You read a pricing page. You didn't fill in anything. Four days later an SDR emails you about that exact product. This is not a coincidence and it isn't magic. It's a chain of four joins, and only one of them is genuinely under your control.
Every HTTP request carries your public IP address. There's no tracker involved and nothing to block: the vendor's web server sees it because that's how the request gets back to you. This is the floor, and no browser setting removes it.
The vendor matches that IP against a database of known corporate IP ranges (MaxMind, IPinfo, or a specialised B2B IP graph) and gets back a company name, industry, size and location. This is called reverse IP lookup, and it's the oldest and cheapest form of visitor identification.
Two things are worth knowing about it. First, it is account-level only: it tells the vendor a company, never a person. Second, it is far less effective than the marketing implies. Accuracy is typically quoted at 30–60%, and it depends almost entirely on connection type. It works on a corporate office network with a registered static range, and works poorly on home broadband, mobile, VPNs, or shared ISP addresses.
Which means remote work broke it. As hybrid became normal, the share of B2B traffic arriving from identifiable corporate IPs fell sharply, by some estimates below 20% for many sites. That collapse is the reason the rest of this chain exists.
Here a script enters the picture. A visitor-identification pixel loads in the page and writes a first-party cookie, sometimes alongside device and browser signals. On its own this identifies nobody. It only establishes that the visitor on Tuesday and the visitor on Friday are the same browser.
That continuity is what makes the last stage possible. An anonymous browser you can recognise twice is a slot waiting for a name.
This is the stage most people don't know exists, and it's the one that matters.
Person-level vendors don't identify you from your visit. They identify you because they already knew you, from somewhere else. RB2B, for instance, describes its method as a permissioned publisher network: a set of sites that share identification signals, combined with first- and third-party cookies, device IDs and IP addresses. When a browser in that network is matched, the record is then enriched from LinkedIn and other professional data sources to produce a full contact.
The input that starts it is almost always a form you filled in. Not on the vendor's site, anywhere in the network. You downloaded a whitepaper eight months ago and typed your real work email. That address became attached to your browser. Every site in that network can now resolve that browser to you, forever, without you ever filling in anything again.
Read the match rates sceptically. Vendors advertise 40–45% contact-level identification of US traffic; independent write-ups put the realistic figure closer to 5–20%. Both numbers come from people selling something, so treat them as an upper bound rather than a measurement.
Person-level identification is effectively a US-only practice, and the reason is legal rather than technical.
Under GDPR, resolving a visitor to a named individual is processing personal data, and it requires explicit consent. As does setting the cookie that makes it possible, under the ePrivacy Directive. Consent rates for that kind of tracking are low enough that no serious vendor attempts it in Europe. Company-level identification is treated differently: a company is a legal entity rather than a natural person, so IP-to-company resolution generally proceeds under legitimate interest without consent.
So the same script on the same site behaves differently depending on where you are. In the US it may return your name. In the EU or UK it returns your employer and stops. That is not a technical limitation the industry is trying to solve. It's a legal line it has decided not to cross.
The chain only works if every stage completes. Break any one and the vendor is left with strictly less. Ranked by how much they actually accomplish:
Don't feed the identity graph. This is the highest-leverage move and the one nobody frames as a privacy measure, because it doesn't look like one. Every real email address you type into a form is a permanent join key. You can't retract it, you can't see which networks hold it, and no browser setting reaches it. But you decide, every single time, what you type.
Block the script. A content blocker that stops the identification pixel loading prevents the cookie being written and the device being recognised. This is genuinely effective against stages 3 and 4, but note it does nothing about stage 2, because IP-to-company resolution can run entirely server-side from web logs, with no script to block.
Change your IP. Only a VPN, a mobile connection, or Tor moves this. Private windows do not. Incognito clears cookies, not your network address. This is the most commonly given advice and the most commonly misunderstood: a private window is useful against stage 3 and irrelevant against stage 2.
Stages 1 and 2 identify your employer. Stage 4 identifies you, and those are very different harms. "A vendor knows someone at my company read their pricing page" is mildly annoying. "My name, title and direct dial are in six resellable databases and I'm now in a sixteen-touch nurture sequence" is the thing people actually want to stop.
The second one runs entirely on your email address. Which is the part you can decide about.
This is the problem Moniker is built for, and it's worth being precise about what it does and doesn't do. It doesn't hide your IP, so a vendor may still infer your employer. It isn't a tracker blocker.
What it does is give you a verified alias address to type into those forms instead of your real one, so the join key that would have followed you around for years is one you can see, control, and switch off. The vendor still gets a real, monitored inbox and a qualified buyer. They just don't get a permanent handle on the person behind it.
Related reading: how ZoomInfo and Apollo build their databases · the full researched case against the B2B data-broker model · the opt-out toolkit.