Storage permission comes first
Non-essential identifiers, SDKs, pixels, enrichment jobs, and profiling events stay off until the visitor chooses the relevant purposes.
Field guide
Four boundaries for useful, defensible visitor intelligence.
A practical model for B2B teams that want better first-party signal without collapsing consent, identity, and outreach into one vague permission.
A company candidate is not a person
Network and organization context needs source and confidence. It cannot reveal an arbitrary email or prove where someone works.
Identity must be deterministic
Forms, logins, bookings, chats, signed links, and lawful CRM matches can associate a person with permitted activity. Guessing cannot.
Email permission remains separate
A qualified lead and an accepted cookie banner do not create direct-marketing permission. Channel rules and suppression state still apply.