# The Website-Visit Alert Read: Work Now, Corroborate, Nurture, or Discard

*Score one website-visitor alert on six dimensions and land on Work Now, Corroborate, Nurture, or Discard, with the matching next action and first-message rule.*

- Canonical URL: https://www.refolk.ai/guides/website-visit-alert-read
- Pillar: Sales and go-to-market
- Format: Framework
- Published: 2026-11-12
- Last reviewed: 2026-11-12
- Reading time: 24 min
- Keywords: website visitor identification accuracy, reverse IP lookup false positives, how to qualify de-anonymized website visitors, should sales follow up on website visits, filter ISP and bot traffic from visitor data, person-level visitor identification outreach legal

## Key takeaways

- Published website visitor identification figures are vendor and practitioner ranges: 30-65% company-level match for US B2B traffic and 5-20% person-level, with no independent benchmark behind either.
- A high-recall visitor tool running at 60-80% precision names the wrong company on roughly 1 in 5 to 2 in 5 matched alerts, so a company name on an alert card is a hypothesis until you check it.
- An AI-agent session such as a ChatGPT-User fetch comes from the operator's published IP list, so any company name attached to it is wrong and the alert should be discarded.
- Unverified B2B email lists have shown hard bounce rates of 14.6%, which is 7.3 times the 2% level at which sustained bounces damage Gmail deliverability, so a named visitor is never emailed before verification.
- California SB 690 removes private suits under CIPA section 638.51 only from its operative date, the Attorney General can still enforce it, and sections 631 and 632 are untouched, so person-level outreach still carries legal risk.
- In Refolk's index, 48% of a 25-profile US sample of sales-development leaders hold director titles against 4% in the UK and Germany, so outside the US the visitor-alert rule is usually set by a manager and must fit on one page.

This guide is for reading one de-anonymized website visit. A visitor-identification tool tells you a target account, and maybe a named person, just looked at your pricing page, and you have a couple of minutes to decide what to do. It's for founders selling their own product, account executives, SDR leads, and partnerships teams who own the first touch. You get six dimensions to score, four verdicts (Work Now, Corroborate, Nurture, Discard), a set next action for each verdict, and a rule for what the first message may say. In every case, that rule leaves out the visit itself.

## What does a de-anonymized visit record actually prove?

A visit record proves that a session reached your site from an IP address the tool linked to a company. It doesn't prove that anyone who works at that company was the visitor. The tool's headline match rate also says nothing about how often that company name is right.

Three terms carry the whole problem:

- **Reverse IP lookup** maps a visitor's IP address to the organisation believed to own or use it.
- **Match rate** is the share of sessions the tool attaches a company or person to.
- **Precision** is the share of those attached names that are correct.

Vendors publish match rates far more often than precision. The published figures for both are ranges, not audited benchmarks.

| Measure | Published range | Source type |
|---|---|---|
| Company-level match, US B2B | 30-65% | Practitioner range |
| Company-level match | 10-40% | Vendor figure |
| Person-level match | 5-20% | Practitioner range |
| Precision, high-recall tools | 60-80% | One vendor's tiers |
| Precision, high-precision tools | 90%+ | One vendor's tiers |

#### How much traffic a visitor tool claims to name

| Stage | Figure | Note |
| --- | --- | --- |
| All B2B site traffic | 100% | Every session that reaches the site |
| Company-level match | 30-65% | Practitioner range, US B2B traffic |
| Person-level match | 5-20% | Practitioner range, before any verification |

*Even on practitioner ranges, a person-level name is attached to at most one session in five, and none of these figures says how many of the names are right.*

Precision falls as match rate rises. In one vendor's own words, "a vendor can boost their match rate by guessing more aggressively." The same vendor's tiers set high-recall tools at 50-70% match rate with 60-80% precision, and conservative tools at 30-45% match rate with 90%+ precision when they match. A tool running at 60-80% precision names the wrong company on roughly 1 in 5 to 2 in 5 matched alerts. That's the base rate this framework has to beat. Treat a confident company name on an alert card as a hypothesis, not a fact.

> **Note:** What has not been established
>
> No independent body benchmarks website visitor identification accuracy, and nobody has published match rate or precision split by network type. The one accuracy test with any backing is overlap with the accounts you already know. Run it yourself before you trust any figure in this section.

That test is simple to state. One vendor's guidance is that the tool with "materially higher overlap to your CRM-known accounts is more accurate, regardless of headline match rate," and that teams should test accuracy against their own customer list. You can also run a seeded-visit check, visiting from networks you know and seeing what the tool reports. It's a reasonable local check, but no standard protocol for it has been published. If you run one, treat the result as your own number, not an industry figure.

## The six dimensions of a visit match, and how to score each

Score four dimensions at 0, 1, or 2 each, for a total out of 8: network type, page and depth, account fit, and corroboration. The other two, session type and person-level use, are pass/fail gates. Two of the scored dimensions also have hard gates that end the read at once.

Every claim on an alert card is inferred from the one above it, so the order you check in matters.

#### What a visit alert claims, outermost first

1. **IP address** - The only thing the tool actually observed
2. **Network owner** - The ASN and its type, such as business, hosting, isp, education, or government
3. **Session** - A human, an AI agent acting for a user, or a crawler
4. **Company match** - The tool's inference that this session belongs to an account
5. **Named person** - A further inference, with its own legal and verification gates

*Each layer is an inference from the layer above it, so an error at the network or session layer invalidates every claim beneath it.*

| Dimension | Scores 2 | Scores 1 | Scores 0 or gate |
|---|---|---|---|
| Network type | Business ASN owned by the account | Hosting tenant or institution matching the account | ISP, mobile, CGNAT, VPN, relay |
| Session | Human: continue | n/a | Agent or crawler: Discard |
| Page and depth | Pricing or comparison, several pages | Product pages | One shallow view; careers or IR: gate |
| Fit and CRM | ICP fit, unowned | Adjacent fit | Out of profile; customer or open deal: gate |
| Corroboration | Independent public signal | Second internal signal | None |
| Person-level use | Pass: may address the person | n/a | Fail: company-level only |

### 1. Network type behind the match

**What it proves:** whether the IP belongs to the matched company or to a network that many unrelated people share. An **ASN** (autonomous system number) identifies the network operator that announces a block of IP addresses. ASN lookups label that operator's type. One common classification returns hosting, isp, education, government, or business. The open-source [openasn](https://github.com/openasn/openasn) project goes finer: residential, mobile, hosting, VPN, Tor, relay, business, or unknown, with extra labels for cgnat and enterprise_gateway. **CGNAT** (carrier-grade NAT) means many subscribers share one public IP address, so no single company owns it.

**When it lies:**

- **Remote work.** It moves visitors onto consumer networks. As one IP-intelligence explainer puts it, "an IP that once mapped cleanly to 'Acme Corp HQ' now might map to 'Comcast residential.'"
- **Subleased cloud.** It produces false discards. "The ASN belongs to the hosting company, so asn.type reads HOSTING, but the actual occupant is a business."
- **Large operators.** They run several network types, so one company can be "captured as hosting on one network, business on another, and isp on another."
- **ISP-announced proxies.** Of datacenter proxies, "the other 12% are announced by consumer ISPs," and "ASN and hosting classification won't flag them." Check the VPN flag as well as the ASN type.

Nobody has published false-match rates for coworking operators, hotels, or re-leased address blocks. Treat all three as shared unless the WHOIS organisation is the account itself, and treat that WHOIS check as an unverified practice.

**Score:** 2 for a business ASN or enterprise gateway owned by the matched account. 1 for a hosting range where the tenant's reverse DNS or WHOIS organisation is the account, or for an education or government network that is the account. 0 for isp, residential, mobile, CGNAT, VPN, Tor, or relay.

### 2. Human, agent, or crawler session

**What it proves:** whether a person was behind the session at all. An **agent session** is an AI assistant fetching a page because a user asked it to. A **crawler** fetches pages on its own schedule, to train a model or build a search index.

Bot traffic isn't marginal. Cloudflare Radar has reported bots at 39.2% of HTTP requests over a four-week window, and humans at 33.8% of HTML page requests in a one-week window. Within AI-bot traffic, the user-action (agent) share was 4.4% in one four-week window, up from 2.7% in the same window a year earlier. Cloudflare Radar publishes these shares on a rolling basis, so re-check the current figure there instead of quoting one from memory. Nobody has published a share specific to B2B sites.

**When it lies:** an agent visit can reflect real human interest, but it carries no usable identity. A ChatGPT-User fetch has its own user-agent string and comes from the IP list OpenAI publishes at openai.com/chatgpt-user.json. Any company name attached to it is wrong. OpenAI's [crawler documentation](https://developers.openai.com/api/docs/bots) also says "Because these actions are initiated by a user, robots.txt rules may not apply," so blocking at robots.txt won't remove these sessions from your data. Timing and path signatures, such as sub-second sessions, no JavaScript execution, or deep-page-only paths, have no primary documentation behind them. Use them as hints, never as proof.

**Gate:** human means continue. Agent or crawler means Discard the alert. Count the page interest in aggregate content analytics if you like, but not against the account.

### 3. Page and depth

**What it proves:** what the visitor was evaluating. Vendor benchmarks put signal-to-meeting rates at 5-15% for topic-level intent and 15-30% for page-level intent, but none of them states a method.

**When it lies:** careers, investor relations, and unsubscribe pages are listed as "Disqualified | No Sales Action." Suggested score deductions also cover student email domains and competitor IP addresses. Login and documentation pages have no published treatment. My read is that a login or docs visit more often comes from an existing user than from a new buyer, so check the CRM before you score it as intent.

**Score:** 2 for pricing or comparison pages with several pages viewed. 1 for product or feature pages. 0 for a single shallow view. Careers, investor relations, unsubscribe, student domains, and competitor IPs are a hard gate to Discard.

### 4. Account fit and CRM state

**What it proves:** whether you're allowed to touch this account, and whether you should want to. A pricing visit from a current customer in renewal season isn't a cold lead. It belongs to whoever owns the renewal.

**Score:** run the gate first. If the account is a customer, in an open deal, or owned by another rep, the cold verdict is Discard and the alert goes to the owner as context. Otherwise score 2 for a clear ideal-customer-profile fit, 1 for adjacent fit, and 0 for out of profile. One intent-data guide proposes tracking the percentage of intent-flagged accounts already in CRM. It's worth logging, because a high share means your alerts mostly re-describe pipeline you already have.

### 5. Corroborating outside signal

**What it proves:** that something besides the tool's guess points at this account now. Examples include a public hiring post for a role your product serves, a funding round, a leadership change, or a public post about the problem you solve. One intent-data guide gives multi-signal combinations 55-70% confidence. Treat that as a vendor estimate, not a measurement.

**When it lies:** a second internal signal, such as a repeat visit or another session from the same account, carries the same network risk as the first. It can score 1 but never 2.

**Score:** 2 for an independent public signal, 1 for a second internal signal, and 0 for nothing.

### 6. Whether a person-level claim can lawfully be used

This dimension doesn't add to the total. It decides who the first message goes to. It passes only if jurisdiction, identity, and email address all check out, and it has its own section below.

## The four verdicts and the message rule for each

Run the gates first, then add the four scored dimensions:

- **7 or 8:** Work Now.
- **5 or 6:** Corroborate.
- **3 or 4, on an account that fits at all:** Nurture.
- **Anything lower, out of profile, or gated:** Discard.

Every verdict has a fixed next action. None of them lets the first message mention the visit.

#### Visit evidence against account fit

Horizontal axis runs from Weak evidence the visit was theirs to Strong evidence the visit was theirs. Vertical axis runs from Poor fit and timing to Strong fit and timing.

| Quadrant | What it means |
| --- | --- |
| Corroborate | Search one to five minutes for an outside signal, then rescore once |
| Work Now | First touch today, led by the outside signal |
| Discard | Log the reason and move on |
| Nurture | No rep message; keep the account in the marketing audience |

*Strong fit with weak visit evidence is a reason to look for an outside signal, not a reason to send the first touch.*

| Verdict | Trigger | Next action | First message |
|---|---|---|---|
| Work Now | Total 7-8, no gate | Touch today | Leads with the outside signal |
| Corroborate | Total 5-6 | 1-5 minute search, rescore once | None until rescored |
| Nurture | Total 3-4, fit 1+ | Marketing audience, revisit on new signal | No rep message |
| Discard | Any gate, fit 0, or total 0-2 | Log reason; hand CRM hits to owner | None |

The arithmetic contains a rule worth stating plainly. A match from a shared network (residential, mobile, CGNAT, VPN) scores 0 on network type, so it can total at most 6 and can never reach Work Now on the visit alone. That's deliberate. If you work that account, it's because of the outside signal, and the visit was only the prompt to look.

These cut lines are my rubric, not a published benchmark. Keep the structure, then shift the thresholds once your own calibration shows what each total actually converts to.

Published sources disagree about timing. One intent-signal guide maps a pricing-page visit to "Direct outreach with ROI context | Same day." Another says no single intent signal is reliable enough to justify a sales touch. Both positions fit together if you corroborate before you act. A one-to-five-minute search still fits inside the same day, and it filters out the alerts that name the wrong company.

> **Rule:** The first message never cites the visit
>
> No regulator has said whether citing a visit in outreach copy is lawful, and with 60-80% precision on high-recall tools the account may never have visited. Write every first touch so it would still make sense if the visit never happened.

The person-level gate changes the recipient, not the verdict. If it passes, a Work Now message may go to the named person. If it fails, the alert is company-level only. Choose the recipient by role from public profiles and ignore the name on the alert card.

**Work Now first touch (visit-free)**

```
Subject: <the outside signal, in their words, e.g. "your first SDR hire">

Hi <first name>,

I saw <public signal: the role you posted / the round you announced / your post about the problem>. Teams at that point usually hit <the specific problem your product solves> within <a timeframe you can stand behind>.

<One sentence on what you do about it, with one concrete outcome from a comparable customer.>

Worth a 20-minute look, or is someone else closer to this?

<signature>
```

*Swap in the outside signal you actually found; if you cannot name one, the alert is not Work Now.*

## Who owns the verdict: sales-development leadership by market

In Refolk's index of professional profiles there are 3,123 sales-development leaders in the United States, 1,272 in the United Kingdom, and 242 in Germany. The US sample is director-heavy, while the UK and German samples are manager-titled. That changes who writes and enforces this rubric, and how simple it needs to be.

| Market | Leaders in Refolk's index | Director-titled share of sample | Top title in sample |
|---|---|---|---|
| United States | 3,123 | 48% (12 of 25) | Director of Sales Development |
| United Kingdom | 1,272 | 4% (1 of 25) | Head of Sales Development |
| Germany | 242 | 4% (1 of 25) | Sales Development Manager |

The counts cover four titles: Sales Development Manager, Head of Sales Development, SDR Manager, and Director of Sales Development. The US pool is 12.9 times the German one and 2.46 times the UK one. Named employers in the samples range from Netflix and Micron Technology in the US, to PayPal, Adobe, and Barclaycard Payments in the UK, to Anaplan, Matrix42, and Haiilo in Germany.

**48% - Director-titled share of US sales-development leaders in a 25-profile sample from Refolk's index**

The UK and German samples were 4% each, so outside the US the person setting the visitor-alert rule is usually a manager.

Three things follow, with the caveat that the director shares come from a 25-profile sample per market and should be read as direction, not precision:

1. **In the UK and Germany, the gate is stricter and the owner is closer to the floor.** The person-level gate fails by default in those markets unless the site collects consent. The manager applying a company-level-only rule may also have no dedicated RevOps support, so the rule has to fit on one page and be checkable by a rep.
2. **In the US, the rubric can lean on RevOps.** Director-led teams can usually get the calibration step (CRM overlap per tool) run centrally and the cut lines tuned from it.
3. **Tool coverage follows the market.** At least one person-level tool describes itself as "a US-only technology with a US-only database." Its person-level claims don't apply to European sessions at all.

If you're the manager setting this rule for a UK team, the quickest calibration is a peer who has already run visitor alerts and can tell you what their discard rate turned out to be. [Refolk](/) finds those people from a plain-English description, with their current employer and the public posts that matched.

I ran this search: `Heads of Sales Development at B2B SaaS companies in London with 50-500 employees who have posted about website visitor identification or intent data.` - [see the full result list](https://www.refolk.ai/s/bm8dyjsycr).

*Returns named UK sales-development heads at mid-sized SaaS companies, with their current employer and the public posts on visitor identification or intent data that matched.*

## The person-level gate: when can a named visitor be used?

A named visitor can be used only if three checks pass in order: jurisdiction, then identity, then address. If any one fails, the alert drops to company-level only and the recipient is chosen by role. This section describes the legal landscape so you can apply the gate. It isn't legal advice, so confirm your own position with counsel.

### Jurisdiction comes first

- **California.** SB 690 removes the private right of action under CIPA § 638.51, the pen-register theory built on "collection of an IP address," but only from its operative date. Until then private plaintiffs can keep filing. The bill also reaches pending claims in actions commenced within two years before that date. The Attorney General can still enforce § 638.51 either way, and plaintiffs may continue pursuing claims under §§ 631 and 632.
- **European Union.** Person-level identification usually needs the visitor's consent under ePrivacy rules and a lawful basis under GDPR.
- **United Kingdom.** The ICO says organisations "must obtain prior consent to the UK GDPR standard for their use, unless an exception applies." For a JavaScript visitor-recording snippet, "the organisation must obtain prior consent to use the tool." In the UK, consent attaches to the snippet itself, before any outreach question arises. See the ICO's guidance, [What are the PECR rules?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules)

> **Watch out:** SB 690 did not fix it
>
> Private suits under section 638.51 stay possible until SB 690's operative date, the Attorney General keeps enforcement power, and section 631 wiretap claims are untouched. Legal risk shifts from one theory to another. Re-check the status with counsel before you allow any person-level use.

### Identity comes second

A person-level match is a guess built on a guess, so check the named person against a public profile that shows their current employer. If the profile shows a different company, or no profile turns up, the name fails. Even with a pass, decide whether this person is the right recipient for the account. Doing that by hand across LinkedIn, GitHub, and the open web eats the couple of minutes you have. A single Refolk search for the role at that account returns current public profiles across all three. That gives you the identity check and a role-based fallback recipient in the same step.

### Address comes last

Verify the email before anything is sent. In a study of 655,442 B2B email addresses, 54.0% came back verified, 18.1% catch-all, and 14.6% bounced outright. Sustained bounce rates above 2% actively damage Gmail deliverability. A well-maintained database with continuous re-verification should keep cold-campaign hard bounces below 2%.

**7.3x - Hard bounce rate on unverified B2B emails (14.6%) against the 2% Gmail damage level**

A handful of bounces from unverified visitor names can hurt deliverability for every rep on the sending domain.

The fix is cheap. One practitioner reports that verification and bounce suppression cut their hard bounce rate from 11.17% to 0.43%. No published study isolates bounce rates on visitor-derived emails specifically, so measure your own.

## Step-by-step: reading one alert in about five minutes

Calibrate once. After that, each alert takes about two minutes through the gates and the scored dimensions, plus up to five more for corroboration. The steps below match the order of the stack: network and session first, because an error there invalidates everything below.

#### Reading one website-visit alert

1. **Calibrate the tool against your CRM once** - RevOps compares one to two weeks of matched accounts against known customers and CRM accounts. Done when each tool has an overlap percentage.
2. **Screen out agent and crawler sessions** - Check the user-agent token and test the IP against the operator's published list, such as openai.com/chatgpt-user.json. Agent or crawler means Discard.
3. **Classify the network behind the match** - Look up the ASN type and the VPN flag. Score 2 for corporate-owned, 1 for tenant or institutional, 0 for shared.
4. **Score page and depth** - Pricing or comparison with depth scores 2, product pages 1, one shallow view 0. Careers, investor relations, unsubscribe, student domains, and competitor IPs mean Discard.
5. **Check account fit and CRM state** - Customer, open deal, or another rep's account goes to the owner. Otherwise score fit 2, 1, or 0.
6. **Look for one outside signal** - Spend one to five minutes on hiring, funding, leadership change, or a public post about the problem. Score 2, 1, or 0 and recalculate the total.
7. **Run the person-level gate** - Jurisdiction, then current public profile, then email verification. Any failure makes the alert company-level only.
8. **Issue the verdict and apply its message rule** - 7-8 Work Now, 5-6 Corroborate, 3-4 with fit Nurture, else Discard. Log the reason and write a visit-free first message.

Log every alert on the same card, discards included. Discard reasons are the data you'll use to recalibrate.

**Visit alert scoring card**

```
ALERT: <account> | <date and time> | <page path(s)> | <tool>
GATE  Session:      human / agent / crawler            -> agent or crawler = DISCARD
GATE  Disqualifier: careers / IR / unsubscribe / student / competitor -> DISCARD
GATE  CRM state:    customer / open deal / owned by ____ -> hand to owner
D1 Network:     ASN type ____  VPN flag ____           -> 2 / 1 / 0
D3 Page+depth:  pages ____  count ____                 -> 2 / 1 / 0
D4 Fit:         ICP / adjacent / out                   -> 2 / 1 / 0
D5 Outside signal: ____________ (source) ____          -> 2 / 1 / 0
TOTAL: __ / 8
PERSON GATE: jurisdiction ____  profile match Y/N  email verified Y/N -> named / company-level
VERDICT: Work Now / Corroborate / Nurture / Discard
REASON (one line): ______________________
```

*Paste into the CRM activity or a shared sheet; one card per alert, discards included.*

## How the read goes wrong: failure modes and false positives

Most bad first touches from visitor alerts trace back to one of nine mistakes. Each one looks like a confident signal on the alert card, and each has a specific check. Learn these before you learn the scoring. They're where reverse IP lookup false positives come from.

1. **Treating the headline match rate as precision.** A high-recall tool can run at 60-80% precision, so a confident company name may still be wrong on 1 in 5 to 2 in 5 alerts. *Check:* the tool's overlap with CRM-known accounts from your calibration.
2. **Discarding a subleased cloud tenant as a machine.** An alert matched to a hosting range is usually automated traffic. But a business renting cloud space also reads as HOSTING, and discarding it is a false negative. *Check:* the tenant's reverse DNS or WHOIS organisation. This is an unverified practice, so record whether it holds up in your own data.
3. **Missing ISP-announced proxies and residential VPNs.** They pass the ASN filter, and 12% of datacenter proxies are announced by consumer ISPs. *Check:* the VPN flag in the IP lookup, not only the ASN type.
4. **Counting an agent session as intent.** A ChatGPT-User fetch comes from OpenAI's published IP list, so the attached company name is wrong. The share of agent traffic grew from 2.7% to 4.4% of AI-bot traffic year on year in the same window, so this failure is getting more common. *Check:* the IP against openai.com/chatgpt-user.json and the equivalent lists other operators publish.
5. **Reading a careers or investor relations visit as buying intent.** A job seeker or an analyst on the account's network looks identical to a buyer on the alert card. *Check:* the page path against the disqualifier list before anything else.
6. **Sending a cold first touch to an existing customer or open deal.** A renewal-season pricing visit triggers an SDR sequence, and the account owner finds out from the customer. *Check:* CRM owner and stage before any action, every time.
7. **Emailing a person-level name unverified.** Unverified segments have shown 14.6% hard bounces against a 2% damage level. *Check:* a verifier, plus a public profile showing the person's current employer.
8. **Believing "SB 690 fixed it."** Private suits under § 638.51 remain possible until the operative date, the Attorney General can still enforce, and § 631 is untouched. *Check:* the person-level gate, with counsel's current read.
9. **Trusting a mapping that has gone stale.** Nobody has measured publicly how fast IP-to-company mappings decay. One source notes that "a match rate measured at signup overstates what a buyer will have twelve months later." *Check:* re-run the CRM overlap test on a schedule, not just at purchase.

> A company name on an alert card is a hypothesis until a second, outside fact agrees with it.

The subtler failure is citing the visit in copy that is otherwise good. Even when every check passes, "I noticed you were on our pricing page" bets the whole first impression on the weakest link in the stack. If the match was wrong, a stranger now knows you track visitors. If it was right, you've told a buyer the one thing they didn't choose to share. The visit-free template avoids both problems at no cost.

## Keeping the read calibrated

The rubric stays accurate only if you feed it its own results. Re-run the overlap test, review discard reasons, and re-check the moving inputs (bot share, law, tool coverage) on a fixed schedule. Don't rely on what was true when the tool was bought.

What to re-check, and where:

- **Tool precision:** the CRM-overlap test per tool, repeated on a schedule, because mapping decay hasn't been measured publicly.
- **Bot and agent share:** Cloudflare Radar's AI insights, and each AI operator's published user-agent strings and IP lists, which change.
- **Law:** SB 690's operative status, any further CIPA activity, and the ICO's storage and access technologies guidance.
- **Cut lines:** the conversion rate of each verdict over a quarter. If Corroborate alerts convert like Work Now, lower the bar. If Work Now alerts stall, raise it.
- **Contact decay:** a commonly cited figure is 2.1% per month, compounding to roughly 22.5% a year. It's attributed only to "industry research," so measure your own bounce rate instead of relying on it.

#### Before you call an alert done

- [ ] The session was confirmed human by user-agent token and published IP lists, not by timing heuristics alone.
- [ ] The network was labelled from an ASN lookup and a VPN flag, and shared networks scored 0.
- [ ] The page path was checked against careers, investor relations, unsubscribe, student-domain, and competitor-IP disqualifiers.
- [ ] CRM owner and stage were checked, and any customer or open-deal hit was handed to its owner.
- [ ] The outside signal, if scored, is named on the card with its source.
- [ ] Any named person passed jurisdiction, a current public profile, and email verification, or the alert is marked company-level only.
- [ ] The verdict and a one-line reason are logged, including for discards.
- [ ] The first message, if one was sent, makes sense without the visit and does not mention it.

## Frequently asked questions

### How accurate is website visitor identification?

Nobody has audited it independently. Practitioner ranges put company-level matching at 30-65% of US B2B traffic and person-level at 5-20%, and one vendor gives 10-40% for company-level. Precision is published only as one vendor's tiers: 60-80% for high-recall tools and 90%+ for conservative ones. The only accuracy test you can trust is the tool's overlap with accounts already in your CRM, measured on your own traffic.

### Should sales follow up on every website visit?

No. Run the gates first, so agent and crawler sessions, careers and investor relations visits, and accounts already in a deal never reach a rep. Then score what's left. Only alerts that total 7 or 8 out of 8 get a same-day touch, and even then the message leads with an outside signal. A pricing-page visit on its own, from an unverified network, isn't enough to spend a first touch on.

### Can I mention in a cold email that someone visited our pricing page?

Don't. No regulator has said whether citing a visit in outreach copy is lawful. With 60-80% precision on high-recall tools, the account may not even have visited. Shared networks and AI-agent sessions make wrong matches common. Write the first message around a public signal, such as hiring, funding, or a post about the problem, so it still makes sense even if the visit never happened.

### How do I filter ISP and bot traffic out of visitor data?

Look up the IP's ASN type and drop or downgrade isp, mobile, and VPN-flagged matches. Then check the user-agent token and test the IP against operators' published lists, such as OpenAI's ChatGPT-User file. Expect gaps. Some datacenter proxies are announced by consumer ISPs and get past ASN filters, and subleased cloud tenants read as hosting even when a real business is behind them.

### Is person-level visitor identification legal in the UK and EU?

Usually not without consent. In the EU, person-level identification generally needs the visitor's consent under ePrivacy rules plus a lawful basis under GDPR. In the UK, the ICO says organisations must get prior consent to the UK GDPR standard unless an exception applies, and that applies to a JavaScript visitor-recording snippet. If your site doesn't collect that consent, treat UK and EU alerts as company-level only.

### Did California SB 690 end CIPA risk for visitor identification?

No. SB 690 closes private suits under section 638.51, the pen-register theory built on collecting IP addresses, but only from its operative date. Until then private plaintiffs can keep filing. The Attorney General can still enforce section 638.51, and claims under sections 631 and 632 are untouched. Check the current status with counsel before you allow any person-level use.

---

*From the Refolk guide library. I revise these guides rather than replacing them, so the current version is always at https://www.refolk.ai/guides/website-visit-alert-read*