Two different questions
"Who visits my website" means one of two things, and the answers are completely different.
Aggregate: what kind of people, from where, arriving how, reading what. Standard analytics answers this, legitimately and well.
Individual: the names of the people or companies browsing your site. This is a much more loaded question, and the tools that promise it come with conditions.
What analytics can tell you
Any reasonable analytics tool will give you:
- Geography, usually at country and city level, derived from the IP address
- Traffic source — search, direct, referral, social, campaign
- Search queries, via Search Console, for organic arrivals
- Device, browser and screen size
- Behaviour: entry page, pages viewed, time on page, exit page
- Conversions and which sources produce them
That is a substantial picture. For most decisions — what content to write, which channel to invest in, what to fix — it is the whole picture.
What it cannot tell you, and should not
A privacy-respecting analytics tool will not give you a named list of individuals. That is not a limitation to work around; it is the design.
Company identification tools
A category of tools maps visitor IP addresses to companies, so a B2B site can see that someone from a given organisation visited. This works reasonably well for corporate networks and poorly for home and mobile connections, which is most traffic now.
Two things to understand before using one:
- It identifies organisations, not people — despite marketing that blurs the line.
- It is not automatically lawful. In the EU, an IP address is personal data, and enriching it to profile a visitor requires a legal basis, transparency in your privacy notice, and a defensible answer if someone asks what you know about them.
Person-level identification
Some products claim to resolve anonymous traffic to named individuals, typically by matching against third-party identity databases. Be very careful here. This is precisely the practice that privacy regulation targets, it usually rests on data collected without the person's knowledge, and it is difficult to reconcile with GDPR requirements. It also tends to alarm customers who find out.
The legitimate way to know who your visitors are
Ask them, and give them a reason to answer.
- A newsletter signup with real value attached
- A "how did you hear about us?" field on your form — frequently more accurate than an attribution model
- Account creation for a product where an account makes sense
- Talking to customers, which remains the highest-quality data source available and the least used
Data given voluntarily is better data: it is accurate, it comes with permission, and it does not need a legal memo.
Where the line is
Aggregate analysis of your own audience on your own site is normal and expected. Assembling profiles of identified individuals from data they did not knowingly provide is a different activity, with different obligations, and it should be a deliberate decision made with legal advice — not a checkbox someone enabled in a dashboard.