Who Visited My Website? What You Can and Can't Actually See

Can you see who visited your website?

You can see visitors at three levels:

1. Aggregate: total users, sessions, locations, devices, and channel performance.
2. Session or browser: a pseudonymous sequence of pageviews and events associated with a cookie, app instance, or similar identifier.
3. Known profile: activity tied to a customer account, email profile, checkout identity, or other recognized person.

Most visits start at level one or two. They move to level three only when a reliable identity signal exists. This is why a dashboard may show hundreds of product views while your ESP can reach only a fraction of those shoppers.

What can website analytics tools show?

Google Analytics, Shopify Analytics, Klaviyo, and session-experience tools answer different questions.

Shopify's acquisition reports can show sessions and visitors by referrer, location, and time. GA4 can show detailed event paths and channel performance. Klaviyo can show activity associated with identified profiles. None of these statements means a store owner receives a universal list of every human who visited.

What can analytics tools usually not show?

Standard analytics usually cannot reveal:

• the full name behind every session;
• an email address for every browser;
• a phone number that the visitor never provided;
• a guaranteed cross-device identity;
• a person's exact physical location; or
• permission to contact someone merely because an identifier exists.

Google's policies explicitly prohibit customers from sending personally identifiable information to Google Analytics. Treat GA4 as a behavioral measurement system, not a CRM or identity database.

> Helpful next step: If you need the practical workflow rather than the category overview, read how to identify website visitors.

When can you identify a website visitor?

1. They log in

A logged-in session can be linked to the account holder through a first-party customer ID. This is one of the strongest identification signals because the visitor actively authenticates.

2. They submit a form

A newsletter form, quiz, gated resource, back-in-stock alert, or contact form can create a known profile. Store the source, timestamp, form language, and applicable consent state with the record.

3. They start checkout

Once a shopper enters contact details, the store may be able to associate cart and checkout behavior with that profile. The ability to send follow-up marketing still depends on local rules, the type of message, and your disclosures and consent choices.

4. They click a tracked email

A tracked click from an existing subscriber can let an ESP associate the destination browser activity with that profile. This recognition can fail when identifiers expire, storage is cleared, or the shopper switches devices.

5. An identification platform finds an eligible match

Some platforms attempt to connect an anonymous session to an identity from permitted data sources. Ecommerce tools focus on consumer profiles; B2B tools may identify a visiting company or professional contact. Coverage is never universal and often varies sharply by geography and traffic source.

Anonymous visitors vs known visitors

The categories should remain separate in reporting. A form subscriber, existing customer, and third-party matched visitor do not have the same relationship with your brand, even if all three ultimately appear as email profiles.

How can ecommerce stores identify more visitors?

Use a layered system rather than betting on one pixel:

1. Improve first-party capture. Offer useful forms, account benefits, back-in-stock alerts, and clear checkout experiences.
2. Connect known identities. Configure login, checkout, and tracked email signals so activity reaches the correct customer profile.
3. Send reliable commerce events. Make sure product views, add-to-cart events, checkout starts, and purchases reach the systems that trigger flows.
4. Measure recognition gaps. Compare high-intent Shopify events with eligible profiles and Klaviyo flow entries.
5. Test visitor identification where appropriate. Add an identification layer only after consent, suppression, and measurement foundations are ready.

Attribuly Capture is built for high-intent U.S. ecommerce traffic. It can attempt to identify eligible anonymous shoppers and sync the resulting profile and behavior to Klaviyo and supported advertising destinations.

If Klaviyo already knows the email but cannot connect the current visit to that subscriber, the problem is customer recognition rather than a completely anonymous person. Attribuly's ReCapture workflow addresses that scenario separately.

> See how many anonymous shoppers your Shopify store could identify.

Why does this matter for Shopify stores?

An ecommerce session has a short economic half-life. A shopper may view a product, add it to cart, and leave within minutes. If the store cannot connect that intent to an eligible profile, the shopper may never enter a browse or cart recovery flow.

This creates four operational gaps:

• paid traffic leaves without becoming an owned audience;
• high-intent events outnumber reachable profiles;
• Klaviyo flows underfire despite correct email logic; and
• revenue reports optimize message conversion while ignoring missing reach.

The goal of Shopify visitor identification is to close an appropriate portion of that reach gap—not to make every human on the internet personally visible.

What about privacy and compliance?

Visitor identification is not automatically compliant or noncompliant. The details determine the answer.

Your implementation should address:

• what data is collected and from which source;
• whether consent is required before collection or activation;
• how the practice is disclosed in your privacy notice;
• which vendors receive the data and under what contract;
• how opt-outs, deletion requests, and suppressions are honored;
• where visitors are located; and
• whether the planned message is commercial, transactional, or otherwise regulated.

The FTC's CAN-SPAM guidance covers U.S. commercial email requirements, including accurate headers, nondeceptive subjects, a postal address, an opt-out mechanism, and honoring opt-outs. The CCPA gives covered California consumers rights related to personal information. Other jurisdictions can require prior consent for cookies or direct marketing.

Do not use this article as legal advice. Ask qualified counsel to review your specific data sources, consent interface, notices, vendors, and messaging workflow.

What should you do next?

Run this four-step identity audit:

1. Count known profiles. Measure how many unique visitors become recognized through login, forms, checkout, or tracked email.
2. Compare intent with flow entry. Look at Shopify add-to-cart and checkout events versus eligible Klaviyo flow entries.
3. Find the failure point. Separate missing identity, missing event delivery, suppression, and incorrect flow logic.
4. Test one controlled change. Improve first-party capture, fix event delivery, or pilot identification with segmented monitoring and a baseline.

Track more than volume. Watch verified identity quality, bounce and complaint rates, unsubscribe behavior, incremental orders, and profit after software and sending costs.

> If you want to evaluate this with your own store data, start a free trial in Attribuly and compare your Shopify intent volume with your reachable Klaviyo audience before choosing a tool.

Common mistakes

Mistake 1: Assuming a session is a person

Why it matters: One person may create multiple sessions or devices, and a shared device may represent multiple people.

What to do instead: Use stable first-party identifiers where available and state the limits of browser-level metrics.

Mistake 2: Treating an email match as blanket permission

Why it matters: Data availability, consent, and legal permission are separate questions.

What to do instead: Preserve provenance and consent state, segment matched profiles, respect suppressions, and review applicable law.

Mistake 3: Optimizing only the number of identified profiles

Why it matters: More profiles can also mean more cost, complaints, and irrelevant messages.

What to do instead: Measure incremental revenue and customer experience alongside coverage.

You can see intent before you see identity

You will not know every person who visits your website, and you should be wary of any product that implies otherwise. You can understand anonymous behavior, recognize some known visitors, and responsibly connect a portion of high-intent ecommerce sessions to reachable profiles.

Start a free trial in Attribuly to evaluate the gap in your own Shopify and Klaviyo data.