You visit a website, look at a product or pricing page and leave. You do not fill in a form. You do not give the company your email address. Yet later, a sales email arrives.
For most people, the obvious question would be: how did they know who I was?
That question deserves more attention following Warmly’s 30 June announcement that it had entered into an agreement to be acquired by HubSpot. Warmly develops technology designed to turn anonymous website traffic into identifiable companies and, in some cases, individual people.
Warmly’s own documentation is unusually revealing about how this works. It describes collecting signals including IP addresses, device IDs and browser details and cross-referencing them with a network of publishers and data providers. Another document lists identification sources including personal and work email databases, IP-to-contact matching and a “Shared Warmly Cookie.”
Its data-quality documentation goes further. Warmly says it can identify the name and email address of people who visited a customer’s website but had not converted. It describes using cookies, browser fingerprinting and IP matching, as well as multiple outside data providers and confidence scoring.
It also says it can monitor partial form fills, attempting to autocomplete partially entered forms so that the visitor can be tagged when they return.
This is an important privacy distinction. The person has not necessarily handed that website their email address or completed the action normally associated with identifying themselves. The technology is attempting to make that connection through other information.
And Warmly acknowledges that identification is not always correct. It describes fingerprint and IP matching as probabilistic. Its own documentation presents accidentally contacting some wrongly identified people as one possible trade-off against missing potential leads.
The HubSpot connection makes the issue more significant. Warmly documents a workflow in which identified website visitors can be automatically written into a CRM, including creating a contact with name, email and job title and attaching information such as pages visited and when the person was last seen on the site. It specifically supports syncing those visitors into HubSpot whether or not they filled out a form.
HubSpot, meanwhile, is expanding automated prospecting. Its Prospecting Agent can research contacts and prepare sales outreach. Customers can choose “Review before sending” or “Send automatically”. In the latter mode, HubSpot says the agent sends emails without human review.
Put those developments together and the privacy concern becomes difficult to dismiss. Browsing activity can contribute to identifying a person, creating or enriching a CRM record, and ultimately contacting that person, potentially without them ever submitting the website’s form.
There is also an uncomfortable question inside HubSpot’s own rules. Its Acceptable Use Policy says customers may not use HubSpot in a way that “harvests or otherwise collects information about others, including e-mail addresses, without their consent.”
That does not establish that HubSpot or Warmly is violating the law or HubSpot’s policy. There may be important technical, contractual and legal distinctions between prohibited harvesting and the data-enrichment and visitor-identification services involved here.
But HubSpot should explain where it draws that line.
Europe adds further questions. GDPR governs the processing of personal data, while the ePrivacy framework separately addresses tracking technologies and unsolicited electronic marketing. Legitimate interest has to be assessed rather than declared. European data-protection guidance requires that assessment to cover necessity, impact on the individual and their reasonable expectations. Rules governing B2B marketing can also differ under national implementations.
For the person on the other side of the screen, however, the issue is less technical.
Looking at a pricing page is not the same as handing over your email address.
Technology may increasingly be able to bridge that gap.
The privacy question is whether it should.
