Personalization for anonymous visitors: recognizing returning visitors without a login

Returning visitors are the ones who convert. They already know the brand, they are further along, and a familiar experience moves them faster. The problem is that most of your returning visitors are not logged in, so to your site they look brand new every time. You cannot tailor an experience for a visitor you cannot recognize, and the two things sites usually lean on to recognize a logged-out visitor, a login and a durable cookie, are exactly the two that are disappearing. The way to bring them back is to recognize the returning device: a durable identifier that holds even in incognito and after the cookies are cleared, so you can greet the visitor, resume where they left off, and skip what they have already done, with no sign-in.

Key takeaways

• Personalization for anonymous visitors means tailoring the experience for a logged-out returning visitor you can recognize by their device.
• Cookies and logins are the usual hooks, and both are fading: browsers cap or clear cookies quickly, and most visitors never sign in. That leaves returning visitors looking new.
• A durable device identifier fills the gap. It recognizes the same device on return, in incognito and after cleared cookies, because it is derived from the device rather than stored in a cookie.
• Once you can recognize a returning device, you can welcome it back, restore its cart and preferences, show relevant content, and stop re-prompting, all without a login.
• The same recognition is a signal your app consumes: you get a durable device identifier, and your product decides what to show.

What is personalization for anonymous visitors?

Personalization for anonymous visitors is tailoring what a returning visitor sees when they are not signed in, based on recognizing that their device has been to your site before. A logged-in user is easy: the account carries their history. An anonymous visitor carries nothing you can read directly, so the question is whether you can tell that this is a returning device at all. If you can, you can act on it, a returning-visitor greeting, the cart they left, the plan they were comparing, without asking them to log in first.

It is worth being precise about the goal, because a returning visitor is genuinely more valuable. Getting personalization right is estimated to lift revenue by 10 to 15 percent across a company's customer base, and a familiar, resumed experience is a large part of why. The catch is entirely in the recognition step: you cannot personalize for a visitor you see as a stranger on every visit, and for a logged-out visitor, recognition is the hard part.

Why cookies and logins fall short

The two hooks sites reach for to recognize a returning anonymous visitor are a stored cookie and a sign-in prompt, and both are eroding.

• Logins are rare on the visits that matter. Most browsing, the top of the funnel, the comparison, the second and third visit before a purchase, happens logged out. Gating personalization behind a sign-in means you only personalize after the visitor has already committed, which is the opposite of when it helps.
• Cookies expire fast now. Browser privacy protections cap how long a client-side cookie survives. Safari's Intelligent Tracking Prevention, for example, limits script-set cookies to seven days, and in some cases 24 hours. A visitor who returns after a week looks new, because the cookie that would have recognized them is already gone.
• Cookies are cleared and blocked. Incognito sessions, cleared storage, and cookie-blocking extensions all wipe the identifier a returning-visitor experience depends on.

The recent cookie news does not reopen this gap either. In April 2025, Google decided to keep third-party cookies in Chrome rather than remove them, but a returning-visitor experience never leaned on third-party cookies: it depends on the first-party cookie a site sets itself, which Safari and Firefox still cap and clear and which any visitor can wipe. So recognition for a logged-out visitor stays hard regardless of Chrome's decision.

The result is that a large share of your real returning visitors are counted, and treated, as new. The recognition layer that most personalization is built on has quietly stopped working for the logged-out visitor, which is most of them.

Recognizing the returning device

What survives when the cookie does not is the device. The browser and machine behind a visit expose a stable set of characteristics that, taken together, recognize the same device when it returns. Because that identifier is derived from the device itself rather than stored in a cookie, it keeps working in exactly the cases where a cookie fails: after the cookie is cleared, after the IP has rotated, and in incognito mode. It is durable on the scale that matters for a returning visitor, recognizing the same device across months rather than the days a cookie now lasts. That derived, durable device identifier is the hook a login and a cookie were supposed to be, and it is the same cookieless device identification mechanism applied to the job of recognizing a returning visitor you can finally act on.

To be accurate about what it recognizes, it recognizes a returning device. That is exactly what a returning-visitor experience needs, the machine that has your cart and your preferences is back, and it is enough to greet it and restore its state without a sign-in. Anything that genuinely needs to know the account holder, a payment, a subscription change, still sits behind a real login, where it belongs.

What you can personalize with a recognized device

Once you can tell that a device is back, a handful of high-value experiences open up that were impossible for an anonymous visitor before:

• Welcome them back. Swap the first-time hero for a returning-visitor message, surface recently viewed items, or pick up the page they left. Recognition alone makes a cold visit feel continuous.
• Restore state without an account. Bring back the cart, the comparison, the filters, or the progress through a flow, so a returning visitor does not start over. This is the persistent-cart case, and it directly recovers otherwise-lost sessions.
• Show relevant content sooner. Lead with the plan tier, the category, or the use case the device engaged with last time, or preset the region and currency they chose, instead of the generic homepage.
• Stop repeating yourself. Do not re-show the cookie banner, the newsletter popup, or the onboarding tour to a device that has already dismissed them. Removing friction for a known device is personalization too, and often the highest-return kind.
• Apply an offer once, cleanly. Assign a first-visit promotion to a device and recognize it on return, so the incentive lands with the right visitor. The same recognition that personalizes is what stops one person from claiming a one-per-customer offer many times, the promo-abuse side of the same signal.

None of these require a login. They require one thing: recognizing that this device has been here before, and reading that recognition as a signal your own product acts on.

The data you get back

Recognition is delivered to your backend as a scored identification event, keyed to the visit. The part that matters for personalization is the identifier set:

{
  "event_type": "identification.scored",
  "schema_version": "2026-06-01",
  "created_at": "2026-07-02T09:14:00Z",
  "data": {
    "request_id": "7a2e9c41-3b8d-4f60-a157-9e0c4d2b6f38",
    "visitor_id": "c1f4b9a6-2d73-4e85-b0a9-6f8c1e3d5a72",
    "device_id": "8d3a6e29-5c41-4b97-ae20-3f9b7c0d4e61",
    "cookie_id": "2b7f0d18-6a44-4c9e-9f21-70b5c8e2a3d1",
    "connection_type": "direct",
    "os": "macOS",
    "browser": "Safari",
    "device_type": "desktop"
  }
}

The durable key is device_id. Because it is derived from the device, it stays the same across cleared cookies, a rotated IP, and incognito, while cookie_id (and the visitor_id built on top of it) resets when the browser storage is wiped. So you store the cart, the preferences, and the last-viewed items against device_id, and on the next visit you look them up by the device_id that comes back. That is the whole integration: recognize the device, key your saved state to it, restore it on return.

We tested the two identifiers side by side across the cases that break a cookie: with the cookies wiped, the connection switched, and the browser in incognito, device_id kept matching the same returning device while cookie_id and the visitor_id built on it reset to new values. The cookie layer keeps getting shorter-lived and more isolated, from Safari's caps to Firefox turning on Total Cookie Protection by default in 2022, yet none of that touches the device the identifier is derived from, which is why a returning visitor stays recognizable while their cookie does not.

Personalizing for returning visitors with ShieldLabs

ShieldLabs gives your app the durable device signal that returning-visitor personalization needs. You add one JavaScript snippet, and each visit is identified and delivered to your backend with a persistent device_id that holds across cleared cookies, a rotated IP, and incognito, so a returning visitor is recognized as the same device and a genuinely new one stands out. You attach that identifier to whatever state you keep, the cart, the last-viewed items, the progress, and read it on the next visit to bring the experience back, with no sign-in step.

ShieldLabs recognizes the returning device and hands you the identifier; your own product decides what to greet, resume, or tailor, so the experience stays yours to design. Recognition is probabilistic, up to 99 percent rather than a guaranteed unique ID, and a deliberately privacy-hardened session can offer less to read, so personalization should degrade gracefully: a confident match earns the full returning-visitor treatment, a weak one is treated as a new visit. The same recognition layer powers anonymous visitor identification, the returning-user experience, and, on the abuse side, promo-abuse prevention. The free tier covers your first 5,000 identifications.

Sources

1. McKinsey & Company: The value of getting personalization right, or wrong, is multiplying (2021)
2. WebKit: Full Third-Party Cookie Blocking and More (Intelligent Tracking Prevention)
3. Google Privacy Sandbox: The next step for Privacy Sandbox (April 2025, keeping third-party cookies in Chrome)
4. Wikipedia: Device fingerprint