How B2B Contact Data Works: Where It Comes From and Why It Goes Wrong

By Laurel · Updated Oct 8, 2026

B2B contact data is the names, job titles, work emails and phone numbers that providers supply for sales prospecting. Providers assemble it from contributor networks, public web pages, registries, partner feeds and pattern-based guesses, then verify only part of it. People change jobs constantly, so some share of any list is already wrong when you buy it.

Most reps treat a purchased list as fact. It's closer to a pile of educated claims, each with a source, a date and a chance of being wrong. This guide covers where those claims come from, how fast they expire, what bad data does to your sending, and what to ask a vendor about privacy. It explains how the data works, not which vendor wins. Turning the data into tiered target accounts is in building a B2B prospect list.

Key Facts: B2B Contact Data

• The U.S. Bureau of Labor Statistics reports that 20.6% of wage and salary workers had a year or less with their current employer in January 2026, and median tenure was 4.1 years.
• ZeroBounce, an email verification vendor, reports that at least 23% of email lists decayed in 2025, down from 28% in 2024, from more than 11 billion addresses it verified (vendor data).
• Amazon SES advises bounce rates below 2% and may pause sending at 10%. Google tells senders to keep spam rates below 0.10%.
• The UK ICO fined Energy Prices Direct £160,000 in 2026 for over 700,000 unsolicited calls made on purchased data that hadn't been screened against the TPS and CTPS registers.

Where B2B Contact Data Comes From

No provider relies on a single source. A typical record is stitched together from several, and each source fails in its own way.

Contributor Networks

Users of a data product share contacts in exchange for free or discounted access. ZoomInfo describes more than 200,000 business professionals contributing through its free tier, and Lusha says its community members share email headers and signature blocks from their business email. Both are the vendors' own descriptions.

The appeal is freshness: a signature block is how someone describes themselves today. The weakness is who contributes, since networks lean toward the roles and regions where the tool is popular. And the contributor chose to take part while the people sitting in their inbox didn't, which is where most privacy questions start.

Web Scraping and Public Pages

Crawlers read company sites, press releases, filings, job postings and staff pages. ZoomInfo says its systems review public information on more than 28 million sites and domains each day, and Lusha says its algorithm scans publicly available sources. That works well for company facts and for people who publish their own details, but poorly for ordinary employees, who mostly don't.

Public doesn't mean free to collect. The French regulator CNIL fined Kaspr €240,000 for a Chrome extension that revealed the contact details of LinkedIn users, including people who had limited who could see them. It found no valid legal basis for collecting those details, and it criticized retention that reset to five years at every data update. In March 2026 the CNIL closed the order after Kaspr deleted its database and stopped collecting from LinkedIn.

Registries, Partner Feeds and Pattern Guessing

Registries. Company registers, filings and domain records confirm that a company exists and who is registered as a director. That's rarely the person who owns your problem. The CNIL noted that Kaspr's database drew on LinkedIn and other sources such as domain name registries.

Licensed feeds. Providers also buy from other providers. ZoomInfo lists data partners among its sources, and Lusha says it licenses information from partners who own established directories. You inherit the partner's freshness and consent practices, and you can't see either.

Pattern guessing. If three people at a company use first.last@company.com, a model can infer the fourth person's address. Lusha says its models generate email addresses from common corporate email patterns. That's cheap and covers a lot of ground. But a guess isn't a fact, and two people named John Smith can collide on one address.

Phone Numbers

Phone data comes from the same sources, with extra problems. A number might be a switchboard, a desk line or a personal mobile, and phone marketing is regulated separately from email in many countries (see the legal section below).

Data Source Types Compared

For vendor comparisons, see the ZoomInfo alternatives comparison and the Apollo alternatives comparison.

How Email Verification Works, and Where It Stops

A verifier runs a ladder of checks. It tests syntax, confirms the domain has mail servers, then asks the recipient's server whether it would accept mail for that address. The obvious tool, the SMTP VRFY command, is mostly out: RFC 5321 lets implementations disable it for security reasons. So verifiers typically open a session, name the recipient and watch the response without sending a message.

Three limits follow:

• Catch-all domains accept everything. A probe can't tell a real mailbox from an invented one. ZeroBounce reports catch-alls were over 9% of the addresses it checked.
• Some servers won't say. The same RFC provides a reply for addresses that appear valid but can't be verified in real time, so some results come back as unknown.
• A valid verdict is a snapshot. A mailbox can be deleted when the person leaves. It shows the address accepts mail, not that the right person holds the job.

Accuracy figures that vendors publish about their own data are self-reported, so ask for the sample, the date and how risky addresses were counted. The lead data enrichment guide covers where verification fits in an enrichment workflow.

How Fast B2B Contact Data Goes Stale

Contact data decays because people move, and companies rebrand, merge and change domains. The rate that matters is your own, but public statistics set the frame.

What Government Data Shows

The BLS Employee Tenure Summary reports that 20.6% of U.S. wage and salary workers had a year or less with their current employer in January 2026. Median tenure was 4.1 years, up from 3.9 in January 2024. It also varies by age: 3.0 years at ages 25 to 34 and 9.6 years at ages 55 to 64. So a list of early-career roles ages faster than a list of senior executives, and the overall rate shifts with the labor market.

The monthly JOLTS release shows the flow. In August 2026 the total separations rate was 3.2% (5.1 million people) and the quits rate was 1.9% (3.1 million). Each separation is a record that may now point at the wrong employer. These are U.S. figures, and job mobility differs by country and sector, so ask a vendor for decay data in the markets you sell to.

What Vendors Report

ZeroBounce reports that at least 23% of email lists decayed in 2025, down from 28% in 2024. That's the vendor's own data, from more than 11 billion addresses it verified for customers of all sizes, and it counts risky addresses alongside invalid ones. Read it as roughly a quarter of an unmaintained list a year on one vendor's customers. The drop from 28% to 23% shows the rate isn't a constant.

Fields Decay at Different Speeds

Person-level fields (title, employer, email, phone) change with every job move. Company-level fields such as domain, industry and headquarters country change more slowly. Judge a record by the last verified date of each field, not by one accuracy percentage. The lead data management guide covers the maintenance routines that keep a CRM from drifting.

What Stale Data Does to Your Sending

A bad address costs more than the wasted send. Mailbox providers read bounces as a sign of careless list building.

Amazon SES advises keeping bounce rates below 2%, and it reviews accounts at 5% or more and may pause sending at 10%. It also explains that spam traps can be addresses that were once valid but have sat unused and bouncing for a long time. That links decay to deliverability: an old list is where traps accumulate. Google tells bulk senders to keep spam rates below 0.10% and never reach 0.30%. Right address, wrong person doesn't bounce, but it can earn a complaint.

Here's an illustration, not a benchmark. Suppose a purchased list of 1,000 addresses contains 120 that no longer exist. Sent in one batch, that's a 12% bounce rate, six times the 2% guideline, before a single reply arrives. The cold email strategy framework covers the setup that protects your domain.

Test a Source Before You Scale It

1. Pull a random sample of 200 to 300 records, not the vendor's showcase rows.
2. Run the emails through an independent verifier and note valid, invalid and unknown separately.
3. Check titles and employers by hand on about 30 records.
4. Send a small test batch and record hard bounces.
5. Split results by field and country, compare them with the vendor's claim, and ask for credits where it falls short.

The Privacy and Legal Questions to Ask a Data Vendor

This is general information, not legal advice. The principle is simple: buying data doesn't transfer responsibility. Cold outreach laws explained covers CAN-SPAM, GDPR, PECR and CASL in more depth. The UK ICO says that for bought-in call lists the buyer remains responsible for complying with the rules and shouldn't use a list whose lawfulness is in doubt.

Lawful Basis and Notice

Under GDPR Article 14, when personal data comes from someone other than the person, they must be told within a reasonable period and at the latest within one month, or at first contact if that comes sooner. The notice must name the source. The ICO's guidance sets out the UK version. Business contacts are covered too: the ICO says the UK GDPR applies to named employees, while the email consent rule in PECR spares corporate subscribers but reaches sole traders and some partnerships.

Opt-Outs and Suppression

GDPR Article 21 gives people the right to object to direct marketing, and once they do, the data can no longer be processed for that purpose. The ICO calls this an absolute right with no exemptions. In the U.S., the FTC says CAN-SPAM requires honoring opt-outs within 10 business days, makes no exception for business-to-business email, and bars selling or transferring the addresses of people who opted out.

The practical gap: an opt-out given to the vendor doesn't reach a file you exported last month. California's DROP platform now requires data brokers to process deletion requests at least once every 45 days from August 1, 2026, though whether a given B2B vendor counts as a data broker is a question to ask. Keep your own suppression list so a person who objects stays suppressed after the next purchase.

Phone Numbers and Do-Not-Call Rules

In the UK, the ICO says bought-in lists must still be checked against the TPS or CTPS registers, that a registration can take 28 days to become active so a supplier's old check may be stale, and that a number in a public directory doesn't override a registration.

Singapore draws the line differently. The PDPC's advisory guidelines (revised February 2021) say a message sent to an organization for that organization's own purposes isn't a specified message, so the Do Not Call provisions don't apply. But a pitch aimed at the person's personal use loses that exclusion, and a Registry check stays valid for 21 days. A vendor's "business number" label doesn't settle which side a call falls on.

Regional Coverage

Ask which countries are covered, how deeply, and under which law each record was collected. Depth depends on where a vendor's contributors and public sources are, so test a sample of your own accounts in Singapore, Malaysia, the Philippines, Indonesia and Vietnam before assuming global coverage. Each has its own privacy regime, and a blanket "compliant" claim doesn't say which applied.

A Vendor Question Checklist

Putting It Together

Treat contact data as a perishable input: know its source, date its fields, sample it before you scale it, and keep your own suppression list. The cleanest records are the ones people gave you themselves, and capturing leads through your own forms and chat into one CRM, as Rework's Lead Ops and Sales Ops do, gives each record a known source and date. The rest is a set of claims you test, not facts you inherit. Contact data is one input to outbound lead generation and the outbound sales playbook, alongside signals such as intent data, and the BDR/SDR tech stack guide shows where it sits in a working stack. For enrichment-focused vendors, the Clearbit alternatives comparison is the place to start.