How B2B Data Is Collected: Sources, Methods, and Accuracy

TL;DR

• B2B data comes from four collection methods: public web crawling, contributory networks (users donating their contacts), licensed/purchased files, and first-party signals you capture yourself.
• No vendor uses only one. Every credible provider blends sources, then runs a verification layer (MX, SMTP, pattern confidence) before the record reaches you.
• Accuracy is a function of recency, not volume. A 700M-record database refreshed annually is worse than a 50M-record database refreshed on request.
• Contributory data has the best coverage on mobile numbers and the worst compliance story in the EU. Crawled + verified data has the cleanest audit trail.
• Ask any vendor three questions before you pay: where the record came from, when it was last checked, and what happens when it bounces.

What does "collecting B2B data" actually mean?#

Think of a B2B contact record like a used car. Two identical-looking sedans can have completely different histories: one had a single owner and full service records, the other was rebuilt from three write-offs. The spec sheet looks the same. The reliability does not.

B2B data works the same way. Two rows in a CSV can both read sarah.chen@acme.com — VP Marketing — Acme Corp, but one was pulled from Acme's own team page last week and SMTP-checked this morning, while the other was inferred from a 2022 conference attendee list and never validated. Same shape, completely different value.

So when a vendor says "we have 400 million contacts," the number tells you almost nothing. What matters is the collection chain: where the raw signal came from, how the identity was assembled, when it was last confirmed, and whether the vendor can tell you any of that.

Where does B2B data actually come from?#

There are four primary collection methods, and every commercial database is a blend of them.

1. Public web crawling. Bots continuously index company websites, team pages, press releases, job boards, GitHub profiles, conference speaker lists, podcast show notes, and news articles. This is the backbone of domain-level data: employee names, titles, email patterns, tech stack, headcount signals, funding events. It is also the most defensible source legally, because nothing is gated. Web scraping at this scale is a crawl-parse-normalize pipeline, not a one-off script.

2. Contributory networks. A user installs a browser extension or connects their mailbox, and in exchange for free credits the tool reads their address book or their email metadata. Those contacts get folded into the shared pool. This is how vendors get direct dials and personal mobile numbers that never appear on a website. It's also the source most likely to trigger a GDPR complaint, because the data subject never interacted with the vendor.

3. Licensed and purchased files. Vendors buy datasets from data brokers, event organizers, trade publications, business registries, and other tools. Quality varies wildly. Some purchased files are excellent — regulated business registries, for example, are authoritative on legal entity data. Others are recycled lists that have been resold six times. Reputable list sellers such as BookYourData sit at the better end of this spectrum by verifying at the point of purchase rather than at the point of collection.

4. Public records and filings. Company registries, SEC filings, trademark databases, patent offices, government contract awards, and domain WHOIS records. Slow-moving but highly reliable for firmographics: legal name, incorporation date, registered address, officers, ownership structure.

5. Pattern inference. Once a crawler sees first.last@acme.com on three confirmed Acme addresses, it can generate candidates for every other known Acme employee. The generated address is a hypothesis, not a fact — which is why inference must always be followed by verification. This is the mechanism behind any email finder that returns a result for a person whose address was never published anywhere.

6. First-party capture. Form fills, website visitor reveal, CRM history, support tickets, product telemetry. This is the only data you fully own, and it is almost always your highest-converting segment. It's also the smallest.

How does a raw signal become a contact record?#

Collection is step one. The pipeline between "a bot saw a name on a page" and "a row appears in your export" has four more stages, and most of the quality difference between vendors lives here.

Stage 1 — Extraction. Parse the page. Pull out names, titles, phone strings, email strings, company references, dates. Handle the messy cases: a name rendered as an image, a title in a PDF, an obfuscated address like sarah [at] acme [dot] com.

Stage 2 — Entity resolution. Decide that "S. Chen, VP Mktg, Acme" on one page and "Sarah Chen, Vice President of Marketing, Acme Corp." on another are the same human. This is the hardest part of the whole pipeline. Bad entity resolution is why you get records where the name belongs to one person and the phone number to another.

Stage 3 — Enrichment and joining. Attach the company record to the person record. Add firmographics: industry, size, revenue band, location, tech stack. Merge duplicate identities across sources. Good data enrichment keeps provenance on each field, so you know the title came from a crawl and the mobile came from a contributory pool.

Stage 4 — Verification. Check whether the address actually accepts mail. MX lookup, syntax validation, disposable-domain detection, role-account detection, and an SMTP handshake that asks the receiving server whether the mailbox exists without sending anything. Catch-all domains accept everything, so they need catch-all verification using a different technique entirely.

Stage 5 — Scoring and decay management. Assign a confidence score. Re-check on a schedule. Retire records that fail. A vendor without a decay policy is selling you a photograph of a moving object.

Which collection method is most accurate?#

Accuracy depends on what field you care about. Crawled data wins on titles and company info. Contributory data wins on mobile numbers. Nobody wins on records older than 18 months.

The practical takeaway: judge a vendor on the verification column, not the volume column. B2B contact data decays at roughly 25–30% per year through job changes alone, and Gartner has flagged poor data quality as a recurring, quantifiable drag on revenue operations. A database that isn't re-verified is losing a quarter of its value every twelve months whether or not anyone touches it.

How is B2B data verified before it reaches you?#

Verification is where most of the real engineering effort goes, and it's the layer buyers understand least.

• Syntax and format checks. Cheap, instant, catches typos and malformed addresses. Table stakes.
• MX record lookup. Does the domain have mail servers at all? Kills dead domains fast.
• Disposable and role detection. Filters info@, sales@, noreply@, and burner domains. Role accounts aren't always bad, but they should be labeled, not hidden in your deliverable count.
• SMTP handshake. Open a connection to the receiving server, ask about a specific mailbox, close without sending. This is the single strongest signal for a normal domain.
• Catch-all handling. Roughly one in five business domains accepts mail for every possible address, which makes SMTP checks return "valid" for asdfgh@domain.com. Honest vendors flag these separately; dishonest ones count them as verified. Run them through a dedicated catch-all finder before you trust them.
• Bounce feedback loops. The best providers ingest bounce data back into the scoring model, so a failed send improves the database for everyone.

If a vendor can't explain which of these six they run, they're reselling someone else's verification and marking it up.

Is collecting B2B data legal?#

Short answer: yes, with conditions that differ by jurisdiction and by collection method.

Under GDPR, business contact data is still personal data if it identifies a person. sarah.chen@acme.com is personal data; info@acme.com generally is not. Processing is usually justified under legitimate interest for B2B outreach, but that requires a balancing test, a privacy notice, an accessible opt-out, and a lawful origin for the record. Contributory data is the weak point here, because the person whose mobile number was uploaded from a colleague's phone never had a relationship with the vendor.

In the US, CAN-SPAM governs the message rather than the collection: you need accurate headers, a physical address, and a working unsubscribe. California's CCPA/CPRA adds deletion and opt-out rights that apply to B2B contacts too.

Practical rules that keep you out of trouble regardless of vendor:

• Prefer records with documented public provenance over records with no stated origin.
• Honor suppression lists across every tool, not just your sending platform.
• Keep your own deletion pipeline — if someone asks to be removed, they should disappear from your CRM, your sequencer, and your enrichment cache.
• Ask vendors for their data processing agreement before signing, not after. Check how they document data sources.

How do you audit a vendor's data collection?#

Send these five questions to any provider before you buy. The quality of the answers predicts the quality of the data better than a free trial does.

1. What is the origin of a specific record? Pick one row from the trial export and ask where it came from. "Proprietary blend" is not an answer.
2. When was this record last verified, and by what method? You want a timestamp and a method name, not a confidence badge.
3. How do you treat catch-all domains? If they're counted as valid, your bounce rate will not match the advertised accuracy.
4. What is your credit policy on bounces? Serious vendors refund or re-credit invalid results. That policy is only affordable if their data is actually good.
5. Can I verify at query time rather than at import time? Real-time lookup beats a static file, every time. If they offer an email verification API, the freshness problem largely solves itself.

Cross-check the answers against public reviews on G2 and against how the vendor documents its own methodology. Vendors that publish their pipeline tend to have a pipeline worth publishing.

How should you collect B2B data yourself in 2026?#

The winning pattern is not "buy a big list." It's a three-layer stack:

Layer 1 — Own your first-party signal. Website visitors, form fills, product usage, webinar attendees, and your CRM history. Smallest volume, highest intent. Everything else exists to expand this layer.

Layer 2 — Enrich on demand, not in bulk. Instead of importing 200,000 rows and watching them rot, resolve contact details at the moment you need them: when a target account shows intent, when an SDR opens the account, when a workflow fires. This is where a domain search or a real-time lookup beats a static database outright, because the record is generated fresh instead of retrieved from cold storage.

Layer 3 — Verify before every send. Even a same-day record should pass validation before it enters a sequence. Bounces damage sender reputation far more than they cost in credits, and reputation damage takes weeks to repair. Run the list through an email verifier as the last step of every campaign build, not the first step of your quarter.

Teams that follow this stack typically carry a much smaller database than teams that buy annually, and hit materially better inbox rates. It's the same logic HubSpot has pushed on CRM hygiene for years: a clean small list outperforms a dirty large one on every metric that matters.

What does this mean for your next data purchase?#

Stop shopping for record counts and start shopping for pipelines. Ask where the data was collected, how it was resolved into an identity, when it was last checked, and what happens when it fails. Any vendor that answers those four clearly is worth a trial. Any vendor that deflects is selling you a used car with no service history.

If you want to see the collection chain in practice, start with the Tomba Email Finder. It resolves addresses from crawled public sources plus pattern inference, then runs MX, SMTP, and catch-all checks before returning a result — so what you get is verified at query time rather than pulled from a file assembled last year. The free tier gives you 25 searches a month to test the accuracy on your own account list, and paid plans start at $49/mo on Starter with $99/mo Growth and $249/mo Pro tiers as your volume grows. Full Tomba pricing is public, including per-credit costs, so you can model the cost of a clean list before you commit to one.

Related guides#

• B2B Data Suppliers: 9 Best Providers Ranked for 2026
• B2B Company Data in 2026: Sources, Accuracy & How to Use It
• B2B Data in 2026: Sources, Accuracy, and Buyer's Guide
• Buying B2B Data in 2026: Costs, Risks, and Smarter Alternatives