Is intent data creepy, and will it pass GDPR and compliance review?

Why do compliance teams object to intent-based outreach in the first place?

Compliance teams object because the category has earned the reputation: a platform that watches a buyer across the internet and hands a rep a dossier to open the call with. Most of that reputation was built by vendors selling intent data as a black box, a score with no visible source. The honest response is to bring the compliance team in early, not late, and to assume every serious prospect runs a vendor assessment before signing anything. A system built to pass that assessment on the first try, rather than explain itself on the second, is doing the review's job before it starts.

The system we run uses first-party signals, a buyer's own site, their own forms, their own product, together with signals from sources that are legitimately available, and it respects consent and regional rules including GDPR and CCPA rather than pretending those rules apply to somebody else's product. There is no shadowy file following a person around the internet: if a signal cannot be sourced legitimately, it never enters the system.

What actually makes outreach feel like surveillance?

What actually makes outreach feel like surveillance is the message, not the signal that produced it. A rep who writes "I saw you visited our pricing page Tuesday at 4" has told the buyer they are being watched, and that line is creepy regardless of how the data was sourced or how compliant the pipeline behind it is. The signal exists to route and time the outreach, not to narrate itself back to the person it describes.

The thing that makes outreach creepy is not the data. It is the message.

A message built correctly speaks to the problem the buyer is likely facing, never to the signal that surfaced them. The signal stays inside the building: it decides who gets a message and when, and the buyer experiences a well-timed, relevant conversation rather than a demonstration of how much you know about them. That distinction is the whole compliance argument in one sentence, and it is also the whole deliverability argument: a message that names its own surveillance is the fastest way to end up flagged, whether the flag comes from a spam filter or from the prospect forwarding the email to their security team.

Does this comply with GDPR and CCPA?

It complies by refusing to treat regional privacy law as somebody else's problem: the system respects consent and regional rules, GDPR and CCPA among them, at the point signals are collected rather than after the fact. First-party signals, a company's own site, forms and product, carry their own consent basis because the buyer interacted directly with the business collecting them. Third-party and legitimately available signals still have to clear the same bar: sourced legitimately or they do not enter the system at all.

Retention and deletion are not a policy document a vendor waves at a reviewer. They live in the schema: what is kept, for how long, and how a deletion request is honored down to the row, are all things a compliance team can be shown directly rather than promised on a call. A vendor who cannot point to where the rules are enforced in the system does not have rules. They have intentions, and intentions do not survive an audit.

How confident does an identity match need to be before a rep acts on it?

An identity match needs enough confidence to clear a fixed, auditable waterfall before a rep ever sees it, because matching an anonymous visit to a named person is probabilistic and nobody's match rate is perfect. The system resolves identity through an enrichment waterfall: a LinkedIn URL beats an email, an email beats a company domain, worked down in a fixed order with every step written to a merge log, so it is possible to see later exactly why the system believes a given visit belongs to a given person.

When confidence is low, the match does not become outreach. It is quarantined, held in place until a second piece of evidence confirms or kills it, and the account-level read still holds even when one individual inside a company is matched wrong, because the conclusion is never staked on a single name. The last safeguard is a person: a rep sees "we think this is the VP of Platform, here is why," and decides, so a wrong guess gets caught by a human instead of amplified by a system running unattended.

What should a GTM team tell its own compliance function before the review starts?

A GTM team should walk in with the same four answers a reviewer will ask for: what data is collected and from where, what a message is and is not allowed to say with it, how a low-confidence match is handled, and where retention and deletion are enforced in the system rather than in a policy PDF. Teams that wait for compliance to ask usually improvise an answer in the room, and an improvised answer is what turns a routine review into a blocked deal.

The same first-party discipline that makes the review defensible also protects the dark channel signals a team is trying to instrument in the first place: docs read twice, a pricing page hit five times, a repository starred. Those behaviors belong to the buyer's own interaction with a business's own surfaces, which is the clearest first-party basis a reviewer will see, and it is also, not coincidentally, the signal a third-party intent tool cannot watch at all.