# What Is Intent Data? A Founder's Guide to First-Party Website Behavior > Intent data signals when a buyer is researching. Learn what intent data is, the first-party vs third-party split, and how to act on it in time. - **Author**: Caius Hayes - **Published**: 2026-08-07 - **Category**: Marketing - **URL**: https://heyzinc.com/blog/what-is-intent-data --- ```tldr Intent data is any signal that a visitor is researching or ready to act. For a small team, the layer that actually compounds is first-party website behavior -- captured on your own domain, consented, and current enough to act on while the visitor is still there. The value is not in collecting the signal; it is in connecting it to a conversation before the moment closes. Keep intent (what they do) separate from identity (who they are) and attribution (where they came from). ``` "Know which buyers are ready to buy, before they fill out a form." That promise is why intent data became a category. It is also where most of the confusion starts, because vendors use the same words for very different things. Some mean "we watched which companies read articles across the web." Others mean "we noticed someone is on your pricing page right now." Those are not the same signal, and they are not equally useful to a small team that has to respond personally. So let's define it plainly. Intent data is information that suggests a person or account is actively researching a solution. Bombora, one of the larger providers in this space, defines it as signals that tell you when buyers are researching online, and which products they are interested in, based on the web content they consume. That is a reasonable, primary-source definition. What it does not say -- and what the marketing copy often implies -- is that the signal tells you exactly who is ready, or that acting on it guarantees a sale. It does neither on its own. Here is the version that matters for a founder-led team. ## First-party and third-party intent data, in one pass Intent data splits into two sources, and the distinction is not academic. **First-party intent data** is what you collect on your own ground: behavior on your website and app, data in your CRM, form submissions, the results of your social efforts, and offline inputs like surveys. You own it, you know how it was collected, and you can act on it in the same session it was created. **Third-party intent data** is collected from outside sources. Bombora describes the common methods: a cooperative of publishers and websites sharing behavioral data, bidstream data passed during programmatic ad bidding, and behavioral data from a publisher's owned network of sites. Providers in this category -- Bombora, G2, ZoomInfo, 6sense, and others -- aggregate content-consumption signals across many B2B sites and tell you which accounts appear to be researching a topic. Both have a place. Third-party intent is useful when you are running account-based marketing at a scale where you need to prioritize a long list of target companies, and where you can afford to act on an account-level signal days or weeks later. First-party intent is useful when the question is "who is on my site right now, and should I talk to them." For a team where the founder is the one answering, the difference is decisive. Third-party intent tells you an account is *somewhere* in research mode. First-party intent tells you a visitor is *on your pricing page right now*. One of those you can act on in the next thirty seconds. The other becomes a CRM task. The durability gap matters too. Third-party intent has historically leaned on cross-site tracking -- third-party cookies, bidstream identifiers, shared IDs. That surface is shrinking. Safari blocks third-party cookies by default through Intelligent Tracking Prevention, Firefox does the same through Enhanced Tracking Protection, and Chrome has been moving to restrict them through its Privacy Sandbox initiative, as [MDN's guide to third-party cookies](https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Third-party_cookies) documents. `SameSite=Lax` is now the browser default, which limits cross-site cookie sending without an explicit opt-in. The result is not that third-party data is dead; it is that a small team betting its response workflow on cross-site tracking is betting against the direction every major browser has taken. First-party behavior on your own domain, under your own notice, is the layer that keeps working. ## What behavioral intent actually looks like "Intent" becomes useful only when you can name the specific actions that count. On a first-party website, the honest intent signals are behavioral, and they are all probabilistic. - **Which page, and in what order.** A visitor who hits the homepage and leaves is one signal. A visitor who goes pricing, then product, then back to pricing is comparing and evaluating. The page flow tells you what question they are trying to answer. - **Depth on buying pages.** Someone who spends forty seconds on pricing is skimming. Someone still there after several minutes, scrolling and returning to the same section, is reading carefully. Time on page is an approximation -- background tabs and idle sessions inflate it -- so treat it as a hint, not a measurement. - **Repeat visits.** A returning visitor is stronger than a first-time one, but only if you can recognize the return. Recognition depends on a stable identifier surviving between sessions: a first-party cookie, a tracked-link token, or an authenticated session. Under modern browser protections, that recognition is probabilistic rather than certain. - **Referral source.** Where they came from shapes the opening message. A visitor who arrived from a community thread where you answered a question is a different conversation than one who typed in your URL. The catch is that the web's default referrer policy trims cross-origin referrers to the origin, so "referral source" is often origin-level at best and `direct` is common even when the visit really came from a DM or a private message. - **Form starts and abandons.** A form someone started but did not submit is one of the highest-intent signals you will see, because they got close enough to engage and then stopped. That stop usually has a reason. The point of [the metrics worth monitoring in real time](https://heyzinc.com/blog/real-time-visitor-tracking) is not to collect more data. It is to change a decision. A signal is worth watching only if it changes whether, when, or how you respond. Google Analytics itself recommends [defining your important business actions as key events](https://support.google.com/analytics/answer/12966437) and distinguishing a completed action from a mere scroll -- because if your dashboard counts every interaction as intent, the numbers stop meaning anything. ## Intent is not identity (and attribution is a third thing) This is the distinction most vendor copy blurs, and it is the one that causes the worst decisions. **Behavioral intent** is what the visitor is doing: the pages, the depth, the repeats, the form starts. That is what this article is about. **Identity** is who the visitor is. You only get it when they tell you -- a form, a login, a chat where they type their details, or a tracked link whose record carries identity server-side. Until then, they are a session, not a name. Reverse-IP "company identification" returns a candidate account at best, and for residential, mobile, and VPN traffic it returns an ISP. That is a prioritization hint, not identity. If you want the deeper map of [how to identify website visitors](https://heyzinc.com/blog/identify-website-visitors) and where each method hits its ceiling, that is a separate question from intent. **Attribution context** is where the visit came from. It is neither intent nor identity, and it is the one most often lost. The referrer is trimmed by default; a visit that really came from a community reply or a private message lands in "direct." The durable fix is a [tracked link](https://heyzinc.com/blog/tracked-links-versus-utm-parameters): a first-party token that preserves the source conversation, so you can acknowledge where the visit originated without pretending to know more than the context proves. Keep the three separate in your head, and the vendor claims get easier to read. "We know who is ready to buy" collapses intent, identity, and attribution into one promise. The honest version is three separate questions: what are they doing, who are they, and where did they come from. ## The honest limits Before the product section, the ceilings. The legal one is not a footnote. In the EU, GDPR treats online identifiers -- including IP addresses and cookie identifiers -- as personal data, as [Recital 30](https://gdpr-info.eu/recitals/no-30/) makes explicit. Processing them, including reverse lookup, requires a lawful basis, and non-essential cookies require consent. In California, the CCPA (as amended by the CPRA) treats IP addresses and internet browsing history as personal information, and consumers have opt-out rights including Global Privacy Control, as the [California Attorney General's CCPA overview](https://www.oag.ca.gov/privacy/ccpa) sets out. The signals that power intent data are regulated personal data in major markets. This is practical orientation, not legal advice; for anything specific, talk to counsel. The technical ceiling is that intent is probabilistic. A visitor lingering on pricing is *probably* evaluating. They might also be a competitor, a job applicant, or someone who left a tab open. Treating every intent signal as a confirmed buyer leads to awkward outreach. Treat it as a reason to make yourself available, not as a verdict. And the scope ceiling: real-time intent visibility is a *precondition* for timely engagement, not a result. Seeing the signal does not raise conversion by itself. If you monitor everything and never act, the dashboard is just a more expensive version of the report you already had. ## From detect to conversation This is where intent data becomes useful, or stays decorative. The workflow that makes first-party intent pay off is short: detect a behavioral signal, start a relevant conversation, alert the team once the visitor actually replies, and let a human take over. That is the gap HeyZinc is built for. It detects behavior-based intent -- the kind of signals above, on your own site -- and can automatically start a conversation with a high-intent visitor rather than waiting for them to raise their hand. Once the visitor replies, the team is alerted, including through companion and mobile notifications, so a founder who is not staring at a dashboard can still respond while the lead is warm. A teammate can then continue by text or a live call inside the browser, and [proactive outreach for website visitors](https://heyzinc.com/blog/proactive-outreach) is the deeper walkthrough of that messaging, calling, and meeting flow. A few honest qualifications, because they change how you should read the previous paragraph. Alert delivery -- including mobile -- depends on your workspace's notification configuration and the device, so treat mobile alerts as a configured workflow rather than a universal guarantee. Intent detection and the higher-tier analytics surfaces are tied to plan and setup; not every workspace has every surface on day one. And none of this is a promise that seeing intent automatically wins customers. It is a capability that makes timely engagement possible, and [response time is a real bottleneck](https://heyzinc.com/blog/why-your-website-traffic-is-not-turning-into-customers) -- but only one of several. If your problem is message match or trust, faster responses alone will not fix it. The connection worth making is between the signal and the conversation. A live visitor on pricing for the third time this week is a better opening for a real chat than a row in next month's report. Tracked links carry the source context forward, so the engagement can acknowledge where the visit came from -- "I saw you came over from that thread" -- without inventing details the data does not support. ## What to actually do with intent data If you take one thing from this: stop trying to collect every intent signal, and start defining the two or three that should change a response. Pick the signals that map to your actual motion -- usually active-now on a high-intent page, repeat visits, and a form start that did not submit. Decide what each one should trigger. Ignore the rest until you have a reason to watch it. A dashboard full of real-time intent you never act on is worse than a smaller one you use. Then make sure you have a way to act in the window that matters. Intent data is only worth what you do with it in the few minutes it stays fresh. If you want to see [how HeyZinc turns first-party website behavior into timely engagement](https://heyzinc.com), that is the part most analytics tools do not solve -- and it is the part that turns "we had intent" into "we had the conversation." --- - [More Marketing articles](https://heyzinc.com/blog/category/marketing) - [All articles](https://heyzinc.com/blog)