B2B marketing without intent data

“It’s B2B, so it’s not personal data”

This is the most common thing we hear from B2B applicants, and it is mostly wrong. A buyer at a company is a person. Their name, work email, job title and the fact that they read your pricing page on Tuesday are about them.

The UK regulator says the same. The ICO’s guidance on business-to-business marketing is clear that if you hold the name of someone who represents a business, UK GDPR applies, and that an address like a named work email is personal data. It also notes that sole traders and some partnerships count as “individual subscribers” under the electronic marketing rules (PECR), and are treated like members of the public. (The ICO says this guidance is under review after the Data (Use and Access) Act 2025.)

That last point matters for tools that identify “companies”. Government estimates put 75% of UK private sector businesses at the start of 2025 as having no employees: in most cases, the owner is the business. When a tool tells you “Smith Plumbing visited your site”, it has often told you that Mr Smith did.

This is general information, not legal advice. And as elsewhere in the Standard, the law is the floor, not the bar.

What is out, and why

• The LinkedIn Insight Tag. LinkedIn describes it as matching website visitors to LinkedIn member accounts for conversion tracking, retargeting and visitor demographics. That is an ad pixel (ruling R-003), whatever the audience.
• Contact list uploads. Uploading emails or names to LinkedIn, or any ad platform, to target or exclude them. Hashing doesn’t change this (rulings R-002 and R-005).
• Contact enrichment. Tools that fill in a person’s job title, phone number, company and social profiles from a bought database. Clearbit, acquired by HubSpot in December 2023 and now offered as Breeze Intelligence, ZoomInfo and Apollo are well-known examples. Buying or enriching data about people is out (clause NFS-1.6).
• Bought intent data. Feeds that tell you which companies are “researching” your topic. Bombora, for example, says its data comes from a co-op of “thousands of media destinations” with a tag on every site in the co-op. G2’s buyer intent reports which organisations viewed your profile, your category or comparisons with competitors. In both cases you are buying other sites’ observations of their visitors.
• Reverse-IP visitor identification. Tools that match the IP addresses of your own visitors to company names. HubSpot’s help centre, for instance, says its buyer intent feature “connects anonymous web visitors to known companies’ IP addresses” through its tracking code. This sends your visitors’ data to a third party to be looked up against its database, and for small firms the answer is often a person.

All of these sit under ruling R-021. Agencies running campaigns for you are covered too: if they install it, you are responsible (clause NFS-1.7).

The regulatory picture

Regulators have taken action against firms in this business, with mixed results.

In December 2024 the CNIL, France’s regulator, fined KASPR €240,000. KASPR ran a browser extension that collected contact details from LinkedIn profiles, including from people who had limited who could see them, and built a database the CNIL put at about 160 million contacts, sold for prospecting and recruitment. The CNIL found problems with the legal basis, a five-year retention period, late and English-only notice to the people concerned, and the handling of access requests.

The ICO’s own case against credit reference agencies went the other way. Its October 2020 enforcement notice against Experian’s marketing business was largely overturned by the First-tier Tribunal in February 2023, the Upper Tribunal dismissed the ICO’s appeal in April 2024, and the ICO decided not to appeal further.

So we won’t claim enrichment is always unlawful. Our point is simpler: these tools depend on people not knowing what is collected about them, and that is the thing the Standard exists to stop.

Pending: company-name lists

LinkedIn also lets advertisers upload a list of companies, by name or website, to target their employees with ads. This is the backbone of a lot of account-based marketing.

A list of company names is not obviously personal data. But a list of “companies we are talking to” can be, where the company is a sole trader or a small partnership, and uploading your pipeline tells the platform who your prospects and customers are. We have not ruled on this yet. Until we do, we ask applicants to list any company-list uploads on their data map so reviewers can see them. Uploaded lists that contain people’s names or emails are out now.

What works instead

• LinkedIn ads on LinkedIn’s own targeting. Job title, function, seniority, industry, company size, skills, location. LinkedIn holds that data about its own members; you pick the criteria and feed nothing back. Measure results on your side, not with the Insight Tag.
• Content and search. Write the pages your buyers look for: pricing, comparisons, integration guides, answers to the questions your sales team hears every week. Search and contextual ads on your topic are fine.
• Events. Talks, meetups, webinars, trade stands. People who register give you their details directly and know they have.
• Partners and referrals. Integration partners, consultants, resellers and happy customers. Agree what you share with partners and put it on your data map.
• Ask how people found you. A free-text “How did you hear about us?” on demo and trial forms tells you things no attribution tool can, like the podcast or the colleague who recommended you.
• Account-based marketing built by people. Pick target companies from public, company-level research: annual reports, job adverts, press, industry directories. Then reach them through content, events, introductions and platform-targeted ads. It is slower than a feed, and usually better informed.
• First-party, cookieless analytics. Count visits to your pricing page and sign-ups by campaign (clause NFS-2.1). Don’t add a layer that turns visits into company names; that is reverse-IP by another route.
• Your CRM, used for people who contacted you. Contacts who asked for a demo, bought or signed up are yours to work with, in a CRM acting as your processor, with enrichment and intent add-ons switched off.

The cost

We won’t pretend this is a small change for most B2B software companies. A typical stack has the Insight Tag, a contact list sync, an enrichment tool in the CRM, an intent feed for the sales team and a visitor-identification script. Joining usually means removing several of those, and some reports your sales team relies on will go blank.

What you get back is a pipeline built on people who chose to talk to you, and a clear, published answer when a buyer’s security or procurement team asks where their staff’s data goes.

If you are unsure where a tool sits, the self-check covers B2B tools, and “Where data goes” has five questions to put to any vendor.