Finding B2B Leads: LinkedIn and Alternatives

B2B leads come from five sources: professional networks, public directories and registers, industry portals, public tender notices and your own visibility. At the most obvious candidate, the professional network, the shortcut that every second tool promises does not exist: automated scraping of profiles and data is forbidden by LinkedIn's own terms of use, and the same goes for XING. It stays a research surface for humans, it does not become a data source for scripts. Public registers are open to anyone by law, but the German Commercial Code allows inspection expressly "durch einzelne Abrufe", through individual retrievals, which is precisely not a bulk download. The difference between a list and a lead is not volume anyway, it is two things: a reliable contact address you did not guess, and a nameable trigger for why this particular business would listen right now. And every list you build is processing of personal data as soon as a person behind it is identifiable.

I run my business as a solo freelancer and handed the groundwork of finding clients to an AI employee: Olaf screens towns for businesses with outdated websites and puts a rated list in front of me, the outreach is mine. This post is about the finding. The overview of the five routes to new clients is in Finding New Clients as a Freelancer.

The five sources at a glance

None of these sources hands you a finished lead. Each delivers a part, and the part that is missing most often is not the company, it is the trigger.

Professional networks: what the terms actually say

This is where most tool lists go quiet. LinkedIn's User Agreement lists among the prohibited actions that you must not

"Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services"

and equally must not

"Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages, create, comment on, like, share, or re-share posts, or otherwise drive inauthentic engagement"

That version has been effective since 3 November 2025. LinkedIn's own help page on prohibited software names the consequence too: accounts can be restricted or shut down, and the tools in question may stop working without notice.

XING says the same thing more briefly. Section 4.2(a) of its general terms, as of 19 June 2026, prohibits the

"Verwendung von Mechanismen, Software oder Scripts in Verbindung mit der Nutzung der XING Websites. Die direkte oder indirekte Bewerbung oder Verbreitung solcher Mechanismen, Software oder Scripts ist ebenfalls untersagt. Der Nutzer darf jedoch von der New Work SE autorisierte Schnittstellen oder Software nutzen, bewerben oder verbreiten"

In plain terms: mechanisms, software or scripts used in connection with the XING sites are forbidden, as is promoting or distributing them, while interfaces or software authorised by New Work SE remain allowed. Section 4.1(c) additionally forbids "unzumutbare Belästigungen anderer Nutzer, insbesondere durch Spam", unreasonable harassment of other users, in particular by spam, with a reference to section 7 UWG in the text itself.

Three things follow from that, whatever a vendor's sales page promises. First, a tool that pulls profile data into a spreadsheet breaches the terms, browser extension or not, because extensions are named word for word. Second, what gets restricted is your account, not the tool, and with it goes your access to the contacts you are there for. Third, both networks name the permitted route themselves: their own authorised interfaces. Reading, and approaching someone because you read about them there, is allowed. Harvesting the surface is not.

For the German-speaking market there is one more shift: XING has been rebuilding itself into a jobs network since 2023, and since July 2024 large parts are accessible without an account. As a research source on roles and employers, stronger; as a sales channel, weaker.

Public registers: open by law, but one at a time

The commercial register is the most underrated source in B2B: free of charge and legally unambiguous. Section 9(1) of the German Commercial Code reads: "Die Einsichtnahme in das Handelsregister sowie in die zum Handelsregister eingereichten Dokumente ist jedem zu Informationszwecken durch einzelne Abrufe gestattet." Inspection of the register and of the documents filed with it is permitted to anyone for information purposes, through individual retrievals. Two parts of that matter. "Anyone" means no reason and no proof required. "Through individual retrievals" means a blanket bulk download from the register portal is not covered by that permission. Whether an authorised interface exists alongside it, and what you may do with it, follows that service's own access and usage rules, not section 9 HGB.

More interesting than the extract itself are the register announcements. Under section 10 of the Commercial Code, entries are published by becoming retrievable through the electronic register portal: a running public stream of new registrations, changes of seat, changes in representation, renamings. Every notice is a trigger with a date, officially published and therefore evidenceable. What the register does not give you: an email address, a contact person, a demand signal. It tells you that something changed. Whether that matters to you is your call.

Tenders: the channel almost no tool list mentions

If your clients can be public authorities, municipalities, hospitals or utilities, there is a source where the trigger does not need to be inferred, because it is the document. Germany's federal Bekanntmachungsservice bundles the notices of public contracting authorities from federal, state and municipal level, freely accessible and explicitly with an open-data interface. The scale, as of 19 September 2026: around 1.1 million notices online, 20,383 new ones in the last four weeks, 12,710 active contract notices.

So this is the rare case where an institution does not merely tolerate automated analysis but provides an interface for it. The price is the formal route: you take part in a procurement procedure, you do not write a friendly first email. There is no harder trigger anywhere else.

Industry portals and your own visibility

Industry directories and B2B marketplaces sort businesses by trade and location, often with a contact option. Convenient and weak at the same time: an entry tells you the company exists, not that it has a problem. And every portal has its own terms of use, to be read as carefully as those of the big networks.

Your own visibility is the slowest source and the only one where the first step comes from the client. Someone who finds you through a search and gets in touch brings the trigger along and, depending on your form, the basis for further contact. This is where documented consent can arise in the first place instead of being circumvented. How far it carries depends on what exactly was consented to.

How to spot a business with a trigger

A trigger is something you can see from the outside and evidence. These six are publicly visible and checkable:

1. A change in the register. New registration, new management, new seat, new name. Where: the register announcements, with a date.
2. An open role that matches your topic. A possible demand signal, not proof: the task is evidently on the table. Where: the company's careers page or a job board.
3. A technical state of the website. No encrypted connection, unusable on a phone, no reachable contact option. Where: the site itself.
4. A mismatch between reputation and presence. Excellent public reviews, but no page where anyone could read about it.
5. A step outwards. New location, new product, trade fair appearance. Where: the federal gazette, a press page, an exhibitor list.
6. An ongoing procurement. Where: the tender notice, deadline included.

The test for each of these is the same: can you say in one sentence what you saw and where? If not, it is not a trigger, it is a hunch.

A trigger is a quality marker, though, not a permission. Three checks stay separate: the trigger decides whether the approach makes sense in substance, the GDPR decides the basis for your list, and section 7 UWG decides the route of contact. Even an incoming enquiry only carries the answer to that specific matter, not later marketing automation. On the route of contact, see Automating Cold Outreach: Limits for AI.

Data protection: a lead list is data processing

In B2B one claim persists: business data is not personal data. It is, as soon as a person is identifiable. Article 4(1) GDPR defines personal data as "any information relating to an identified or identifiable natural person", identifiable among other things by a name. That covers the managing director named in the register as much as the sole trader whose business address is her home address.

So anyone building a list is processing data and needs a legal basis. Article 6(1)(f) GDPR names legitimate interests, "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data". Recital 47: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." Not a free pass, but a balancing test in which the reasonable expectations of the data subject count too.

The part that gets overlooked almost every time is the information duty. Because you did not obtain the data from the person themselves, Article 14 GDPR applies: inform about the purpose and the legal basis and, under paragraph 2(f), also about "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources", Paragraph 3 names three points in time for that: "at the latest within one month" after obtaining the data, where the data is used to communicate with the person "at the latest at the time of the first communication", and where disclosure to others is envisaged "at the latest when the personal data are first disclosed". For a lead list that means your first email carries the information at the latest. Paragraph 5 knows exemptions. I am not a lawyer and this is not legal advice, for an individual case the regulation should be read or a lawyer asked.

This is easy to satisfy if your list carries three columns from the start: where the entry came from, when you recorded it, when you informed the person. A bought list can come with a source too; the difference is whether you can evidence origin, basis and trigger yourself per line, and whether the processing was foreseeable for the person. How I handle client data when working with AI in general is in AI and Data Protection: Protecting Client Data.

How Olaf does the groundwork

Olaf is my AI employee for the part that eats time: not the writing, but the finding and the sorting out. I give him a town and a trade, he returns a rated list, every entry with a reason, evidence and a rating of A, B or C. His toolchain: location research through the Google Places API, a technical quick check per website, screenshots of the site, because he only judges a design once he has looked at the picture.

He works exclusively with publicly accessible sources, and one rule separates him from any bought list: without a reliable contact address from the imprint or the contact page there is no lead, only a C. Addresses are never guessed. Companies with no website at all are not leads, because the comparison material is missing. And he contacts nobody. He finds, I approach. How hard that filters shows in my own lead runs in July 2026: 198 candidates checked across eight assignments. For the location assignments, each with 20 candidates, the rule of thumb holds in large and small towns alike that 20 candidates yield 3 to 5 real leads.

He runs on local service businesses here, and his signal is the technical state of a website. What transfers is not the location but the grid: a public source, fixed criteria, an exclusion rule stricter than the inclusion rule, evidence per line. Anyone rebuilding that grid on their own criteria, on register announcements instead of website technology, will find the framework in AI Employees for Consultants and Agencies, and more roles built the same way in AI Agents: 10 Examples from Practice.

Frequently asked questions

Can I scrape LinkedIn data with a tool?

No. LinkedIn's terms explicitly prohibit software, scripts, robots, crawlers as well as browser plugins and add-ons for scraping or copying the Services, and equally bots for adding or downloading contacts. What gets restricted is your account, not the tool. What stays permitted are the platform's own authorised interfaces; how interfaces, bought databases and scrapers differ is in the tool comparison.

Is business contact data personal data?

Yes, as soon as a natural person is identifiable. Article 4(1) GDPR covers any information relating to an identified or identifiable person, for example by name. A managing director named in the register or a sole trader falls under it. Data with no personal reference at all does not, but in a lead list it rarely stands alone.

Do I need consent to build a B2B lead list?

Not necessarily for building it, since legitimate interest under Article 6(1)(f) GDPR can apply, and Recital 47 names direct marketing explicitly as a possible case. For the advertising approach itself, section 7 UWG applies on top. Not legal advice, in case of doubt the individual case should be checked.

Do I have to inform the people on my list?

As a rule yes. Because the data was not obtained from the person themselves, Article 14 GDPR applies: information about purpose, legal basis and source. The deadline is the earliest of three: within one month of obtaining the data, at the latest with the first communication to the person, at the latest with the first disclosure to others.

Which source is best for B2B leads without LinkedIn?

It depends on who your client is. If public authorities and municipal operations are possible, public tender notices deliver the hardest trigger, because it is written in the document. Otherwise the register announcements are the strongest free source: every notice is a change with a date.

What separates a researched list from a bought one?

With a researched list you can evidence origin, basis and trigger yourself for every line. With a bought one the origin is at best asserted, the processing is harder to foresee for the person, and the trigger is missing entirely. You need both: for the information duty under Article 14 GDPR and for the first sentence that actually gets read.

How to take this further

Do not start with a tool, start with one line. Write down which trigger would be visible from the outside at your ideal client, then look for the source that carries it. A change in the business: register announcements. A stated need: job ads or tenders. A visible condition: the website itself. Only once the source is settled is automation worth asking about, and the answer is then usually not a scraper but a cleanly written checking grid.

How I handed that grid to an AI employee is on the page about Olaf, my lead scout. The template to rebuild on your own criteria is in my community Claude Practitioners.