Can a website owner see who visits?

What a website owner can see about visitors

Every visit leaves a few traces, and analytics tools turn them into reports. Here is what you get, and where it comes from.

If you run an online shop or a site with logins, you also know who bought or signed in, because they told you. That is the one route to a name: the visitor hands it over.

What an owner can't see

• A name, email address or phone number for an anonymous visitor. Nothing in a normal page request carries one.
• Which person is behind a browser. A cookie recognises a browser coming back. Two people sharing a laptop look like one visitor, and one person on a phone and a laptop looks like two.
• An exact address. MaxMind, a large IP location provider, says its data is "never precise enough to identify or locate a specific household, individual, or street address."
• Anyone using a blocker that stops your script. Those visits are missing from the report, though your server logs may still show them.

Google builds this limit into Google Analytics. Its policy prohibits sending personally identifiable information, such as names or email addresses, to Analytics, and it says Google Analytics 4 does not log or store IP addresses.

How to see who visited your website

You need an analytics tool on the site. Without one, the only record is your server's access log, which lists requests, not readable visits.

1. Install an analytics tool. Google Analytics is free for most sites, and Stickybeak is another option. Either is one script tag on your pages.
2. Open the live view. In Google Analytics 4 that is the Realtime report. It shows activity from the last 5 and 30 minutes, with the countries and pages involved.
3. Check sources. The traffic acquisition report groups visits by channel: search, social, email, referral and direct. Our referral traffic guide explains how each is detected.
4. Check places and pages. The demographic details report gives countries and cities. The pages report shows what visitors read.
5. Leave yourself out. Exclude your own visits, or you'll be the most loyal visitor in the report.

The counts side of this, how many visits a site gets and how to find the number, is covered in how to check website traffic. This page sticks to who the visitors are.

In Stickybeak

Stickybeak is live analytics for every site you own, and it's in early access. Its wall shows who is on each site now, with a per-minute chart and top countries. You can click any referrer, page, country or device to filter by it. Where a visitor buys, the order keeps its trail: the entry page, the referrer, every UTM tag and the pages read before buying. That is a detailed picture of what visitors did, which is the part an owner can honestly see.

Can you see the IP address of people who visit?

Your web server has to receive a visitor's IP address to send the page back, so server logs usually hold it. What the address tells you is limited:

• It identifies a network connection, not a person. Everyone in a household, café or office can share one.
• Mobile networks reuse addresses across many phones. MaxMind notes that mobile addresses "may be used by mobile phones across a large distance."
• With a VPN, the address belongs to the VPN's server. MaxMind says it can locate that server but not the end user.
• MaxMind's published estimates are 99.8% accuracy at country level and about 66% for US cities within a 50 km radius.

So the IP address is good for "which country", fair for "which region", and poor for "who". Whether you should store it at all is a privacy question, covered below.

Can you find out which company visited?

Sometimes. Company lookup tools, often sold to sales teams as visitor identification, match a visitor's IP address to a database of networks registered to businesses. When someone browses from an office network, the tool can guess the employer. The limits are the same IP limits as above:

• People working from home, on mobile data or on a consumer VPN usually don't appear on a company's network, so they go unmatched or match the wrong organisation. A corporate VPN can do the opposite and show the employer's network.
• The match names a network, not the person at the keyboard. A visit from a company's address might be an employee, a guest or a security scanner.
• Internet providers and cloud hosts own many addresses. A lookup that returns a provider tells you nothing about the customer.

Treat a company match as a lead worth a look, not as proof. If you sell to businesses, it can help you prioritise who to contact. If you run a blog or a shop, it rarely matters.

Can a website track who visits it?

A website can track a browser. With a cookie, it recognises the same browser coming back and links its visits together. It sees where that browser came from, which pages it read and what it did. That doesn't name anyone.

The visitor becomes a named person when they log in, buy something, fill in a form, or click a link in an email you sent them (if your email tool adds an identifier to the link). Everything else is a profile with no name on it. In standard mode, Stickybeak sets three first-party cookies on your own domain: a visitor ID, a session ID and a session count. The docs list them.

The referrer works the same way. MDN explains that browsers send the page a visitor came from in the Referer header, and that it can be trimmed or left out. The referrer identifies a source URL. That URL can leak personal details or identifiers, so keep those out of URLs and analytics.

Is it legal to see who visits your website?

Counting visits is routine. What matters is whether you collect personal data, and that depends on where your visitors live. This is general information, not legal advice.

• Under the EU's GDPR, an IP address can count as personal data. Privacy International explains that Court of Justice of the European Union cases, including Breyer v Bundesrepublik Deutschland, treat IP addresses as personal data when they can be linked with other information that identifies the user. The UK's Information Commissioner's Office calls them online identifiers.
• If you use an analytics tool that stores IP addresses or sets cookies, your privacy policy should say so, and some places require consent first.
• If you run a company lookup tool, you are working with that same data, so check the rules for your visitors' countries before you switch it on.
• Tell visitors what you collect and why, and keep as little as you need.

The PII examples guide lists what counts as personal information, and what to keep out of your analytics.

Sources, checked 16 October 2026: Google Analytics Help, Best practices to avoid sending PII and IP masking in Analytics (GA4 does not log or store IP addresses). MaxMind, Geolocation accuracy (limits and accuracy estimates). Privacy International, Are IP addresses personal data?. MDN Web Docs, Referer header.