The average ecommerce site still converts somewhere around two to three percent of its traffic. That means the other 97 percent walked through your store, looked at your shelves, and left without you learning a single name. For two decades, marketers papered over that gap with third-party cookies. Those cookies are now mostly gone, and the brands that never built their own identity layer are the ones scrambling.
Here is the uncomfortable part: most retail teams didn’t lose their data overnight. They lost it slowly, one browser update at a time, and nobody owned the problem. Chrome has been phasing out third-party cookie support, Safari and Firefox blocked them years earlier, and the shared tracking pixels that used to stitch together a customer journey across sites are now close to worthless. If your growth plan still leans on retargeting lists built from someone else’s data, you’re renting your audience from a landlord who’s evicting you.
The replacement isn’t a better pixel. It’s first-party identity data, built from signals you actually own, and a growing share of B2C teams are now evaluating the best b2c website visitor identification platforms specifically to close that gap. The rest of this piece is about what that actually means in practice, and where I think most teams get it backwards.
Why the cookie collapse hit retail harder than anyone else
Business-to-business companies always had a fallback. They could identify a company by IP address and call the front desk. B2C has no front desk. Your visitor is a person in a kitchen at 11pm comparing three brands of mattress, and the only thing you know about her is a session ID that expires in thirty minutes.
So when cookies died, B2C lost the connective tissue between “someone browsed” and “someone bought.” Attribution windows collapsed. Lookalike audiences got fuzzy. Email lists, which used to feel old-fashioned, suddenly became the most valuable asset in the building.
I’d argue that’s healthy. The old system encouraged laziness. You could run a campaign, let the platform tell you it worked, and never build a relationship with an actual human. Now you have to earn the identity, which means giving people a reason to hand it over.
What you’re actually collecting when you collect identity
First-party identity data is broader than most people assume. It isn’t just the email address someone types into a popup. It’s the whole trail of consented signals your own properties generate.
- On-site behavior: which product pages someone returns to, how long they linger on sizing charts, whether they abandon a cart at the payment step
- Declared data: emails, phone numbers, loyalty signups, quiz answers, wishlist shares
- Transactional history: past orders, return patterns, subscription pauses
- Channel signals: which email click or SMS link brought them back for a third visit
None of that requires guessing. All of it requires consent, which is exactly why it survives. The World Wide Web Consortium spent years documenting how browsers and standards bodies think about tracking and user privacy, and the direction of travel has been consistent the whole time: if a user didn’t agree to it, you shouldn’t be building a profile on it.
That constraint is a feature. Data you collected with permission doesn’t vanish when a browser vendor changes its mind.
How to build an identity stack without creeping people out
There’s a line I call the Creepy Line, and every retail marketer crosses it once before learning where it is. It sits between “this store remembers me” and “why does this store know what I said out loud.”
Here’s the practical version. Your job is to stay on the friendly side of that line while still collecting enough signal to be useful.
The test is simple. If you showed the customer the exact data you have on them and how you plan to use it, would they shrug or would they flinch? Shrug means keep going. Flinch means stop.
A few rules I’d follow:
- Ask early, ask once. A single well-placed email capture on a high-intent page beats five popups that fire on scroll. Value exchange, not ambush.
- Store less than you collect. If a data field never informs a decision, delete it. Unused data is liability, not leverage.
- Give the data back. Order tracking, size recommendations, restock alerts. When the customer benefits from being known, they stay known.
- Keep consent records clean. If you can’t show when and how someone agreed, you don’t really have permission.
The National Institute of Standards and Technology publishes voluntary frameworks on privacy and risk management that are worth reading even if nobody’s forcing you to adopt one. Doing the boring documentation work early saves you from being the case study later.
Where the population data says this market is heading
Step back and look at the demographics. According to the U.S. Census Bureau, younger adults now make up the majority of the buying public in the United States, and they’ve grown up with a completely different expectation about who gets their data. They’ll share it freely with a brand they trust. They’ll punish a brand that takes it.
That generational shift is why identity work has moved from a marketing line item to a board-level topic. It’s also why the teams that treat privacy as a product feature, not a compliance chore, are the ones seeing the least friction at checkout.
A tested exercise you can run this week
I’ve watched three different retail teams try to buy an identity platform before they were ready. All three failed the same way: they bought the tool, piped in anonymous sessions, and had no workflow to act on what came back. The tool wasn’t the problem. The missing process was.
So before you compare vendors, run this test.
- Pick one high-traffic page, ideally a category page with decent purchase intent.
- Write down the three things you’d want to know about an anonymous visitor there, and put them in priority order.
- Check whether your current stack can answer any of them. Most teams can answer exactly one.
- Design the follow-up action for each signal. If a known visitor returns to a product page twice, what happens? Be specific.
- Only now start looking at tools, and score them against that list instead of a feature grid.
If you can’t describe the follow-up action in one sentence, a new platform won’t save you. Identity data without a response is just a slightly more expensive dashboard.
What to do Monday morning
The cookie era taught a generation of marketers to outsource their customer knowledge. That trade is over. What’s left is slower, more deliberate work: earning consent, storing only what you’ll use, and building a response for every signal you collect. It’s less exciting than a retargeting list, and it’s the only thing that keeps working.
So here’s the question worth taking to your next team meeting. If every anonymous visitor on your site tomorrow had to be identified through trust alone, would your funnel hold up? If the answer is anything other than yes, you already know where the next quarter of work goes.
