What Is Identity Resolution? How It Works (2026 Guide)

Identity resolution is the process of connecting scattered data points (emails, phone numbers, device IDs, cookies, postal addresses) to the single real person they belong to. It turns "anonymous browser #48213" and "[email protected]" into one profile, so a business can recognize, count and reach the same customer across channels.

Key takeaways

• Identity resolution links identifiers to one person. An identity graph is the database that stores those links.
• Deterministic matching uses exact, verified identifiers and is precise. Probabilistic matching infers likely links from signals and adds reach at some cost to accuracy. Most tools blend both.
• Website visitor identification is one practical use: a pixel collects signals from a visit and resolves them against an identity graph to return a name, email or phone.
• Privacy is part of the job, not an add-on: consent where state law requires it, honest data handling, and outreach that helps instead of startles.
• When you compare identity resolution tools, look at person-level vs company-level output, geography, match rate honesty, data freshness and price per identified record.

What is identity resolution, in plain English?

Every customer leaves a trail of fragments. They browse your site on a phone, open an email on a laptop, call from a cell number and fill out a form with a work address. Each system you own sees one fragment and treats it as a separate "person."

Identity resolution is the work of answering one question: which of these fragments are the same human? Once you answer it, you can stop sending duplicate mail, stop counting one buyer as three leads, and start seeing the whole journey.

The output is usually a resolved profile with a persistent ID, plus the identifiers attached to it: names, emails, phone numbers, addresses, device and browser IDs, and sometimes attributes like homeowner status or age range.

How does identity resolution work?

Most systems follow the same four steps, whether they run inside a customer data platform or a website visitor identification tool.

1. Collect identifiers. Data arrives from forms, a site pixel, a CRM, email clicks, call logs, purchases and offline lists.
2. Clean and standardize. Emails are lowercased, phone numbers formatted the same way, addresses normalized, and many identifiers are hashed so raw values are not passed around.
3. Match. Rules and models decide which records belong together, using deterministic matching, probabilistic matching, or both.
4. Merge and maintain. Matched records are grouped under one ID in an identity graph. The graph is updated as new signals arrive and as people move, change numbers or switch emails.

That last step is where many projects struggle. People change jobs, phones and addresses all the time, so an identity graph is never "done." Freshness matters as much as size.

Deterministic vs probabilistic matching: what is the difference?

Deterministic matching links two records only when they share an exact, known identifier, such as the same hashed email, the same login ID or the same phone number. If a person logs in on their phone and later on their laptop with the same account, those two devices can be tied together with high confidence.

Probabilistic matching estimates the likelihood that two records belong to the same person from signals like IP address, device characteristics, location and timing. It can connect records that share no exact identifier, which adds reach, but every link carries some chance of being wrong.

The data platform RudderStack describes the tradeoff clearly: deterministic links are high precision with limited coverage of anonymous users, while probabilistic links cover more ground but risk incorrect merges (RudderStack, as of October 2026).

Factor	Deterministic matching	Probabilistic matching
How it links records	Exact shared identifier (email, phone, login)	Statistical likelihood from signals
Accuracy	High	Moderate, depends on the model and thresholds
Reach	Lower, needs a known identifier	Higher, works on more anonymous traffic
Typical inputs	Hashed emails, phone numbers, account IDs	IP address, device traits, location, timestamps
Main risk	Missing people who never identify themselves	Merging two different people into one profile
Best for	Outreach, billing, compliance requests	Audience sizing, measurement, broad targeting

In practice, good systems use deterministic links as the backbone and add probabilistic links only where confidence clears a threshold. When you plan to email or phone someone, precision matters more than reach. A wrong match is not just wasted effort, it is a message to a stranger.

What is an identity graph?

An identity graph is the database that holds all the identifiers known to belong to each person, and the links between them. Think of each identifier (an email, a phone, a device) as a dot, and each confirmed connection as a line. A cluster of connected dots is one person.

There are two broad kinds:

• First-party graphs are built from your own data: your CRM, your logins, your orders. They are accurate for your customers but know nothing about people who have never identified themselves to you.
• Third-party or partner graphs are built by data providers across many sources. They can recognize people who are new to you, which is what makes identifying anonymous website visitors possible.

Size gets the headlines, but three other qualities decide whether a graph is useful: how often it is refreshed, how many identifiers each profile has, and whether its sources were collected with proper notice and consent.

What is customer identity resolution used for?

Customer identity resolution shows up in more places than most people realize:

• A single customer view. Merging duplicate CRM records so sales and service see one history.
• Personalization. Recognizing a returning shopper on a new device.
• Measurement and attribution. Connecting an ad click on one device to a purchase on another.
• Fraud prevention. Spotting when many "new" accounts share the same underlying identity.
• Privacy requests. Finding every record tied to a person who asks to see or delete their data.
• Website visitor identification. Turning anonymous traffic into named, reachable leads.

How does website visitor identification use identity resolution?

Most of the people who visit a business website never fill out a form or call. Analytics tools count them, but by design do not tell you who they are. Google Analytics, for example, asks that no data be sent to it that could identify a person (Google Analytics Help, as of October 2026).

Visitor identification fills that gap with identity resolution:

1. A small script on the site collects signals from the visit, using a first-party cookie.
2. Those signals are matched against an identity graph.
3. When a match clears the confidence bar, the tool returns a profile: name, email and phone where available, plus pages viewed.
4. The record is sent to the business's CRM so the team can follow up.

There are two very different levels of output, and the difference matters:

• Company-level identification uses reverse IP lookup to name the business whose network the visit came from. It suits B2B sales to larger companies, but it cannot name a person, and it struggles when people browse from home internet, mobile data or privacy relays such as Apple's iCloud Private Relay, which assigns a temporary IP when you connect to a site (Apple Support, as of October 2026).
• Person-level identification resolves the visit to an individual. It is the only kind that helps a roofer, dentist or mortgage broker, because their buyers are households, not companies.

For a deeper walkthrough of the process, see how to identify anonymous website visitors.

Is identity resolution legal, and how do privacy and consent fit in?

Identity resolution is legal in the U.S. when it is done with proper notice, consent where required, and respect for consumer rights. The rules depend on where your visitors live and how big your business is.

• State privacy laws. A growing number of states have comprehensive privacy laws. California's CCPA, for example, gives residents the right to know, delete, correct and opt out of the sale or sharing of their personal information, and applies to for-profit businesses that meet thresholds such as more than $25 million in annual gross revenue (California Attorney General, as of October 2026). The IAPP state privacy legislation tracker is a good way to follow which states have passed laws.
• Consent on your site. Your privacy policy should explain that you use visitor identification. Where state law requires it, visitors should be asked for consent before the script runs.
• Email rules. Any marketing email you send to identified visitors must follow CAN-SPAM: accurate sender information, an honest subject line, a physical postal address and a working opt-out that is honored within 10 business days (FTC, as of October 2026).
• Tone. Legal is the floor, not the goal. People should feel helped, not watched. That is why the first touch should be a useful email about the topic they care about, and it should never mention their visit.

This is general information, not legal advice. Talk to your attorney about your specific situation.

How do you evaluate identity resolution tools and software?

"Identity resolution software" covers everything from enterprise customer data platforms to plug-in visitor identification tools. Before you compare vendors, decide which job you need done. Then ask these questions:

1. Person or company? Do you need named individuals with contact details, or just the businesses visiting? Consumer and local service businesses need person-level.
2. Which geography? Many person-level graphs cover U.S. consumers only. Make sure the graph covers where your buyers live.
3. How honest is the match rate? Ask what percentage of real, non-bot traffic gets identified, and whether results vary by site. Be wary of anyone who promises a fixed number.
4. How deep is each profile? Count the data points you actually get: name, email, phone, address, and any household or demographic attributes.
5. How fresh is the data? Ask how often the graph is refreshed. Stale emails bounce and stale phones reach the wrong person.
6. Where does the data go? Native delivery to your CRM beats a CSV you have to remember to download.
7. Does it help you prioritize? Intent scoring and alerts keep your team focused on the hottest records.
8. What does it really cost? Divide the monthly price by the identified records you expect. Check for setup fees and contract terms.
9. How is consent handled? Look for consent prompts where state law requires them and clear documentation you can share with your attorney.

Two examples show how differently tools approach the problem. Leadfeeder identifies the companies visiting a site and does not show individual visitors by default (Leadfeeder, as of October 2026). RB2B offers person-level identification aimed at B2B teams, with names, LinkedIn profiles and business emails, and describes its person-level data as U.S.-only (RB2B, as of October 2026). Neither approach is wrong. They are built for different buyers. See our side-by-side notes on LeadSpyder vs Leadfeeder and LeadSpyder vs RB2B.

Where does LeadSpyder fit?

LeadSpyder is person-level identity resolution built for U.S. small and midsize businesses whose buyers are consumers and households: home services, healthcare practices, mortgage, insurance, real estate, legal and similar.

• Person-level, not company-level. LeadSpyder identifies the people visiting your website, with name, email and phone where available, plus company, job title and LinkedIn profile for business visitors, and delivers them to your CRM.
• A large U.S. graph. Matches resolve against a 269M+ U.S. consumer profile identity graph, with up to 27 data points per profile.
• Honest match rates. On average, LeadSpyder identifies 30% or more of non-bot, U.S.-based website traffic. Results vary by site.
• Prioritized. SpyderScore ranks each identified visitor 0 to 100 by intent, and SpyderAlert notifies your team.
• Quick to start. One script in your site header, about 10 minutes on average to go live.
• Consent-aware. The pixel uses a first-party cookie, and consent is asked first where state law requires it. U.S. visitors only.

Example: a site with 2,000 non-bot, U.S.-based visits a month at a 30% identification rate would see about 600 identified visitors, which matches the Starter plan's 600-visitor allowance. Your numbers will differ. See pricing for plan details.

What should you do with resolved identities?

Resolving an identity is only half the job. What you do next decides whether it builds trust or burns it.

1. Send a helpful email first. Share something useful on the topic they care about: a seasonal checklist, a pricing guide, an answer to a common question. Reference the topic, never the visit.
2. Wait for a signal. Move to a phone call or text only after the person replies, fills in a form or calls you.
3. Prioritize by intent. Work the highest-scoring records first.
4. Respect opt-outs. Honor unsubscribes promptly and keep your suppression list clean.

Frequently asked questions

What is identity resolution in marketing?

It is the process of linking a customer's identifiers across devices and channels into one profile, so marketers can recognize the same person everywhere, measure accurately and avoid duplicate outreach.

What is the difference between identity resolution and an identity graph?

Identity resolution is the process. The identity graph is the database it builds and reads from, holding every identifier and the links between them.

Is deterministic or probabilistic matching better?

Neither wins everywhere. Deterministic is more accurate and is the right choice when you will contact people. Probabilistic adds reach for measurement and audience sizing. Most tools combine both.

Can identity resolution identify every website visitor?

No. Some visitors cannot be matched with enough confidence, some are bots, and some are outside the graph's coverage. On average, LeadSpyder identifies 30% or more of non-bot, U.S.-based website traffic. Results vary by site.

Do I need consent to use identity resolution on my website?

It depends on the state laws that apply to you and your visitors. Disclose it in your privacy policy, ask for consent where state law requires it, and check with your attorney.

How much do identity resolution tools cost?

Enterprise platforms are often custom-priced. Visitor identification tools are usually monthly plans. LeadSpyder plans start at $200 a month for 600 identified visitors, with no setup fees or contracts.

Ready to see who your website traffic really is? Start for $1: 7 days, up to 50 identified visitors. No contracts. Cancel anytime. Live in about 10 minutes on average.