An RFP for buyer intent data succeeds when its questions make every vendor show what a score is built from, in a form you can check. This post gives you 18 questions specific to intent data, in five groups: source, method, privacy, delivery and licence. Each comes with the evidence to request and the answer that earns full marks, followed by a worked example and a back-test to run on sample data.
How to write RFP questions for a buyer intent data vendor
Write RFP questions for a buyer intent data vendor in five groups: where signals come from, how they become a score, what personal data is touched on the way, how scores are delivered and what the licence allows. Give each question a named piece of evidence and a grade from 0 to 3.
| Grade | The answer rests on |
|---|---|
| 0 | Nothing, or an assurance given in a meeting |
| 1 | A written statement in the response |
| 2 | A document you can keep: a methodology, a contract clause, a registry entry |
| 3 | Something you verified: a test on sample data, or a record traced end to end |
An intent score is an inference: somebody observed an activity, tied it to a company and read a purchase into it. Four kinds of source are sold as intent data, and a response should say which kind each signal comes from.
- Your own properties. Visits to your website and content: first-party data.
- Other publishers' sites. Reading observed through a co-operative's tag on member sites or through the advertising bid stream: the classic third-party data.
- A marketplace or review site. Views of product, category and comparison pages on the vendor's own site.
- A company's own public actions. A tool adopted, a role opened, a filing made, an announcement.
Send every vendor the same target accounts and topics, and ask for sample scores on that list for a past quarter, as first published. The questions common to all company data are in ten questions for a company data vendor.
A checklist for evaluating B2B intent data providers: questions to ask vendors
When evaluating B2B intent data providers, the questions to ask vendors fall into a checklist of 18. Thirteen are below: what a signal records, how it is tied to a company, how signals become a score and a surge, how the evidence reaches you and what the licence allows. Five on privacy follow.
Source: where each signal comes from
| Question | Evidence to request | Full marks when |
|---|---|---|
| S1. Which kind of source does each signal come from, and in what shares last quarter? | A source inventory by kind, with shares | Every sampled signal names its kind |
| S2. What event stands behind one signal: a page view, a bid request, a comparison, a posting? | The event schema, and the events behind ten sampled scores | You can count the events behind a score |
| S3. How is an event tied to a company, and what share is discarded as unresolved? | The matching method by source, and the treatment of home, mobile and shared networks | Each signal states its match, and the unresolved share is a number |
| S4. Who else receives the same signals, directly or inside a platform you license? | The resellers and platforms that carry the feed | No source is paid for or counted twice |
Method: how signals become a score
| Question | Evidence to request | Full marks when |
|---|---|---|
| M1. What is the unit of a score, which window feeds it and how does older activity fade? | The grain, the window and the decay, as numbers | You can rebuild a sampled score's inputs from the events delivered |
| M2. What baseline defines a surge: the account's own history, similar accounts or the whole market? | The rule for an intent surge, in numbers | You reproduce the flag on sampled rows |
| M3. How is activity mapped to a topic, and who maintains the taxonomy? | The taxonomy, and twenty sampled signals with the text behind each topic | Your grading of the twenty agrees at a rate set in advance |
| M4. Is the history the scores as first published, or recomputed with the current model? | The version on each row, and the policy on recomputation | Two pulls of one past week, weeks apart, are identical |
| M5. Against which outcome was the score validated, on which population and at what base rate? | The validation design, and lift by score band | You reproduce a lift on your own opportunities |
Delivery: how scores reach your systems
| Question | Evidence to request | Full marks when |
|---|---|---|
| D1. Does the evidence travel with the score, and how old is the newest signal when the score arrives? | Sample rows with the dated signals behind each | A rep can open the evidence, and its age is measurable |
| D2. At which level is a score attached: a website, a legal entity or a parent group? | The roll-up rule, and a match of your account list | A subsidiary's activity lands on the account you expect |
Licence: what you may do with the scores
| Question | Evidence to request | Full marks when |
|---|---|---|
| L1. May scores leave the vendor's application for your warehouse, models and product, and may you train models on them? | The permitted-use clause, and the clause on derived data at termination | The clause names internal use, embedding or redistribution, the three rights of a data licence, and derived data is addressed |
| L2. Does the vendor warrant its right to license each source, and what follows if one is withdrawn? | The warranty, the indemnity and the remedy | The loss of a source has a stated remedy |
A privacy and compliance checklist for a B2B intent data vendor evaluation
A privacy and compliance checklist for a B2B intent data vendor evaluation covers five points: whether personal data is processed at any stage, who collected consent and can prove it, which privacy signals the pipeline honours, how opt-outs and deletions reach the scores, and which of the delivered fields describe people.
Delivery at account level does not settle the first point: identifiers used on the way to an account can be personal data. Start from the official pages below, with your counsel.
- European Union. The European Commission lists an IP address, a cookie ID and a phone's advertising identifier among its examples of personal data. It adds that pseudonymised data which can be used to re-identify a person remains personal data.
- United Kingdom. The Information Commissioner's Office says in its guidance on storage and access technologies, finalised on 29 April 2026, that unless an exception applies you must tell people what the technologies are, explain what they do and obtain prior consent. It lists five exceptions and says that use for online advertising requires consent. It counts cookies, tracking pixels, fingerprinting, scripts and tags among those technologies.
- California. The Attorney General's CCPA page lists internet browsing history among its examples of personal information. It says a user-enabled global privacy control, the GPC, must be honoured by covered businesses as a valid request to stop the sale or sharing of personal information.
- California data brokers. The California Privacy Protection Agency says a business that meets the definition of a data broker must register each January, and it publishes the Data Broker Registry. The agency gives 1 August 2026 as the date on which data brokers are required to begin processing deletion requests sent through its platform, DROP.
- Advertising. IAB Tech Lab describes its Global Privacy Protocol as a protocol for transmitting privacy, consent and consumer choice signals from sites and apps to ad tech providers. It supports the IAB Europe and IAB Canada TCF strings, the MSPA's US National string and a number of US state strings.
Privacy and consent questions to ask an intent data vendor
The privacy and consent questions to ask an intent data vendor are who obtained consent for each event and in what words, whether the consent record can be produced, what happens to events that arrive with an opt-out or with no signal, and how a deletion reaches data already scored.
| Question | Evidence to request | Full marks when |
|---|---|---|
| P1. Is personal data processed at any stage, IP addresses, cookie IDs and device identifiers included, and in which role? | A data flow naming each identifier, where it is dropped, and the vendor's role | Every identifier is accounted for, from collection to delivered row |
| P2. Where a tag or cookie collects the activity, who obtains consent, and in what words? | The consent wording on three member sites, and the clause that binds the site | The wording covers the use you are buying |
| P3. Can the consent record be produced for a sampled event, and what happens to events with an opt-out or no signal? | Stored consent strings, and counts of events dropped, by reason | Records are produced, and the drop rule is written down |
| P4. How do opt-outs and deletions reach data already scored, and is the vendor on California's data broker registry? | The opt-out route, the time to act, and the registry entry or why the definition does not apply | You find the entry yourself, and a test opt-out acts in the stated time |
| P5. Which delivered fields describe people: visitor counts, personas, locations? | The schema, with every person-level field marked and its lawful basis | The schema is account-level, or each person-level field has a basis |
Grade this group with a gate as well as a sum: a 0 on any of the five holds a response out. A fund's due diligence questionnaire covers the same ground: sourcing, rights and personal data.
Privacy and accuracy in an intent data RFP: G2, Bombora, 6sense and Demandbase
G2, Bombora, 6sense and Demandbase each document a different source, so an RFP on intent data privacy and accuracy puts a different question to each: G2 records research on its product and category pages, Bombora a co-operative of publishers and brands, Demandbase the advertising bid stream, and 6sense keyword research matched to accounts.
| Product | What its own pages say | The questions it leads to |
|---|---|---|
| G2 Buyer Intent | G2's documentation says signals are triggered by buyers' actions on G2, such as viewing a product profile, a pricing page, a category or a comparison, and that Buyer Intent includes research activity from Capterra, Software Advice and GetApp. It reports a Buying Stage and an Activity Level for each buyer company, and a product's plan determines its signal types. | S2 and L1: the signal types in the quoted plan, and whether they may leave the application |
| Bombora Company Surge | Bombora's site says the data is derived from its Data Co-op of publishers and B2B brands, through its own tag on member sites, which it describes as consent-driven, and scored by comparing three recent weeks with a 12-week baseline. Its article on privacy, published in October 2022, says publishers are responsible for obtaining consent. | P2 and P3: the member clause, the consent wording and a sampled consent record |
| 6sense | 6sense's site says customers track keywords of their choice, that it matches anonymous web traffic and intent signals to buyers and accounts, and that partnerships with other providers, Bombora and G2 among them, complement its native intent. | S3 and S4: how traffic is matched to an account, and which signals are native |
| Demandbase | Demandbase's help centre says keyword intent is collected through direct access to the bid stream via its own B2B DSP and scored low, medium or high against accounts of similar size. Trending Intent means a rise of two standard deviations in the last 7 days against the last 8 weeks. | P3 and M2: the privacy signals on a bid request, and the trending flag reproduced on a sample |
The pages linked in the table describe sources and scoring rules. On them we found no validation design: the outcome a score was tested against, the population and the base rate. Request it under M5.
A worked example: grading three responses and back-testing two
Acme Robotics is an illustrative company, and every figure here is invented.
Assumptions:
- Each of the 18 questions is graded 0 to 3, so a response can earn 54 points, three for each question of a group.
- A 0 on any privacy question holds a response out.
- Acme has 2,000 target accounts with no opportunity open at the start of the test quarter, and 80 opened one during it: a base rate of 4.0%.
- Each vendor supplies scores on those accounts for the quarter before, as first published. An account is flagged when the vendor's surge rule fired on one of Acme's topics in any week.
| Group (maximum) | Response A | Response B | Response C |
|---|---|---|---|
| Source (12) | 10 | 7 | 11 |
| Method (15) | 9 | 12 | 13 |
| Privacy (15) | 13 | 11 | 9, with a 0 on P3 |
| Delivery (6) | 4 | 5 | 6 |
| Licence (6) | 3 | 5 | 5 |
| Total (54) | 39 | 40 | 44 |
Response C has the highest total and a 0 on P3, so the gate holds it out. A and B are one point apart, within the judgement of one grader, so the back-test of M5 decides.
| Measure | Response A | Response B |
|---|---|---|
| Accounts flagged | 300 | 500 |
| Flagged accounts that opened an opportunity | 30 | 35 |
| Hit rate: opened ÷ flagged | 10.0% | 7.0% |
| Lift: hit rate ÷ base rate | 2.5 | 1.75 |
| Share of the 80 opportunities found | 37.5% | 43.75% |
Response A concentrates opportunities in a short list: one flagged account in ten opened one, 2.5 times the base rate. Response B finds five more opportunities for 200 more accounts worked. A team with capacity for 300 accounts takes A's list as it stands, and needs B's ranking to cut 500 to 300 before the two compare.
Repeat the test on a second quarter. The standard error of each hit rate, the square root of p times (1 minus p) divided by n, is about 1.7 points for A and 1.1 for B, so a gap of 3.0 points is a lead to confirm.
How Fokals answers the five groups
Here are the five groups put to Fokals. The methodology overview and the sourcing statement are public, the full methodology is shared with buyers during an evaluation, and sample data for the companies you name is sent on request.
| Group | Our answer |
|---|---|
| Source | The sourcing statement sets out the rules of collection, and each score comes with the dated evidence behind it, so a sampled score can be traced. |
| Method | Intent Scores: a weekly 0 to 100 score per company and topic, 69 topics in 9 groups, with a surge flag, written once after the week closes and never revised. What a Fokals intent score gives you shows how to read one. |
| Privacy | Company-level data throughout: every delivered row describes a company. |
| Delivery | Scores weekly and Company Signals daily, by REST API or as bulk files. Each score comes with its dated evidence. |
| Licence | A written agreement for internal use, embedding in a product or redistribution. |
Frequently asked questions
What questions should an RFP for buyer intent data ask?
Ask 18 questions in five groups. Source: what event stands behind a signal, how it is tied to a company and who else receives it. Method: the window of a score, the baseline of a surge, the mapping to topics, whether history is recomputed and how the score was validated. Privacy: the identifiers processed, consent, opt-outs and person-level fields. Delivery: the evidence and the level a score attaches to. Licence: permitted use, derived data and the warranty on each source.
How do you test the accuracy of intent data before you buy it?
Run a back-test on your own accounts. Take the vendor's scores on your target accounts for a past quarter, as first published. Count the accounts it flagged and how many of those opened an opportunity in the following quarter. Divide that hit rate by the rate across all your target accounts to get the lift, and note the share of all opportunities the flags found. Repeat the test on a second quarter before you rely on the result.
Is B2B intent data personal data?
It depends on what is processed on the way to the score, so read the vendor's data flow with your counsel. The European Commission lists an IP address, a cookie ID and a phone's advertising identifier among its examples of personal data, so activity observed in a browser can involve personal data even when the delivered row names an account. A score built from a company's own public actions, such as a posting or a filing, describes the company.
What is the difference between co-operative, bid stream and review-site intent data?
They differ in where the activity is observed. Co-operative data comes from a tag on member publishers' sites, which is how Bombora describes its Data Co-op. Bid stream data comes from advertising auctions, which is how Demandbase describes the source of its keyword intent. Review-site data records views of product, category and comparison pages, which is how G2 describes Buyer Intent. Each source raises its own questions on consent, matching and exclusivity.
What evidence should come with an intent score?
The dated events or signals behind it, each with its source, so that a rep or a model reviewer can open what produced the number. Ask for sample rows and check that the evidence arrives with the score. Each Fokals intent score comes with the dated evidence behind it, and the Company Signals dataset is delivered daily beside the scores.
Can intent scores be used in a model or a product of your own?
Where the licence grants it. Internal use, embedding in a product and redistribution are three separate rights, so ask which one the quoted licence grants, whether scores may leave the vendor's application, whether you may train models on them, and what happens to derived scores and trained models when the term ends. Fokals licenses its data by written agreement for those three uses.
What this page says about the products it names was checked against their public documentation on 7 October 2026. Product and company names are trademarks of their owners. Fokals is not affiliated with them or endorsed by them.