email list | Upstack Audience, Retention.com, Opensend, Tie |
A B2B tool will not help a Shopify store recognize a returning shopper, and an enterprise identity graph is rarely the right first purchase for a brand doing a few thousand orders a month. Start from the job. If the goal is more abandonment revenue and better ad matching from the shoppers you already know, you need first-party identity resolution that feeds your email and ad platforms directly. If the goal is a bigger list from traffic you already pay for, add third-party visitor identification on top.
How to choose visitor identification software
When you compare tools, ask each vendor the same questions:
- How does it match? Ask what share of links are deterministic and what role probabilistic signals play. A vendor that will not give a straight answer is guessing more than it says.
- Where does matching happen? Server-side matching keeps personal data out of the browser and away from third-party scripts.
- Which destinations receive the identity? Check that it reaches the tools that need it: your email platform, each ad platform's conversion API and your attribution reports.
- Does it fit your store? Shopify checkout, headless storefronts, landing page builders and subscription apps each need to be covered, or the gaps become anonymous again.
- How does it handle consent? It should respect your consent banner and your store's privacy settings, and hash personal data before sending it anywhere.
- How long does the identity last? A browser cookie can be gone in a week. Ask whether the identity survives cookie loss, new devices and long gaps between visits.
- What is a match rate claim based on? "Identifies X% of visitors" means little without knowing what was counted. Ask for the definition, or better, run a trial on your own traffic and compare the identified-visitor and email-flow numbers before and after.
- For third-party identification, where does the data come from? Ask about the consent basis of the network, whether emails are verified before delivery, and what happens when a matched shopper is already on your list.
- What is the pricing unit? Per order, per event, per identified visitor or per profile each scale differently as your store grows.
Is website visitor identification legal?
Identifying visitors from data they gave you, such as an email at checkout or a click from your own email, is standard practice, but privacy law still applies to how you collect, store and share it. A few principles hold in most jurisdictions:
- Be clear in your privacy policy about the data you collect and the platforms you share it with.
- Respect consent. Where your customers are covered by laws such as GDPR, or by state privacy laws in the US, make sure tracking and sharing follow the choices they make in your consent banner.
- Hash personal data before sending it to ad platforms. Meta, Google and TikTok all accept SHA-256 hashed emails and phone numbers.
- For third-party identification, know the consent basis. Use a provider whose network is built on opt-in consumer data, that honors opt-outs such as those under the CCPA, and that you can describe accurately in your privacy policy.
This is general guidance, not legal advice. Check your own setup with counsel if you sell into regulated markets.
How Upstack identifies anonymous visitors
Upstack covers both routes with two products on one pixel.
Upstack Signal is first-party identity resolution. Its identity layer, Upstack ID, follows the approach in this guide:
- Deterministic and probabilistic matching. A login, an email entered at checkout or a click from a Klaviyo email creates a hard link to a known person, and probabilistic matching extends the graph where no exact identifier exists.
- A graph of 750M+ devices and 150M+ customers. Signal resolves your shoppers against Upstack's own device network and identity graph, not only the cookies on your site.
- Lifetime identity. An Upstack ID lasts the life of the customer, well beyond the seven days Safari gives a cookie set by JavaScript.
- Server-side matching. Personal data is matched on Upstack's servers and is never exposed to client-side scripts or third-party tags.
- Retroactive session stitching. When a visitor identifies themselves mid-session, their earlier anonymous page views and add-to-carts in that session gain the same identity, as described in identity stitching.
- Cross-device merging. When the same email or phone appears on different devices, those sessions merge under one identity.
- Click ID restoration. Meta click IDs are kept with the identity, so a shopper who clicked an ad last week and returns through Google can still carry the original click to Meta, as our docs on the Facebook click ID explain.
- One identity, every destination. Meta and TikTok receive hashed email and phone with their click IDs, and Klaviyo can re-identify returning visitors it no longer recognizes, so abandonment flows reach more of them.
Identity resolution is included in the Signal and Attribution + Signal plans; see pricing.
Upstack Audience is third-party visitor identification, an add-on to a Signal plan. It matches shoppers your own data has never identified against a partner network built on opt-in consumer data, verifies the email, and delivers the contact to Klaviyo or Omnisend and to Meta through the Conversions API. Shoppers already in your Klaviyo account go to a separate reactivation list instead of being duplicated, and California residents can opt out under the CCPA. It is priced per resolved visitor, from $0.025 a match, with a 14-day free trial. The Upstack vs Opensend comparison sets it next to a standalone alternative.
Not every visitor can be identified by either route, and the share varies by store and traffic source.
Frequently asked questions
What is website visitor identification?
Website visitor identification is the process of attaching an identity to anonymous website traffic. B2B tools usually identify the company behind a visit from its IP address. Ecommerce identity resolution identifies the person, by linking their sessions and devices through an email, phone number, login or click from your own emails.
How can I identify anonymous website visitors?
Start with your own data: capture identity wherever shoppers share it (checkout, logins, signup forms and clicks from your own emails), keep a durable first-party identifier on the browser, stitch earlier anonymous events to the person once they identify themselves, and merge devices that share the same email or phone. Visitors who never share any identifier can only be identified with a third-party visitor identification tool that matches them against an opt-in data network.
Can website owners see who visits their site?
Not by default. Analytics tools show anonymous sessions, not people. A store can recognize visitors who have shared an email, phone number or login with it before, and a third-party visitor identification tool can match some of the rest against an opt-in consumer network. Neither route identifies every visitor.
What is the difference between visitor identification and identity resolution?
Identity resolution links the identifiers a shopper has already given you into one person, so a returning visitor is recognized on any device. Third-party visitor identification finds out who a never-identified visitor is by matching them against an external network. Ecommerce brands often use both.
What is identity resolution software?
Identity resolution software links the identifiers that belong to one person, such as cookies, device IDs, emails, phone numbers and ad click IDs, into a single profile. Types include B2B visitor identification tools, customer data platforms, enterprise identity graphs and ecommerce tracking tools that send resolved identity to ad and email platforms.
What is the difference between deterministic and probabilistic matching?
Deterministic matching links identifiers through an exact shared value, such as the same email or login, so it is highly accurate. Probabilistic matching infers links from signals like IP address and device settings, which reaches more sessions but can link the wrong people. Good identity resolution uses both, with deterministic links anchoring the customer record.
Is website visitor identification GDPR compliant?
It can be. Identifying visitors from data they gave you, respecting the choices in your consent banner, hashing personal data before sharing it and explaining it in your privacy policy are the foundations. Third-party visitor identification depends on the provider's consent basis and where your customers are, so check both with counsel before you switch it on.
Key takeaways
- Website visitor identification means different things in B2B (which company visited) and ecommerce (which customer came back).
- There are two ways to identify anonymous website visitors: first-party identity resolution recognizes shoppers who have shared an identifier with you, and third-party visitor identification finds shoppers who never have.
- Deterministic matching on emails, phones and logins anchors the customer record; probabilistic matching extends it where no exact identifier exists.
- Resolved identity pays off in email and SMS flows, ad platform matching, attribution and new-customer counts.
- Choose visitor identification software by the job it does, how it matches, how long the identity lasts, where it sends it and how it handles consent.
About the author
Want similar results?
Start free for 21 days and see what clean signal does for your performance. No card, no contract.