Website Visitor Identification for Agencies: Honest Client Reporting
How agencies can report which companies visited a client's site, set it up per client and avoid over-claiming.
Agencies add visitor identification to client reports because a list of identified companies reading the pages you optimised is clearer than a session count. Set up one account per client so data, consent and billing stay separate, report companies by confidence band, and never call an identified visit a lead.
In short
- A list of identified companies on the pages you optimised is a clearer result for B2B clients than a session count.
- One account per client keeps data, consent and billing separate, and unlimited users let client and agency both log in.
- Report companies by confidence band, with the pages and searches behind them and what the client's sales team did next.
- The client is normally the controller for visitor data; an agency that reuses it for its own purposes risks becoming a controller.
- Charge for analysis and reporting, not for leads, and set expectations that coverage is never complete.
Website visitor identification for agencies is mostly a reporting question: how do you show a client which organisations visited the pages you worked on, without over-claiming? Done well, it turns "sessions went up" into a list of real companies a managing director recognises. This guide covers set-up across clients, what a monthly report should show, who is responsible for consent, and how to price it honestly.
Why do agencies add visitor identification to client reporting?
Because it makes results concrete. "Organic sessions rose 20%" is abstract to most clients. "Fourteen companies in your target sector read the service pages we rewrote, and three came back twice" is a story the client's sales team can check and act on.
It also connects your work to the client's pipeline. SEO and PPC reports usually stop at traffic and conversions. A list of identified companies sits between the two: more concrete than sessions, earlier than enquiries. That is useful for B2B clients with long sales cycles, where a quarter may pass before the work shows up as revenue.
The risk is the same as the benefit. A company name on a report looks like a lead, and it is not one. More on that below.
How should it be set up across clients?
The cleanest structure is one account per client, not one agency account covering everyone. Three reasons:
- Data stays separate. Each client's visitor data belongs to that client. Mixing it in one account makes it harder to hand over, delete or audit.
- Consent and privacy notices differ. Each client site has its own consent set-up and its own privacy notice.
- Billing follows the client. If the relationship ends, the client can keep the account, or cancel it, without untangling a shared plan.
Where possible, let the client own the account and invite the agency in. With Scout, every plan includes unlimited team members, so the client's marketing lead, their sales team and your account manager can all log in without per-seat costs. Billing is monthly and can be cancelled any month, so a subscription can follow the length of the engagement. See pricing for what each plan includes.
Installation is one script snippet in the site's <head>, which also works through Google Tag Manager. For WordPress clients, our guide to website visitor identification on WordPress walks through the options.
What should the monthly report show?
Report what the data can support, grouped so the client can act on it.
| Section | What to include | Why it matters |
|---|---|---|
| Identified companies | Count and list, split by confidence band | Shows scale without inflating it |
| Pages and searches | Which pages and search queries brought them | Links companies to your work |
| Return visits | Companies seen more than once | Repeat interest is a stronger signal |
| Sales actions | What the client's team did with them | Closes the loop |
Confidence bands. Scout gives every identified company a confidence score from 1 to 99 and a high, medium or low band. ISP, residential, mobile, VPN and data-centre traffic is flagged and held in the low band. Lead the report with the high band and treat the rest as context.
Pages and searches. With the client's Google Analytics 4 and Google Search Console connected, each company shows session depth, the pages read and the search queries associated with it. This is where your SEO or content work becomes visible: a named company reading the page you optimised, after a search for the term you targeted.
Sales actions. Ask the client what happened. Even a short note ("called two, one meeting booked") makes the next report far more useful, and our guide to following up with companies that visited your website can help their team.
An illustrative summary line. Here is how the headline of a monthly report might read for a fictional client: "In October, 41 companies were identified on the site, 12 of them in the high confidence band. Nine of the 12 read the three service pages rewritten in September, and four arrived from searches for terms we target. Two have visited more than once. Your team contacted three; one meeting is booked." Every number in it can be checked in the account, and none of it calls a visit a lead.
Scheduled reports can be emailed weekly or monthly, and the company list exports to CSV, so the data can drop into whatever reporting template you already use.
Who handles consent and the privacy notice?
This is general information, not legal advice. Have your own contracts reviewed by a solicitor.
Under UK GDPR, a controller is the body that "determines the purposes and means of the processing of personal data", and a processor "processes personal data on behalf of the controller".1 For visitor identification on a client's website, the client decides to identify visiting organisations and why, so the client is normally the controller. Scout's privacy policy states that Swarm Labs IO Ltd is the data processor and its customers are the data controllers, responsible for getting "any consent their visitors need before the Scout snippet loads".2
Where does that leave the agency? If you run the account on the client's instructions, you are likely acting for the client too. The ICO warns that a processor who acts "outside your instructions or process[es] for your own purposes" will "step outside your role as a processor and become a controller for that processing".3 In practice, that means never reusing one client's visitor data for another client or for your own new-business work.
The ICO also notes that processing by a processor must be governed by a contract.4 Check that your client agreement covers the data you handle.
The practical split of jobs:
- The client decides whether to use the tool, owns the privacy notice and decides the consent approach.
- The agency installs the snippet so it respects the client's consent set-up, updates the notice if asked, and keeps each client's data separate.
On consent itself, the ICO's guidance on storage and access technologies lists the exceptions where consent is not needed, including a statistical purposes exception with strict conditions.5 Whether a given set-up fits is the client's decision. Our guide to website visitor identification and GDPR goes further.
Should you white-label it?
Only if your client contract and the vendor's terms both allow it. White-labelling hides who processes the data, which can complicate the privacy notice and any processor contract.
Scout is sold under its own name and does not offer a white-label version. For most agencies that is simpler: the client can see which tool is running on their site, name it in their privacy notice, and keep using it if they move agency.
How should you price it to clients without over-promising?
Charge for the work around the data, not for "leads".
- Pass the subscription through at cost, or have the client pay directly. With one account per client, direct billing is easiest.
- Charge for analysis and reporting time. Interpreting the list, matching it to the client's CRM and presenting it is agency work.
- Report visits and confidence, not leads. An identified visit tells you an organisation's network visited. It does not tell you who, or why.
- Set expectations on coverage. Home-working, mobile and VPN traffic cannot be tied to a company, so the list will never cover every visit.
If you need the data in your own dashboard, Scout offers an open REST API (JSON, scoped keys) on selected plans, and custom integrations can be built on request. Companies can also be pushed to HubSpot, with Slack and email alerts for the client's sales team.
Getting started
Unlimited users, one account per client, and monthly billing you can cancel any month. Compare plans, or start a 14-day free trial on one client site first, no card needed.
Frequently asked questions
Can the client keep or cancel the account if we stop working together?
If the account is set up in the client's name from the start, it stays with them when the engagement ends. Scout is billed monthly and can be cancelled any month, so the client can keep it or cancel it without waiting for a contract to run out.
Does it integrate with our reporting dashboard?
Scout offers an open REST API with JSON responses and scoped keys on selected plans, and the company list exports to CSV. Custom integrations can be built on request. Scheduled reports can also be emailed weekly or monthly.
Do we need the client's GA4 access?
Not for identification itself, which works from the script snippet. Connecting the client's Google Analytics 4 and Google Search Console adds session depth, pages read and associated search queries, which is the part that links companies to your SEO or content work.
Can we white-label Scout?
No. Scout is sold under its own name and does not offer a white-label version. That keeps the processor clearly named in the client's privacy notice.
Sources
- ICO: What are controllers and processors? ico.org.uk
- Scout: Privacy policy scoutmetrics.co.uk
- ICO: What does it mean if you are a processor? ico.org.uk
- ICO: When is a contract needed and why is it important? ico.org.uk
- ICO: Guidance on the use of storage and access technologies, what are the exceptions? ico.org.uk