Returning Visitor Recognition: What to Remember and What to Forget
Remember what they bought and what size they wear. Forget the trail of pages that followed them here.
Recognizing a returning visitor is the cheapest personalization you can do, and the easiest to get wrong. Remember what they bought, what size they wear, and what they looked at last time. Forget the session data that followed them around the internet. The line between the two is consent, and the technical limit is that browsers now cap the cookies you use to remember.
What to remember, and why it is cheap
The most valuable thing to remember about a returning visitor is boring: what they bought, what size they wear, and what they looked at last time. That data lives in your own store, it costs nothing to keep, and it powers the personalizations shoppers actually like: the right size preselected, the reorder button on the homepage, the recently viewed rail that shows what they were looking at yesterday.
The reason it works is that shoppers expect it. They gave you their email, they bought from you, and they assume you remember. A store that forgets a returning customer feels broken in a way a store that never knew them does not. Recognition is the baseline now, not a feature.
What to forget, and why it matters more
The data to forget is the trail: the pages they visited on other sites, the ads they clicked elsewhere, the inferences bought from a broker. That data was never yours, and using it is what makes personalization feel creepy. A shopper who sees an ad for a product they looked at on another site does not think the store is smart. They think the store is watching them.
The test is simple. If the shopper would be surprised to learn you know it, do not use it. First-party data from your own store passes the test. Third-party data and cross-site tracking do not. The stores that get personalization right are the ones that treat the shopper's data as borrowed, not owned.
The technical limit: browsers cap your memory
The practical problem is that browsers now limit how long you can remember. Safari caps client-side first-party cookies at seven days, and at 24 hours for cookies set by known trackers. A shopper who returns after a month looks brand new unless you stored the identifier somewhere that survives the cap.
The fix is to store the identifier server-side, tied to an account or an email address the shopper gives you. A logged-in customer is recognized forever, because the recognition lives in your database, not in their browser. An anonymous visitor is recognized for a week, and that is the honest limit of what a cookie can do now.
Consent is the gate, not the paperwork
Every personalization should start with a consent gate, and the gate should be a real choice. A shopper who creates an account is opting in to recognition. A shopper who checks out as a guest is not, and the store should remember the order, not the person, until they say otherwise.
The stores that do this well ask once, clearly, and then stop asking. A banner that explains what you will remember and why, with a button that says yes, earns more trust than a wall of legal text nobody reads. Consent is not a compliance chore. It is the moment the shopper agrees to be recognized, and that agreement is what makes the personalization feel like service instead of surveillance.
Keep reading
Related guides on this site: personalizing for shoppers with no history the personalization flicker and when the page changes after the shopper sees it weather-based personalization and when the forecast changes what you show More from AI personalization for e-commerce.
Frequently asked questions
What should a store remember about a returning visitor?
What they bought, what size they wear, and what they looked at on your site. That is first-party data from your own store, and it is the data shoppers expect you to remember.
What should a store forget?
The browsing they did on other sites, the ads they clicked elsewhere, and anything you bought from a data broker. That data was never yours to use, and using it is what makes personalization feel creepy.
How do you recognize a returning visitor without third-party cookies?
A persistent first-party identifier, stored server-side, tied to an account or an email when the shopper gives it. Client-side cookies alone are no longer reliable, because Safari and other browsers cap them.
Why does Safari make this hard?
Safari caps client-side first-party cookies at seven days, and at 24 hours for cookies set by trackers. That means a shopper who returns after a month looks new unless you stored the identifier server-side.