Every de-anonymization method works the same way underneath. Take a signal a browser or device already leaks, run it against a database that maps that signal to a real-world identity, and return a match with some level of confidence attached. The differences between vendors sit in which signal they use, which database they run it against, and how honestly they express that confidence, not in whether the underlying process is guesswork dressed up as certainty.
The three signals de-anonymization tools actually use
Almost every de-anonymization product on the market runs on one of three underlying signals, and vendors rarely say which one they are actually using. The first is a cookie or device graph: a data broker has already linked a cookie or device ID to a name and address somewhere else, usually through data-sharing agreements spanning many sites and apps, and sells access to that link. The second is IP intelligence, where the visitor's IP address gets checked against a database of known IP-to-business or IP-to-household mappings, the mechanism behind most B2B tools that claim to show which company visited a site. The third is hashed PII matching. An email or phone number a business already collected gets hashed and matched against a hashed identifier the visitor happens to be carrying, most often through an ad platform's own audience-matching system. This one reunites a business with a customer it already had; it does not identify a true stranger.
Some vendors run more than one of these in parallel and merge the results into a single number before it ever reaches a dashboard, which makes it hard to tell what actually produced a given match.
| Signal | What it matches on | Typical scope | Where it breaks |
|---|---|---|---|
| Cookie or device graph | Browser or device ID against a broker's identity file | Individual, when the graph is correct | Cleared cookies, new devices, ad blockers, and Safari or Firefox's default cookie limits |
| IP intelligence | IP address against a business or household database | Company or household, rarely a named individual | Shared IPs: offices, apartment buildings, coffee shops, VPNs, and carrier-grade NAT on mobile networks |
| Hashed PII match | Hashed email or phone against a hash the visitor already carries | Individual, but only people already in a business's own contact list | Only works on existing contacts, so it says nothing about a genuine stranger |
Why "who is this visitor" usually means "who probably owns this IP"
An IP address is not a person. It is a network address that a router, an office, a phone carrier, or an entire apartment building can share among dozens or thousands of devices at once. When a de-anonymization tool reports a match, what actually happened in most cases is that an IP address was checked against a database and returned the most likely business or household associated with that address, at that moment. A remote worker on a home connection can get attributed to their internet provider's business customer instead of their employer. A visitor on a coffee shop's wifi or behind a VPN can get attributed to whoever else is sharing that exit node. None of this is a flaw in one particular vendor so much as a structural property of IP-based matching, which is why an honest tool separates a high-confidence match from a low-confidence guess instead of presenting both as the same thing.
De-anonymization vs visitor identification vs visitor tracking
These three terms get used loosely and they answer different questions. Website visitor tracking counts and describes traffic, pageviews, sessions, referrers, without attaching any identity to it at all. Visitor identification, covered in what is a visitor ID, assigns an anonymous but consistent token to a browser or IP so a system can tell "probably the same visitor as last week" without knowing who that is. De-anonymization is the step past both of those: an attempt to attach a name, a household, or a company to that anonymous token. It is the most aggressive of the three, the least certain, and the one that carries the most privacy weight, which is exactly why vague marketing language around it deserves more scrutiny than the other two.
What a de-anonymization match does not tell you
No de-anonymization method identifies every visitor. Most traffic to most sites goes unmatched, because the visitor's IP or cookie simply is not present in whatever database the tool is checking against. A match is also not proof. It is a probability, and even a high-confidence match can be wrong when an IP is shared or a cookie graph is stale. Treating a de-anonymization report as a verified guest list, rather than a set of educated guesses ranked by confidence, is the most common way businesses misuse this category of tool. A related and often overlooked idea is that a matched identity is only as trustworthy as the weakest link that produced it, which is exactly the structure covered in what is an identity graph.
The compliance line, stated plainly
Matching an anonymous visitor to a real person's name, address, or contact details touches privacy law directly, including GDPR in the EU and CCPA and CPRA in California, and the requirements differ by jurisdiction and by exactly what got matched. Reuniting a business with its own existing customer through a hashed email is a different legal situation than identifying a stranger who has never given that business anything. No tool in this category should describe itself as fully compliant or fully legal in the abstract, because compliance depends on the specific data, the specific jurisdiction, and how the result gets used afterward, not on the tool alone.
How Raydar approaches this
Raydar takes a narrower approach: a hashed version of the visitor's IP address, tagged with an explicit high-confidence or low-confidence tier instead of one blended score. There's no device fingerprinting involved and no broker lookup running underneath it, and Raydar doesn't claim to identify everyone who clicks a link. Coverage stops at the links and pages Raydar actually serves. What a visitor does on a different site afterward is invisible to it, and rightly so, since that's a separate category of product, closer to the site-wide trackers described above than to a link-level tool. Anyone evaluating a match rate figure, Raydar's or a competitor's, should ask which of the three signals above produced the number. That answer tells you more than the percentage does.