How Is Intent Data Collected? A 2026 Field Guide

TL;DR

• Intent data is collected four ways: bidstream ad auctions, publisher co-ops, first-party pixels on your own site, and social/community scraping. Each has a different accuracy ceiling.
• Bidstream is the cheapest and the noisiest — it resolves an IP address to a company, then guesses the topic from the page the ad was served on. Expect 40-70% company-match accuracy at best.
• Publisher co-ops (Bombora-style) are more reliable because the content is registered and topic-tagged, but they lag 24-72 hours and only cover B2B media properties.
• First-party intent — your own site, docs, pricing page, product usage — is the only source where you control the identity resolution end to end. It is also the smallest volume.
• Intent tells you which account is warm. It never tells you who to email. You still need a contact layer to turn an account signal into a deliverable address.

Intent data is sold as mind-reading. It is not. It is a chain of inferences — an IP address, a cookie, a page URL, a topic taxonomy — and each link in that chain drops accuracy. If you know how the collection actually works, you can predict where a vendor's data will be strong and where it will be garbage, before you sign a $40K contract.

This guide walks the plumbing.

What is intent data, in collection terms?#

Intent data is any behavioral signal that suggests an account is researching a problem you solve. The definition is easy. The collection is where vendors get vague.

Every intent record you buy is assembled from three pieces:

1. A behavioral event — someone loaded a page, watched a video, downloaded a PDF, bid on an ad slot, or searched a term.
2. An identity resolution — the vendor maps that anonymous event to a company (rarely a person), usually via IP-to-company matching, a cookie graph, or a logged-in publisher session.
3. A topic classification — the vendor tags the content with a topic from a fixed taxonomy ("data warehouse", "SOC 2 compliance", "email deliverability").

If any of those three is weak, the record is noise. A perfect topic match on a misidentified company is worse than no data at all, because it sends a rep into a call with a false premise.

Think of it like a security camera in a shopping mall. The camera records that someone walked past the running-shoe store three times (event). The mall's system guesses which company badge that person carries from the Wi-Fi they connected to (identity). The store category is known from the floor plan (topic). Useful, directionally. But nobody would run a sales org on it without knowing the camera's blind spots.

How is intent data collected? The four sources#

Bidstream: the firehose with a leak#

Every time a page with programmatic ads loads, an ad exchange broadcasts a bid request containing the page URL, a device/cookie ID, an IP address, and metadata. Millions of these fire per second. Some intent vendors sit inside that stream — as a bidder, or via a data partnership — and log the requests instead of (or alongside) bidding.

The appeal is scale: bidstream covers essentially the entire ad-supported web. The problem is that a bid request was never designed to identify a business researcher. Two failure modes dominate:

• IP resolution decay. Remote work, VPNs, corporate proxies, and mobile carrier NAT mean an IP no longer reliably maps to one company. A residential IP in Denver could be a Fortune 500 VP or a student.
• Topic inference from URL. The vendor sees example.com/blog/best-crm-2026 and tags "CRM". Fine. It also sees a news homepage and tags whatever the page-level classifier guesses.

Bidstream is also under regulatory pressure. Privacy regulators in the EU and US have scrutinized how bid request data is retained and resold, and several vendors have quietly de-emphasized it. Treat any vendor that will not tell you its bidstream percentage as a vendor selling bidstream.

Publisher co-ops: fewer signals, cleaner ones#

The co-op model — Bombora is the best-known operator — works differently. Thousands of B2B publishers install the vendor's tag in exchange for access to the pooled data. When a registered user reads an article about Kubernetes security on any member site, that pageview is tagged against a shared taxonomy and attributed to the reader's company.

Two things make this better than bidstream:

• The content is intentionally tagged, not inferred from a URL string. Topic precision goes up sharply.
• Many members have registration walls, so identity comes from a form-submitted business email rather than an IP guess.

The tradeoffs are coverage and latency. Co-ops only see what happens on member properties — not on Google, not on your competitor's site, not inside Slack communities. And surge scores are usually computed on a weekly baseline, so you learn about a spike days after it started.

First-party intent: small, slow to build, and the only one you control#

Your own website is an intent source, and it is the one most teams underuse. A visitor hitting your pricing page three times in four days is a stronger signal than any third-party topic surge, because there is no inference chain — you own the event, and you can attach identity through forms, logged-in sessions, or website visitor reveal that resolves company-level traffic.

What counts as first-party intent:

1. Pricing and comparison page visits — highest-intent pages on almost every B2B site.
2. Documentation and API reference views — strong signal from technical evaluators, often before any sales contact.
3. Repeat visits from the same account inside a short window — velocity matters more than volume.
4. Product usage for existing customers — seat growth, feature adoption, or a drop-off that predicts churn.
5. Email and content engagement — which sequence, which asset, how deep.

The catch: volume. If you get 8,000 monthly visitors, first-party intent might surface 60 accounts worth working. That is a great list — it is not a demand-gen program on its own.

Social and community signals#

Person-level signals come from public behavior: someone follows your company page, comments on a competitor post, leaves a review on G2, or asks a question in a niche subreddit. Volume is low and collection is manual or semi-automated, but the signal is attached to a human, not an IP block. For founder-led and small-team sales, this often outperforms a six-figure intent subscription. Pair it with disciplined LinkedIn outreach and you have a workable motion without any vendor contract.

Is third-party intent data accurate enough to act on?#

Depends what "act on" means. Here is the honest breakdown by use case.

The single most common failure I see: a rep opens an email with "I noticed your team is researching data warehouses." The account never researched anything — an IP in the same /24 block did. The prospect knows they never visited that page, concludes the sender is either lying or creepy, and the thread is dead. Use intent to decide who to contact, not to narrate what they did.

Vendors publish accuracy figures that are not comparable, because they measure different links in the chain. "94% accurate" usually means the topic classifier matched a human-labeled sample — not that the company attribution was right. Ask two specific questions during evaluation:

• What percentage of your records come from bidstream versus registered/co-op sources?
• What is your company-level match rate, measured against a held-out set of known visitors?

If the answer to either is a deflection about "proprietary AI models," you have learned what you needed to know. Analyst coverage from Gartner and buyer reviews on G2 are more useful here than vendor collateral.

What are the privacy and compliance limits in 2026?#

Collection method determines legal exposure, so this is not a footnote.

• Company-level, no personal data. Reverse-IP company identification and aggregate topic surges generally sit outside GDPR's personal-data definition when no individual is identified. This is why most B2B intent products deliberately stop at the account level.
• Person-level third-party intent requires a lawful basis. If a vendor tells you which named individual at an account read an article, ask how consent was captured. Frequently the answer involves a publisher's consent flow you have no visibility into.
• Bidstream retention is the sharpest edge. Bid requests are transmitted for the purpose of running an auction; repurposing and reselling them has drawn enforcement attention in multiple jurisdictions.
• CCPA/CPRA and state analogues give consumers deletion and opt-out rights that flow through to your CRM if you ingest person-level records.

Practical stance: build your program on first-party plus company-level third-party, and treat person-level third-party intent as a high-scrutiny purchase requiring your legal team's sign-off.

How do you turn an intent signal into a contactable person?#

This is the step vendors gloss over, and it is where most intent programs stall.

An intent record says: Acme Corp showed a surge on "email deliverability" this week. It does not say who at Acme owns that problem, whether they are still employed there, or what their email address is. You have an account. You need a human.

The workflow that actually converts:

1. Filter the surge list against your ICP — company size, tech stack, geography. Most surge lists are 60-80% irrelevant before filtering.
2. Identify the right roles. For a deliverability topic, that is likely a Demand Gen Manager, a Head of Growth, or an RevOps lead — not the CEO of a 900-person company.
3. Find their contact details. Use a domain search to pull the verified addresses at that company and filter by department, or run a name-and-domain lookup through the Tomba Email Finder if you already have the person from LinkedIn.
4. Verify before sending. Surge lists are only useful if the emails land. Run every address through an email verifier so a burst of outbound against a fresh account list does not spike your bounce rate and damage sender reputation.
5. Write to the problem, not the signal. Reference the topic ("most teams your size hit deliverability walls around the 50-rep mark"), never the surveillance ("I saw you were researching...").
6. Move fast, then let it go. Co-op surge windows are typically 2-4 weeks. If two touches inside that window get nothing, drop back to nurture.

Step 3 and 4 are where the economics of an intent program get decided. A 500-account surge list at a 55% contact-find rate and a 12% bounce rate produces far less pipeline than the same list at 85% find and 2% bounce — same intent spend, twice the meetings. If you are enriching lists at volume, batch it: bulk email finder runs beat one-off lookups on both cost and rep time, and data enrichment fills in the title and seniority fields your routing rules depend on.

Should you build a first-party intent stack instead of buying?#

For most teams under $10M ARR: yes, start there.

A workable first-party stack costs a fraction of a third-party subscription:

Compare that to a mid-market third-party intent contract, which typically starts around $25K-$40K per year and requires a dedicated owner to keep the topic taxonomy tuned. Buy third-party when your first-party volume is genuinely maxed out and you need to reach accounts that have never heard of you — not as a substitute for instrumenting your own funnel. If your ICP is narrow and well-defined, a good B2B database plus disciplined first-party tracking will outperform a broad surge feed.

Note that vendor category boundaries blur here. Contact-data providers like BookYourData sell verified B2B records rather than intent signals — a genuinely different layer of the stack, and often the one worth fixing first. Bad contact data breaks an intent program faster than bad intent data does.

What should you ask a vendor before signing?#

Run this list in the demo, and write the answers down:

• Source mix. What percent bidstream, co-op, first-party partnership, and survey/panel?
• Match rate. Company-level match rate against a blind sample, not a curated case study.
• Taxonomy control. Can you define custom topics, or are you stuck with 6,000 pre-set ones that miss your category?
• Latency. How many days between the behavior and the record appearing in your instance?
• Baseline math. How is a "surge" calculated — absolute volume, or deviation from that account's own baseline? Deviation is the honest method.
• Suppression. Can you exclude existing customers and open opportunities automatically?
• Person-level claims. If they offer contact-level intent, exactly how was consent obtained?
• Contract exit. Annual lock-in with no pilot is a red flag in this category.

If a vendor answers all eight cleanly, they are probably worth a paid pilot. Score the pilot on meetings booked from surge accounts versus a control list from the same ICP — not on the size of the surge list.

Where to start this week#

Pick the smallest version of this that works. Instrument your pricing and docs pages, resolve the company-level traffic, and route anything with three-plus visits in seven days to a rep the same day. That is a functioning intent program, and it costs almost nothing.

The bottleneck will show up immediately: you will know which company is interested and have no idea who to write to. That is the layer to solve first. Run the domain through the Tomba Email Finder to pull verified, department-filtered contacts at any account showing intent, then verify before you send. The free tier gives you 25 searches a month to test the workflow on real surge accounts; Starter is $49/mo when you are ready to run it at volume. Intent tells you when. A verified contact is what lets you do anything about it.

Related guides#

• Bidstream Intent Data in 2026: How It Works & When to Use It
• Buyer Intent Data in 2026: How to Find Ready-to-Buy Leads
• B2B Intent Data in 2026: How to Find Buyers Ready to Buy
• Best Intent Data Providers in 2026: A Buyer's Guide