Is Intent Data Legal?

Yes, intent data can be used legally, including under GDPR and CCPA. Neither law bans it. What they require is that you have a lawful basis for any personal data you process, that you respect people's rights to object and opt out, and that you can explain where your data came from. Most third-party intent data is aggregated at the company level, which keeps much of it outside personal data rules, but not all of it.

This guide explains how the main privacy laws apply to intent data, where the real risks sit and what to ask your providers. It is general information, not legal advice. Talk to a qualified lawyer about your specific situation.

Company-level vs personal data

The first question is whether the data you use counts as personal data at all.

Most third-party intent data describes companies, not people. A signal that says "Company X shows increased research on cloud security" is about an organisation. In many cases, that keeps it outside the definition of personal data.

But the line is not always clean. Personal data can enter the picture in several ways:

• Collection: cookies, device identifiers and, in some jurisdictions, IP addresses can count as personal data at the point they are gathered.
• Contact data: once you attach a named person, email address or phone number to an account, you are processing personal data.
• Individual-level signals: some products claim to identify specific visitors or contacts showing intent. These carry more obligations.

So while company-level signals are relatively low risk, the way you combine them with contact data is where compliance matters most.

How GDPR applies

The EU's General Data Protection Regulation (GDPR), and the similar UK GDPR, apply when you process personal data of people in the EU or UK.

You need a lawful basis

Article 6 of the GDPR lists six lawful bases for processing personal data. For B2B outreach, the two most relevant are usually:

• Consent: the person has clearly agreed to the processing.
• Legitimate interests: the processing is necessary for your legitimate business interests and those interests are not overridden by the person's rights.

Many B2B teams rely on legitimate interests for prospecting. To do that properly, you should document a balancing test. The UK regulator, the ICO, publishes practical guidance on legitimate interests, including how to carry out a legitimate interests assessment.

Other GDPR duties

• Transparency: tell people how you got their data and how you use it, usually in your privacy notice and first contact.
• Right to object: people can object to direct marketing at any time, and you must stop.
• Data subject requests: you must handle requests to access or delete data.
• Electronic marketing rules: separate e-privacy rules in many countries govern marketing email and cookies, and can be stricter than GDPR.

How CCPA applies

The California Consumer Privacy Act (CCPA), as amended by the CPRA, gives California residents rights over their personal information, including business contacts. The California Attorney General's CCPA page sets out these rights, which include:

• The right to know what personal information is collected and how it is used
• The right to delete it
• The right to opt out of its sale or sharing
• The right to correct inaccurate information

If your intent data or enrichment involves selling or sharing personal information, you need to honour opt-out requests and explain your practices clearly. Several other US states have passed similar laws, so check which apply to your business.

Where providers fit in

Where personal data is involved at the point of collection, such as cookies or IP addresses, reputable providers rely on consent gathered by their publisher network and offer ways to handle data subject requests. You inherit some of the risk of your provider's practices, so it is worth checking them.

Questions to ask any intent data provider

• Is your data company-level, individual-level or both?
• Where does it come from, and how was consent or notice obtained?
• Which laws do you design for, such as GDPR, UK GDPR and CCPA?
• How do you handle access, deletion and opt-out requests?
• Do you use bidstream data, and if so, how is consent handled?
• Will you sign a data processing agreement?

If a vendor cannot tell you how their data was collected and consented, that is your answer. Our vendor evaluation guide covers other checks.

Practical steps to stay compliant

• Use company-level signals for prioritisation and only add personal data when you have a clear purpose.
• Document your lawful basis for prospecting, especially if you rely on legitimate interests.
• Update your privacy notice to explain how you source prospect data.
• Make opting out easy in every message, and honour it promptly across all your tools.
• Do not reveal tracking in outreach. Lead with a business reason, not the signal.
• Keep records of where each data source came from.

We cover the ethical side of this in What Are the Privacy Concerns With Intent Data? and practical opt-out options in How Do People Opt Out of Intent Data?

The bottom line

GDPR and CCPA do not ban intent data. They require that you have a lawful basis, respect opt-outs and can explain where your data came from. Teams that work with transparent providers, use company-level signals sensibly and treat prospects with respect can use intent data with confidence.

How BlueChimp approaches data

BlueChimp sources decision maker data only from first-party APIs, and CSV files you upload are parsed in your browser and never stored on our servers. You can read more on our Security and Privacy Policy pages, and California residents can manage their choices on our Privacy Choices page.

Key takeaways

• Intent data is legal under GDPR and CCPA when used properly.
• Most third-party intent is company-level, but personal data enters when you add contacts.
• Under GDPR, you need a lawful basis, often legitimate interests, and a documented assessment.
• Under CCPA, people can know, delete, correct and opt out of the sale or sharing of their data.
• Choose providers who can clearly explain their sources and consent model.