Collecting B2B Leads: What Is Public Is Not Automatically Permitted
The short answer
Collecting a business contact from a public source is one thing; using it to email someone is another. You generally need a lawful basis, a notice saying where the data came from and how to object, and a working opt-out.
Most arguments about lead collection collapse two questions. Can you collect this? And may you use it to contact this person? A directory of company switchboard numbers is public; that does not make it a consent record. The distinction matters because the enforcement that reaches small senders is rarely an abstract privacy case: it is a complaint, a platform suspension, or a domain that stops delivering.
Public, permitted and lawful are three different words
Public means anyone could have seen it. Permitted means the platform or website allows you to take it and use it that way. Lawful means you have a basis under the rules that apply to the person whose data it is. A contact can be public, prohibited by the source and unlawful to use, all at once.
In practice the middle word is the one that catches people. A professional network's terms commonly prohibit scraping and automated collection; a directory may allow reading but not bulk extraction. Breaking those terms is a contract problem with the source, which is enforceable and usually resolved by losing access rather than going to court.
- Public: the information was visible to anyone.
- Permitted: the source allows you to collect and use it this way.
- Lawful: you have a documented basis for contacting the person.
The basis most B2B outreach relies on, and what it requires
For business contacts in many jurisdictions, the basis is a legitimate interest: you have a relevant reason to contact someone in their professional role, the message is pertinent to their job, and you have weighed their rights against your interest. It is not a free pass, and it comes with obligations that are easy to state and easy to skip.
The obligations are: tell the person where you got their data and what you are doing with it, give them a simple way to object, keep the data accurate and delete it when they ask, and keep a record of the assessment you made. If you cannot say where an address came from, you cannot meet the first one.
What a collection record needs to survive a question
For each source, write down what it is, when you collected from it, whether its terms permitted that, and what you told recipients afterwards. One paragraph per source is enough. The purpose is not bureaucracy: it is the difference between answering a data request in ten minutes and reconstructing a list from memory.
The record also changes behaviour while you build, because a source that cannot be described is usually a source you should not use. If the only description you can write is "a list someone sent me", that is your answer.
The opt-out that decides how this ends
One working opt-out, honoured immediately across every list, prevents most of the outcomes people fear. A complaint is what escalates; an unsubscribe is what closes the matter. The failure mode is a suppression list that lives in one person's spreadsheet, so an address removed from one campaign reappears in the next.
Make the suppression list central, apply it at the point of sending rather than at the point of import, and keep a record of when an objection arrived. That single piece of engineering prevents more harm than any wording in the email body.
Worked example: a list that could not be described
A recruiter buys 8,000 addresses described as "verified HR decision-makers in manufacturing". The list verifies cleanly, the campaign runs, and replies trickle in. Four months later a recipient asks where their data came from. The seller cannot say, the original file has no source column, and the recruiter cannot meet the first obligation of the basis they were relying on.
The resolution was not dramatic, which is the point: the addresses were deleted, the list was discarded, and the four months of work were written off. The lesson was that the useful question about a list is not "is it verified" but "can I describe where every row came from".
The replacement list was built from a manufacturing trade directory whose terms permitted export, with the source recorded per row, an opening line naming the directory, and a central suppression list. It was smaller, slower to build, and answerable.
Collection methods and the commitments they create
| Method | Typical permission issue | What you owe the recipient | Risk level |
|---|---|---|---|
| Manual research from company websites | Generally allowed to read | A notice of source and an opt-out | Low |
| A directory export | Terms may forbid bulk use | Source disclosure and an opt-out | Medium |
| Scraping a professional network | Usually against the platform terms | The same duties, plus a platform problem | High |
| A bought list | Nobody can tell you the origin | Duties you cannot meet, because the origin is unknown | Very high |
| An event attendee list | Depends on what attendees were told | Honour the purpose they were told about | Medium |
| Inbound enquiries | Clear context for contact | Answer their enquiry and nothing unrelated | Low |
| A referral | The referrer speaks for themselves, not the contact | Say who referred you, and expect a different reception | Low |
The pattern is not "public good, private bad". It is whether you can still describe the source and honour an objection a year later.
Before the first message goes out
- 1Every address traces to a source you can name, with a date.
- 2You checked whether the source's terms permit collection, and wrote the answer down.
- 3Your first message says how you found them, in one plain sentence.
- 4The message is about their professional role, not their personal circumstances.
- 5An opt-out is visible, works without a login, and is honoured the same day.
- 6Suppression is central and applied at send time, not at import time.
- 7There is a written path for "delete my data", with a named owner.
- 8You have a one-page note on why you have a legitimate interest, dated and kept.
- 9Sensitive categories, such as health or beliefs, are excluded from everything you collect.
- 10Someone has actually read the recorded sources in the last quarter and removed the ones nobody can describe.
Where this connects on this site
- The collection side of this is built into finding business contacts
- Once the list is lawful, clean it with remove dead addresses before sending
- For the policies that apply to this site itself, see the compliance pages on this site
What this will not do
- This page is not legal advice. Rules on business-to-business email, legitimate interest, notice and opt-out differ by country and change.
- A lawful basis does not override a platform's terms. Both can bind you at once, and breaching either has consequences.
- Verification removes dead addresses; it does not create permission, and a clean list of people who never agreed is still a problem.
- Collecting special-category data, or data about individuals acting outside a professional role, needs advice this page cannot give.
- Nothing here guarantees that a campaign will be compliant in your jurisdiction, and no checklist substitutes for a lawyer where the stakes are real.
Questions this page gets asked
- Is scraping a website for business emails legal?
- It depends on three separate things: the website's terms, the law where the person is, and whether you can meet the duties that follow. Scraping is often blocked by terms before it is addressed by law, and using the result to email people adds obligations about notice and objection.
- Do I need consent to email a business address?
- In many jurisdictions business-to-business email can rely on legitimate interest rather than prior consent, provided the message is relevant to the person's role and you offer a clear way to object. Some countries require consent for all electronic marketing, and corporate subscribers are treated differently from individuals, so the answer is jurisdiction-specific.
- What should a source notice say?
- One plain sentence naming where you found them and how to stop hearing from you. It does not need to be long, and it should be true. If you cannot name the source, you have a collection problem rather than a wording problem.
- How long can I keep a lead who never replied?
- Keep it only as long as you can justify the purpose, and delete or re-check on a schedule you have written down. A file of contacts nobody has contacted in three years is both a data protection liability and a deliverability risk.
Last reviewed 2026-10-26. Written for readers in the United States and elsewhere; rules about access, email and consent differ by country, and nothing on this page is legal advice.