The complete guide to intent data and buying signals

Intent data is any record suggesting that a company, or a person at one, is researching something you sell. It ranges from your own pricing-page visits to topic research tracked across publisher sites you will never see. Vendors sell it as a way to call the right accounts at the right moment. Often it is a weekly list of company names with a score and no clear next step.

This guide is for sales leaders, RevOps, SDR managers (SDRs are the sales development reps who open new conversations) and founders deciding whether to buy intent data, and which kind. After reading it you should be able to tell the main data types apart, ask a vendor how its signals are sourced, understand the privacy rules that apply in the EU, UK and US, score and route signals into your CRM, and run a 60-day pilot that shows whether any of it changes pipeline. It is not for teams without a defined ICP (ideal customer profile, the description of the accounts you can win and serve) or without anyone to act on a signal. Buy those first.

This guide compares legal frameworks and regulator guidance. It is not legal advice; ask counsel about your own setup.

Summary

• First-party signals (your website, product and inbox) are the most accurate and the cheapest. Start there.
• Third-party intent comes from publisher co-ops, the ad bidstream or review sites. Each source sees a different slice of buyer behavior.
• Most intent data identifies companies, not people. Person-level website identification exists, is mostly US-only and carries the most legal risk.
• In the EU and UK, identifying visitors usually touches cookie and tracking consent rules as well as GDPR. In California, B2B contact data has been fully covered by the CCPA since 2023.
• Signals decay in days or weeks. A signal that waits for a weekly report is mostly wasted.
• Score a handful of signals, route them to a named owner with a deadline, and measure against a holdout group. Anything else measures activity, not lift.
• List prices are rarely published. Most providers in this guide quote custom annual contracts.

1. What intent data is, and where it comes from

The useful split is by who collects the data, because that decides accuracy, cost and legal exposure.

First-party, second-party and third-party

First-party intent is behavior you observe directly: visits to your site, demo requests, email replies, webinar attendance, and usage of your product. You own it, you know how it was collected, and you can usually tie it to a known contact.

Second-party intent is another company’s first-party data, sold or shared with you. The clearest example is a software review site reporting which companies looked at your profile, your pricing or your competitors. TrustRadius describes its review-site signals as second-party “downstream” intent, meaning research close to a purchase.¹1 Source: TrustRadius, “Downstream intent data”, accessed Oct 2026. TrustRadius is an HG Insights company.

Third-party intent is behavior observed across sites neither you nor the seller owns, aggregated by a data company. It tells you about accounts that have never visited you. It is also the least direct, because it infers interest from content consumption.

The main third-party sources

There are three broad collection methods, and vendors criticise each other’s.

• Publisher co-ops. A data company places a tag on member publishers’ sites and shares the aggregated activity back. Bombora runs the best-known co-op. It says it has a proprietary JavaScript tag on member sites, tracks more than 25,300 intent topics, and that 86% of co-op data is shared exclusively with it. It describes the data as consent-driven and says it does not use bidstream data.²2 Source: Bombora, “Our data”, accessed Oct 2026; and Bombora, “Bombora’s Company Surge intent data still works despite challenges like remote work and the cookieless future”, accessed Oct 2026. Claims about consent and exclusivity are the company’s own.
• The bidstream. When a page loads an ad, the ad exchange broadcasts a bid request that can include the page URL and an IP address. Some providers mine those requests for research activity. Demandbase says its intent draws on “direct access to the bidstream” and lists more than 950,000 keywords on its intent page.³3 Source: Demandbase, “Intent”, accessed Oct 2026. The same page also cites 865K+ keywords elsewhere; figures are vendor claims. Bombora, a competitor, calls bidstream data unconsented.² Both are vendor positions; read them as such.
• Review and comparison sites. G2 reports when a company views your profile, your pricing page, comparison pages or alternatives pages, and its intent feed also includes research on Capterra, Software Advice and GetApp.⁴4 Source: G2 Documentation, “Buyer Intent”, accessed Oct 2026.

Platforms combine sources: 6sense says it tracks keywords in more than 40 languages and integrates intent from Bombora, G2, TrustRadius and others.⁵5 Source: 6sense, “Intent data”, accessed Oct 2026. Language and coverage figures are vendor claims.

Website visitor identification

The fourth category sits on your own site but uses outside data. A script records each visit, and the provider matches the visitor’s IP address or other identifiers against its own database to name the company, or in some products the person. HubSpot’s documentation describes its version plainly: the tracking code collects activity and IP addresses, and buyer intent “connects anonymous web visitors to known companies’ IP addresses.”⁶6 Source: HubSpot Knowledge Base, “Use buyer intent”, accessed Oct 2026. RB2B sells person-level identification and states in its FAQ that contact-level identification is US only, while company-level identification is global.⁷7 Source: RB2B, “Pricing”, accessed Oct 2026. Coverage percentages are the vendor’s own figures.

Type	Who collects it	Typical unit	Strength	Main weakness
First-party engagement	You	Known contact or account	Accurate, free, consented in context	Only covers people already aware of you
Product usage	You	User and workspace	Strongest buying evidence for PLG products	Needs instrumentation and a data team
Publisher co-op	Data company with publisher tags	Account and topic	Broad, early research signal	Inferred from content reading; weekly cadence
Bidstream	Data company reading ad requests	Account and keyword	Very wide coverage	Consent and quality questions; noisy
Review site	The review site	Account and product	Close to purchase, names competitors	Only sees research on that site
Visitor identification	Vendor script on your site	Company, sometimes person	Covers your anonymous traffic	Probabilistic matching; highest privacy risk

2. The signal types that matter

Separate signals that show research from signals that show change at the account. They call for different responses.

Research signals

• Topic or keyword surges. An account reads more than usual about a subject. HubSpot, which offers Bombora’s Company Surge inside its CRM, describes it as detecting when a tracked company’s research activity spikes on topics you have configured, with up to 12 topics per account and a research level of High, Medium, Mild or Low.⁸
• Review-site activity. Profile views, pricing views, comparisons and competitor research. G2 assigns each company a buying stage (awareness, consideration or decision) and an activity level, updated daily.⁴
• Your own website visits. Repeat visits to pricing, integrations, security or case-study pages from an ICP account. This is the signal most teams underuse.

Change signals

• Hiring. Job postings for a role your product supports, or for the team that buys it. A company hiring its first RevOps lead is about to change its tooling. 6sense lists job postings among the data in its sales plans.⁹9 Source: 6sense, “Pricing”, accessed Oct 2026.
• Funding. New money usually means new headcount and new budgets. The signal is public and cheap, which means every competitor sees it too.
• Technology installs and removals. A company adding a tool that integrates with yours, or dropping a competitor, is a strong prompt. Treat it as partial: tools visible from outside a company are easier to detect than back-office software.
• Job changes. A champion who used your product at one company and moves to another is the warmest signal in B2B. It is also frequent: the median US wage and salary worker had been with their current employer 4.1 years as of January 2026, according to the Bureau of Labor Statistics.¹⁰10 Source: U.S. Bureau of Labor Statistics, “Employee Tenure in 2026”, released Sept 24, 2026, accessed Oct 2026. Common Room lists job-change tracking among its signal features.¹¹11 Source: Common Room, “Pricing”, accessed Oct 2026.

Product usage signals

For products with a free plan or trial, usage is the best intent data available: a workspace inviting its fifth colleague, hitting a plan limit, or connecting a production integration. It needs event tracking and a definition of a product-qualified account (PQA), but no vendor sells anything more predictive.

A practical ranking for most B2B teams: product usage and high-intent page visits first, review-site signals and champion job changes second, hiring and technology changes third, topic surges last. Topic surges are the earliest signal and the hardest to act on, which is why they make sense for advertising and account selection more than for an SDR’s call list.

3. Privacy and the law

Intent data involves personal data more often than buyers assume: IP addresses on the way in, named people on the way out. Here is how the main regimes treat it, as of October 2026.

EU: GDPR and the ePrivacy rules

GDPR applies to information about identifiable people, including people acting in a work role. It allows direct marketing on the basis of legitimate interests: Recital 47 says such processing “may be regarded as carried out for a legitimate interest.”¹²12 Source: GDPR Recital 47, Article 14 and Article 21, accessed Oct 2026. “May” is doing work there. Legitimate interest requires a documented balancing test, and it does not remove other duties. Article 14 requires you to tell a person whose data you obtained from someone else what you hold and where it came from, at the latest at your first communication with them. Article 21 gives them a right to object to direct marketing at any time, after which you must stop.¹² In practice, an SDR emailing a person identified by a visitor tool needs a compliant privacy notice and an opt-out that actually works.

The separate ePrivacy rule on storing or reading information on a device (Article 5(3) of the ePrivacy Directive, the “cookie rule”) decides whether you need consent before the tracking happens at all. The European Data Protection Board’s guidelines, adopted 7 October 2024, state that the rule covers tracking pixels and tracking links, not only cookies. They also address tracking based on IP addresses alone: unless an entity can ensure an IP address does not originate from the user’s device, it has to take all the steps Article 5(3) requires.¹³13 Source: European Data Protection Board, “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive”, version 2.0, sections 3.1 and 3.3, accessed Oct 2026. For visitor identification on EU traffic, that generally means the script runs only after consent, unless a specific exemption applies.

UK: UK GDPR and PECR

The ICO finalised its guidance on “storage and access technologies” on 29 April 2026. It covers cookies, tracking pixels, link decoration, fingerprinting and scripts, and sets out exceptions including strictly necessary and a new statistical-purposes exception added by the Data (Use and Access) Act 2025.¹⁴14 Source: ICO, “Guidance on the use of storage and access technologies”, accessed Oct 2026. Identifying visiting companies for sales outreach is not an obvious fit for a statistics exception; treat that as a question for counsel, not a loophole.

For outreach itself, the UK rules are friendlier to B2B than many assume. The ICO says the PECR consent rule for marketing email does not apply to corporate subscribers (limited companies, LLPs and similar), though you must identify yourself and give a valid opt-out. Sole traders and some partnerships are treated as individuals and need consent. The ICO also notes that a business contact’s name is still personal data under UK GDPR.¹⁵15 Source: ICO, “Business-to-business marketing”, accessed Oct 2026.

United States: state privacy laws

There is no general federal privacy law covering this. The states differ on the point that matters most for B2B. California’s attorney general confirms that the CCPA’s exemptions for employment data and for personal information reflecting business-to-business transactions expired on December 31, 2022.¹⁶16 Source: State of California Department of Justice, “California Consumer Privacy Act (CCPA)”, FAQ A.2, A.11 and B.8, accessed Oct 2026. Business contacts in California therefore have the same rights as any consumer, including opting out of the sale or sharing of their data, and a browser opt-out signal such as Global Privacy Control must be honored as a valid request.¹⁶ Virginia, by contrast, defines a consumer as acting in an individual or household context and excludes people “acting in a commercial or employment context.”¹⁷17 Source: Code of Virginia, § 59.1-575 Definitions, accessed Oct 2026. Check each state’s definition rather than assuming California’s rule applies everywhere.

California also regulates data brokers, companies that sell personal information about consumers they have no direct relationship with. Since August 1, 2026, registered brokers must check the state’s Delete Request and Opt-Out Platform (DROP) at least every 45 days and process the deletion requests it contains.¹⁸18 Source: California Privacy Protection Agency, “Delete Request and Opt-Out Platform (DROP)”, accessed Oct 2026. Ask any intent or contact-data vendor whether it is registered and how DROP deletions flow through to the records you already bought.

4. How accurate intent data is

None of the providers in this guide publishes an independent, audited accuracy rate. What you can do is understand where errors come from.

Matching is probabilistic

IP-to-company matching works well for visitors on an office network with a registered IP range. It works poorly for remote workers on home broadband, mobile carriers, VPNs and privacy relays. The EDPB notes that carrier-grade NAT (CGNAT) groups many subscribers under one public IP address.¹³ Apple’s iCloud Private Relay replaces a user’s IP address with a temporary one for the sites they visit.¹⁹19 Source: Apple Support, “About iCloud Private Relay”, accessed Oct 2026. Each of these turns a visit into either no match or the wrong match.

Vendors’ own figures show the ceiling. RB2B’s pricing page states coverage of 15–20% on its lower plans and 35–45% on its top plan.⁷ On the vendor’s own numbers, most traffic stays anonymous even on the best tier.

Surges are relative, and topics are fuzzy

A topic surge compares an account’s current reading with its own history. A small company reading three articles can surge; a large one reading hundreds might not. Topics are also broad: “data security” research could come from a buyer, a student or a competitor. Surges work best as a filter on an ICP list, badly as a trigger for a call.

Coverage depends on where your buyers read

A co-op sees only member sites. A review-site feed sees only that site’s visitors, and G2 warns that some products may see higher volume because its feed now includes Capterra, Software Advice and GetApp research.⁴ Non-English and niche markets are thinner everywhere. 6sense’s claim of 40-plus languages is a vendor claim worth testing on your own territories.⁵

Signals decay

A pricing-page visit is relevant for days. A funding round is relevant for a few months. A champion’s job change is relevant until they have chosen their stack. Build expiry into scoring (chapter 6) or old signals will crowd out new ones.

5. Providers by category and how they price

The table below names providers neutrally by category, with pricing as their official pages state it as of October 2026. “Not published” means the page offers a sales conversation, not a number. All prices are list prices.

20 Source: Demandbase, “Pricing”, accessed Oct 2026. 21 Source: ZoomInfo, “Pricing”, accessed Oct 2026. 22 Source: HubSpot, “HubSpot Credits”, accessed Oct 2026. Credit costs per intent action are not listed on this page.

Provider	Category	What it sells, per its own pages	Pricing model as published
Bombora	Publisher co-op	Company Surge topic intent from a tagged publisher co-op, 25,300+ topics2	Not published; also resold inside other platforms
6sense	ABM and intent platform	Keyword intent, partner intent feeds, web visitor identification, job postings59	Three plan bundles, no prices published9
Demandbase	ABM and intent platform	Bidstream-sourced keyword intent; can import Bombora Surge3	Platform fee plus per-user fee, quoted on request20
ZoomInfo	Contact data plus signals	Intent, website visitor and “Live Signals” across use-case packages21	Custom packages; API priced on usage21
G2 Buyer Intent	Review-site intent	Profile, pricing, compare, alternatives and competitor signals4	Per product subscription; plan sets signal types4
TrustRadius	Review-site intent	Second-party “downstream” intent from buyers researching products1	Not published
HubSpot (owner of Clearbit)	CRM-native intent and visitor ID	Company-level visitor intent, research intent, Bombora Company Surge68	HubSpot Credits at $10 per 1,000; adding and tracking companies uses credits622
RB2B	Person-level visitor ID	Company ID globally, person ID for US visitors only7	Free; Starter $79/mo; Pro from $149/mo; Pro+ from $199/mo7
Common Room	Signal aggregation	Website deanonymization, Bombora topics, job changes, community and product signals11	Essential $2,500/mo billed annually; higher tiers custom11

A few notes the table cannot hold.

Bundles hide the unit price. Common Room’s Essential plan includes six Bombora Company Surge topics and 1,000 website deanonymizations a month.¹¹ HubSpot charges credits when you add an identified company to the CRM and then monthly while you track it, and its credits expire at the end of each month.⁶²² Ask every vendor for the price of one tracked account for one month. It is the only unit that compares across them.

HubSpot and Clearbit. HubSpot completed its acquisition of Clearbit on December 4, 2023,²³23 Source: HubSpot, “HubSpot completes acquisition of B2B intelligence leader Clearbit”, accessed Oct 2026; and HubSpot, “Clearbit”, accessed Oct 2026. and its Clearbit page describes enrichment, company-reveal and form-shortening features being integrated into the HubSpot platform.²³ If you are not on HubSpot, that changes the evaluation.

Vendor risk is real. Koala, a visitor-identification and intent product, states on its own pricing page that it is shutting down following its acquisition by Cursor.²⁴24 Source: Koala, “Pricing”, accessed Oct 2026. The page states the service is shutting down following the company’s acquisition by Cursor. Keep signal logic in your CRM, not only inside a vendor’s interface, so a provider can be swapped without rebuilding your process.

What it is not for. If deals are small and close in one call, an annual ABM platform contract will not pay for itself. Start with first-party signals.

6. How to score and route signals into CRM and outreach

The plumbing matters more than the model. A simple score that reaches an owner within a day beats a clever one that sits in a dashboard.

Step 1: Filter by fit before intent

Score fit first: industry, size, region, technology, and whether the account is already a customer or in an open deal. Intent on a poor-fit account is noise.

Step 2: Weight a short list of signals

Pick five to eight signals and assign points. A workable starting point, to be tuned against your own wins:

Signal	Suggested weight	Expires after
Demo or pricing request (first-party)	Route immediately, no score needed	n/a
Product usage threshold (PQA)	High	14 days
Repeat visits to pricing or security pages	High	7 days
Review-site comparison or pricing view	Medium-high	21 days
Champion job change into an ICP account	Medium-high	90 days
Relevant hiring or new funding	Medium	60 days
Topic surge on 2+ of your topics	Low-medium	21 days

These weights are editorial guidance, not benchmarks. The expiry column matters as much as the weights.

Step 3: Write signals to the CRM as data, not alerts

Store each signal as a dated record or timestamped field on the account: source, type, date, score contribution. Signals arrive keyed to company domains, and G2’s documentation notes that domain filters must exactly match the domain on a signal,⁴ so your accounts need clean domains first. If they do not, fix that with enrichment before buying intent. The best email enrichment tools in 2026 covers how to test that layer.

Step 4: Route to one named owner with a deadline

Every account that crosses the threshold goes to one owner with a service level, for example two business days for first touch. The CRM task is the record; chat alerts are a nudge. Accounts in an active deal go to the deal owner as context, not to an SDR as a new lead.

Step 5: Turn the signal into a reason to talk, carefully

Use the signal to choose who, when and what topic. Do not quote it back: “I saw you on our pricing page on Tuesday” tells a buyer they were tracked and invites the Article 21 objection from chapter 3. Send outreach that would make sense even if the signal were wrong. The complete guide to outbound in 2026 covers sequences, deliverability and messaging.

7. Measuring lift, and a 60-day pilot

Intent vendors report “influenced pipeline”: pipeline from accounts that showed a signal. That number is always large, because good accounts research a lot. It does not tell you whether the signal changed anything. Lift does.

How to measure lift

Lift is the difference in outcome between accounts that received signal-driven treatment and comparable accounts that did not. The clean way to get it is a holdout:

1. Take the accounts that crossed your signal threshold in a given week.
2. Randomly assign a portion, say a fifth, to a holdout that gets your normal motion and no signal-driven outreach.
3. Compare meetings booked, opportunities created and pipeline value per account between the two groups after 30, 60 and 90 days.

Measure per account, and check that the groups look alike on size and segment. If you cannot hold accounts out, compare signal-triggered outreach with standard outreach to similar ICP accounts in the same period, and treat the result as weaker evidence.

The 60-day pilot plan

Before day 0. Write the question down: “Does signal X, routed within two days, raise the meeting rate on ICP accounts?” Pick one or two sources. Confirm with counsel which regions the pilot can cover. Clean account domains.

Days 1–10: backtest and set up. Backtest the vendor’s historical data against your last 12 months of wins and losses. Set the threshold and expiry windows. Build the CRM fields, routing rule and holdout flag. Brief reps on what not to say.

Days 11–45: run. Route every threshold account within the agreed service level. Track, weekly: signals received, share passing the fit filter, share actioned within the SLA, meetings booked per account for treated and holdout groups. Drop signals that produce only noise by week three.

Days 46–60: read out. Compare treated and holdout groups. Calculate cost per meeting and cost per opportunity including the data, the tooling and the rep time. Decide one of three things: expand, keep only the signals that showed lift, or stop. Sixty days will not show closed revenue for most B2B sales cycles, so judge on meetings and qualified opportunities, then confirm with revenue at 6 to 9 months.

Negotiate the pilot before the contract: ask for a paid pilot or an exit clause tied to agreed metrics. The complete guide to building a B2B revenue stack covers how this layer fits with the CRM, enrichment and engagement tools around it.

8. Mistakes that waste intent budgets

Buying third-party data before using first-party data. If nobody calls the ICP account that viewed pricing three times this week, a surge report will not help.

Too many signals, no owner. Ten feeds into one dashboard produce a list everyone checks and nobody owns.

Treating surges as hand-raises. A topic surge is a reason to prioritize an account for ads or research. It is not evidence that a person wants a call.

Ignoring consent on EU and UK traffic. Running a visitor-identification script before consent on European traffic conflicts with how the EDPB reads the cookie rule.¹³ Geofence the script or put it behind your consent banner.

Assuming B2B is exempt everywhere in the US. It is not in California.¹⁶ Honor opt-outs and Global Privacy Control signals, and ask vendors about DROP.

Measuring influenced pipeline, with no expiry. Influenced pipeline flatters every vendor, and a signal from February should not drive a call in October. Use a holdout and expiry windows.

Locking logic inside the vendor. If scoring lives only in a vendor’s interface, a price rise or a shutdown takes your process with it.²⁴

9. The verdict

Intent data is worth buying when you already act fast on your own first-party signals, have a clear ICP, and have reps with capacity to follow up within days. In that setting, one well-chosen external source, usually review-site intent for software sellers or a co-op topic feed for account selection, can sharpen who gets attention this week. Without those conditions it becomes an expensive dashboard. Person-level visitor identification is the narrowest fit: RB2B, for example, limits it to US visitors,⁷ and it needs a privacy notice and opt-out process you trust.

Frequently asked questions

What is the difference between intent data and buying signals?

Intent data usually means research behavior: topics read, review pages viewed, site visits. Buying signals is broader and adds changes at the account, such as hiring, funding, technology changes and job moves.

Is website visitor identification legal?

It depends on where the visitor is and what you identify. In the EU, the EDPB says IP-based tracking can fall under the ePrivacy cookie rule unless you can show the address does not come from the user’s device, which usually means consent first.¹³ In the US, California gives business contacts consumer privacy rights while states such as Virginia exclude people acting in a work capacity.¹⁶¹⁷ Ask counsel to review your specific setup.

Is third-party intent data accurate?

It is directionally useful and individually unreliable. Matching depends on IP addresses that remote work, CGNAT and privacy relays obscure, and topic surges infer interest from reading.¹³¹⁹ Test any feed against your own past wins and losses before trusting it.

How much does intent data cost?

Most ABM and intent platforms do not publish prices and quote annual contracts. Published examples as of October 2026 include RB2B from free to $199 a month and up, Common Room’s Essential plan at $2,500 a month billed annually, and HubSpot credits at $10 per 1,000.⁷¹¹²² Compare on cost per tracked account per month.

Should SDRs mention the signal in their outreach?

No. Use the signal to decide who to contact and what topic to raise, then write a message that stands on its own. Referencing someone’s page views tells them they were tracked and invites an objection to further marketing.¹²

Do we need intent data if we have product usage data?

Product usage is the stronger signal for anyone with a free plan or trial. External intent then mostly helps you find accounts that have not signed up yet. Get usage-based routing working first.

Sources and notes

1. Source: TrustRadius, “Downstream intent data”, accessed Oct 2026. TrustRadius is an HG Insights company. ↩ ↩²

2. Source: Bombora, “Our data”, accessed Oct 2026; and Bombora, “Bombora’s Company Surge intent data still works despite challenges like remote work and the cookieless future”, accessed Oct 2026. Claims about consent and exclusivity are the company’s own. ↩ ↩² ↩³

3. Source: Demandbase, “Intent”, accessed Oct 2026. The same page also cites 865K+ keywords elsewhere; figures are vendor claims. ↩ ↩²

4. Source: G2 Documentation, “Buyer Intent”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

5. Source: 6sense, “Intent data”, accessed Oct 2026. Language and coverage figures are vendor claims. ↩ ↩² ↩³

6. Source: HubSpot Knowledge Base, “Use buyer intent”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

7. Source: RB2B, “Pricing”, accessed Oct 2026. Coverage percentages are the vendor’s own figures. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

8. Source: HubSpot Knowledge Base, “Use Company Surge signals, powered by Bombora”, accessed Oct 2026. ↩ ↩² ↩³

9. Source: 6sense, “Pricing”, accessed Oct 2026. ↩ ↩² ↩³

10. Source: U.S. Bureau of Labor Statistics, “Employee Tenure in 2026”, released Sept 24, 2026, accessed Oct 2026. ↩

11. Source: Common Room, “Pricing”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

12. Source: GDPR Recital 47, Article 14 and Article 21, accessed Oct 2026. ↩ ↩² ↩³

13. Source: European Data Protection Board, “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive”, version 2.0, sections 3.1 and 3.3, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

14. Source: ICO, “Guidance on the use of storage and access technologies”, accessed Oct 2026. ↩

15. Source: ICO, “Business-to-business marketing”, accessed Oct 2026. ↩

16. Source: State of California Department of Justice, “California Consumer Privacy Act (CCPA)”, FAQ A.2, A.11 and B.8, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

17. Source: Code of Virginia, § 59.1-575 Definitions, accessed Oct 2026. ↩ ↩²

18. Source: California Privacy Protection Agency, “Delete Request and Opt-Out Platform (DROP)”, accessed Oct 2026. ↩

19. Source: Apple Support, “About iCloud Private Relay”, accessed Oct 2026. ↩ ↩²

20. Source: Demandbase, “Pricing”, accessed Oct 2026. ↩

21. Source: ZoomInfo, “Pricing”, accessed Oct 2026. ↩ ↩²

22. Source: HubSpot, “HubSpot Credits”, accessed Oct 2026. Credit costs per intent action are not listed on this page. ↩ ↩² ↩³

23. Source: HubSpot, “HubSpot completes acquisition of B2B intelligence leader Clearbit”, accessed Oct 2026; and HubSpot, “Clearbit”, accessed Oct 2026. ↩ ↩²

24. Source: Koala, “Pricing”, accessed Oct 2026. The page states the service is shutting down following the company’s acquisition by Cursor. ↩ ↩²