B2B privacy is the elephant in the room (are you about to be sat on?)

B2B likes to imagine it’s somehow immune from the privacy storm. After all, we’re not selling sneakers or retargeting people’s TikTok habits. But here’s the reality: A “business lead” is still a human being. If your database contains names, emails, job titles, behavioural signals... regulators consider that personal data.

GDPR doesn’t carve out exceptions just because your sales cycle is long and complex. California’s CCPA and CPRA have narrowed most of the wiggle room that used to exist for B2B. And the FTC has started paying closer attention to data brokers, enrichment practices, and even how AI gets wrapped into data-driven marketing. In other words: The net is tightening, and B2B isn’t hiding under the radar anymore.

The real operational headache? Most B2B orgs are still running playbooks that feel like 2018. Gated eBooks sprayed to cold lists, cookie-based retargeting that ignores the death of third-party cookies, and widespread use of enrichment tools like ZoomInfo without a second thought about their legal footing. These practices live in a grey zone that might have passed without comment five years ago, but regulators, and customers, are less forgiving now.

And yet, despite the risks, the pressure to feed pipeline pushes teams to take shortcuts. Marketing Ops ends up being stuck in the worst possible position: Both the enabler of growth and the Police officer at the gate. You’re the one who has to get the campaigns live, but also the one who’ll be called first when legal or leadership asks, “Where did this list come from?”

Why vendors are the weakest link

Let’s be blunt: Most data vendors are black boxes. They pitch you engagement lift, “95% accuracy,” and “millions of verified contacts”, but scratch the surface and the provenance is murky at best. Where did those names come from? When were they collected? Was consent given, or inferred, or scraped from LinkedIn with a bot? If you can’t answer those questions with confidence, you can’t respond to a subject access request (DSAR).

And if you can’t respond to a DSAR, you’re exposed.

Worse, vendors hide behind endless supply chains. They resell to each other, creating a hall of mirrors where no one can trace the original source. Sub-processors multiply without disclosure. And when you ask for audit rights or deletion guarantees, half of them refuse. The risk doesn’t stay with the vendor; it lands squarely on you. Regulators don’t fine ZoomInfo - they fine you, the controller using the data.

The operational fallout

The impact isn’t just legal risk. It’s wasted money on bad leads that never convert. It’s campaigns bogged down by high bounce rates. It’s sales complaining about “junk” contacts. And when the inevitable DSAR or opt-out comes through, it’s your Ops team scrambling across disconnected systems trying to purge records while the clock ticks down on compliance deadlines.

Even if regulators don’t come knocking, reputation damage can be brutal. A single screenshot of a poorly targeted cold email can go viral. “This company scraped my data” is a headline you can’t buy your way out of.

Making privacy operational (not optional)

So how do you fix it? The first step is cultural: Treat privacy and compliance like product quality. Every campaign should carry provenance details the same way it carries a budget code. Who supplied the data, what’s the lawful basis for processing, when was consent obtained, how long will it be stored? If that feels heavy, good - it should. It’s no different than asking finance to approve spend.

From there, you need cross-functional muscle. Marketing Ops can’t do this alone. Legal, procurement, data engineering, even sales ops, all need a seat at the table. Call it a “Privacy Ops squad.” Meet weekly. Review new vendors. Decide if that cold outbound campaign meets the bar. And most importantly, give someone authority to hit the red button and pause campaigns when the provenance looks shaky.

Contracts, controls, and kill switches

On the vendor side, stop signing contracts that don’t give you leverage. Push for provenance disclosure: Where did the data come from, how was it collected, when? Push for a right to audit, or at least independent third-party certifications. Push for guaranteed deletion timelines and sub-processor transparency. If a vendor refuses, that tells you everything you need to know.

On the technical side, don’t rely on spreadsheets and hope. Build a central consent store that syncs across your MAP, CRM, and ad platforms. Automate suppression so opt-outs don’t slip through. Attach provenance metadata to every record, not buried in a notes field, but as structured data you can report on. Set retention rules so stale data gets purged automatically instead of living in forgotten campaigns. These aren’t fancy MarTech tricks; They’re table stakes.

Measuring what matters

The only way to get leadership on board is to show the numbers. Stop relying on attribution reports that flatter purchased lists. Instead, measure incrementality, what happens when you run a campaign with the data versus a holdout without it. If the lift is negligible, you have proof that “growth” via shady data isn’t worth the risk.

Also, build dashboards that tie provenance to outcomes: This vendor’s contacts turned into SQLs, this one didn’t. That’s how you argue for renewals, not with open rates or impressions.

Dealing with DSARs

Here’s where theory hits practice. When someone asks to see or delete their data, you need documentation.

Intake the request.

Find every system where that person lives.

Pull the provenance trail.

Reply within the legal window.

Log everything for audit.

Then purge the records with proof.

If you can’t do that, you’re not compliant - full stop.

And you don’t want to be figuring it out for the first time when legal is already breathing down your neck.

The 30/60/90 reality check

Within 30 days, you can stop ingesting lists without provenance and run a DSAR drill. Within 60, you can audit your top vendors and enforce provenance fields in your campaign process.

Within 90, you can have suppression and retention jobs automated.

This isn’t abstract, it’s achievable if you prioritise it.

The leadership conversation

Of course, you’ll get pushback. “We can’t slow lead gen.” “These vendors are compliant, they told us so.” “Nobody complains about B2B emails.” When that happens, you need crisp answers. One bad list can create legal fallout that dwarfs the pipeline it generated.

Compliance claims without paperwork are worthless. And DSARs might be rare, but it only takes one high-profile complaint to become a firestorm.

Final word

Privacy isn’t a blocker to growth; It’s the foundation of growth you can scale without fear. Regulators are watching, vendors won’t protect you, and the operational cost of doing nothing is far higher than the cost of building real controls.

Marketing Ops doesn’t just enable campaigns, it protects the business. And the time to fix this isn’t when you’re under investigation; It’s now.