SOVE7GN GTM
How to build a B2B lead list: sources ranked by freshness and legal risk
Updated 14 November 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run inbound, midbound and outbound for founders
Build a B2B lead list from the sources closest to a real event, in this order: your own CRM and past conversations, people who engaged with you, a live search on LinkedIn, hiring and funding signals, then a database, and only then anything bought. The further down that list you go, the older the data and the more work you have to do before anyone sees a message.
Short answer: rank sources by how recently a human confirmed the data and by the rules that apply where the person sits. In the US the FTC's CAN-SPAM guide says business-to-business email is covered, needs a valid postal address and an opt-out honored within 10 business days, with penalties up to $53,088 per email (checked November 2026). Then test the list: audit 25 rows by hand, dedupe against the CRM, verify, and send 50 before you send 500.
Where should I get B2B leads from?
Rank sources by one question: how long ago did a human confirm this is true? Best at the top.
| Source | How fresh the data is | Typical cost | What to watch |
|---|---|---|---|
| Your CRM: closed-lost deals, old trials, people who went quiet | As fresh as your own notes | Nothing | Check who still works there |
| People who engaged with you: post reactions, followers, site visitors | Hours to days, and the action is the reason to write | Nothing beyond your posting time | Covered in midbound and website visitor identification |
| LinkedIn search or Sales Navigator | The person maintains the profile, so titles beat any database | Sales Navigator Core lists at US$119.99 a month or $1,079.88 a year (LinkedIn, checked November 2026) | Profiles lag a job change by weeks, and email is not in there |
| Hiring signals: the company's careers page and job boards | Days. A live role is a dated, public fact | Free to check, paid to monitor | A posting proves a plan, not a budget |
| Funding and press announcements | Days to weeks | Free | Everyone else on your market reads the same announcements |
| Public registers, licence lists, association directories | Months, but authoritative for what they certify | Usually free | Useful only if that attribute is in your profile |
| General B2B databases with enrichment waterfalls | Mixed, from last week to several years old | Clay publishes a free tier and Launch at $167 a month billed annually, $185 monthly (Clay, checked November 2026) | Coverage differs by country and company size. Test before buying a year |
| A list bought from a broker or scraped in bulk | Unknown, and you cannot check it | Cheap per row, expensive in domain damage | Hardest to defend when someone asks where the data came from |
Hiring and funding signals are strong because they are dated, which is why they sit at the centre of signal-based outbound. A database is not the enemy either: it is the right tool once your profile is written as a filter, which is the job of defining your ICP.
How fast does a lead list go stale?
Fast, and public data puts a floor under the number without trusting a vendor claim. The US Bureau of Labor Statistics JOLTS release for September 2026 reports 5.3 million total separations, a rate of 3.3% of employment in that month (checked November 2026).
Our method: 3.3% a month, held for twelve months, equals about 40% of employment moving in a year. Some people move more than once, so the share of individual people who move is lower. Even at half that rate, roughly one row in five in a list built in January points at the wrong person by December.
So build lists in batches you will contact within two weeks, re-verify anything older than 90 days, and treat a job change as a reason to write rather than a row to delete.
What are the rules for cold email in the US, UK and Canada?
General information, not legal advice. Read the primary sources and take advice before sending at volume.
| Where the recipient is | What the rule says | Source |
|---|---|---|
| United States | CAN-SPAM makes no exception for business email: accurate headers, a valid physical postal address, a working opt-out honored within 10 business days, penalties up to $53,088 per email, and you cannot pass the responsibility to whoever sends for you | FTC compliance guide |
| United Kingdom | "The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers", though you must not disguise your identity and must give a valid opt-out address. Sole traders and some partnerships count as individual subscribers and do need consent or the soft opt-in, and the UK GDPR still applies to personal data | ICO business-to-business marketing |
| European Union | The GDPR says "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest", but only where that does not override the "reasonable expectations of data subjects". The email rules come from national implementations of the ePrivacy Directive and differ by country | GDPR Recital 47 |
| Canada | CASL section 6 requires consent, express or implied, before a commercial electronic message, and the message must identify the sender, give contact information "valid for a minimum of 60 days after the message has been sent" and include an unsubscribe mechanism | Canada's Anti-Spam Legislation |
Our cautious reading: the US is the most permissive of these for cold B2B email and Canada the strictest, so split a mixed list by country and write different rules for each. The ICO's advice applies everywhere in practice: keep a suppression list of anyone who objects and screen every new list against it.
How do I test a list before I send anything?
Five checks, in order. The first four take under an hour for a 500-row list.
- Audit 25 rows by hand. Open the person's live profile and the company site. Is the title current, is the company the size you filtered for, is this the person who feels the problem? If more than 3 of the 25 are wrong, the filter is wrong, not the data.
- Dedupe against your CRM. Remove current customers, open deals, anyone another founder is already talking to, and the suppression list.
- Verify the addresses and drop the ones that come back risky or unknown rather than guessing. Google's sender guidelines require bulk senders to keep the spam complaint rate in Postmaster Tools below 0.30%, with 0.10% recommended, and apply to anyone sending more than 5,000 messages a day to Gmail (checked November 2026). The rest of the rules are in cold email deliverability.
- Note a second channel per row. A valid address behind a strict gateway is still a dead end, so record the LinkedIn profile too.
- Send 50 and read the replies. Not the open rate, the words. "We do not do this here" means the targeting is wrong. "We already have something" means the targeting is right and the message is wrong.
What does one row of a good list look like?
Rows that hold only name, title, company and email get template messages, because there is nothing else to write about. Example only: Northgate Freight is a made-up company used to show the columns.
| Column | Example value | Why it is there |
|---|---|---|
| Why this company, this month | Posted a dispatch supervisor role on 3 November | The dated reason you are writing now |
| Fit attributes from your ICP | 180 staff, 3 depots, no data engineer | Proves the row passed the filter |
| Person and title | VP Operations at Northgate Freight | The person who feels it, not the most senior person |
| Verified email and date | Yes, verified 12 November | So you know when it ages |
| Second channel | LinkedIn profile URL | For when email fails |
| First line you would write | "Three depots and a dispatch supervisor opening usually means..." | If you cannot write it, the row is not ready |
The last row is the test that matters. A list where you cannot write a specific first line for each row will produce templates, and templates are why outbound stops working.
Doing this every week is what most founders drop after the first list. SOVE7GN GTM runs that part continuously for B2B startups: matching fitting companies with the right person, writing one personal message each, and handling replies, while the founder takes the calls. Pricing is shared on a call: book 30 minutes. The other guides are in the GTM guides hub.
Questions people ask
Is it legal to send cold emails to business contacts?
In the US, yes, if you follow CAN-SPAM: truthful headers, a postal address, an opt-out honored within 10 business days. In the UK, PECR's email consent rule does not cover corporate subscribers but does cover sole traders and some partnerships. In Canada, CASL requires consent first. General information, not legal advice.
How many leads do I need in a list to start?
Enough for two weeks of sending, which for a founder writing by hand is 100 to 300 rows. Building 5,000 before the first 100 are tested just means 5,000 rows going stale.
Should I buy a B2B lead list?
A bought list is the worst row in the freshness table and you cannot check how the data was collected. Use a database you can filter and verify yourself, and test a sample before signing an annual plan.
How often should I clean my lead list?
Re-verify anything older than 90 days and re-check titles before an account enters a new sequence. The public turnover data makes a yearly clean far too slow.
What is the difference between a lead list and an ICP?
The ICP is the filter: the attributes a company must have. The list is the output of that filter, with named people, verified contact details and a dated reason to write. Build the filter first, as in how to define your ICP.
Want calls on your calendar without hiring five people?
Book a 30-minute call. Tell us who buys from you and we'll show you what inbound, midbound and outbound would look like for your startup.
Book a call How SOVE7GN GTM works- How to define your ICPBuild an ideal customer profile backwards from closed deals, then test it.
- Buying signals for B2B outboundFunding, hiring, job change and intent signals ranked, with data sources.
- Cold email deliverabilityProvider rules in plain words, plus a pre-send checklist for a new domain.