The Open-Data Frontier of Global B2B Contact Intelligence

Working paper, prepared for peer review. Version 1.0, 2026-06-02.

Abstract

Commercial business-to-business (B2B) "sales intelligence" datasets (ZoomInfo, Apollo, Cognism, Dun & Bradstreet, People Data Labs and others) are built mostly from web crawling, email-signature mining, and opt-in contributory networks. They cover a lot of people, but at the cost of well-documented data-protection exposure. We ask a related question that has not been studied much: how far can you build a legally clean, commercially redistributable global B2B dataset from free and open-data or open-source (OSS) sources alone, attribute by attribute and country by country?

We built a standardised, adversarially-verified audit that scores each jurisdiction against a fixed eight-attribute rubric (company name, national identifier, address, industry code, website, phone, email, representative name). We applied it to coverage that is jurisdiction-complete by construction (enumerated from ISO 3166-1, not UN membership), with deep audits of about 90 economies and a universal identity backstop (GLEIF/LEI) covering all 249 jurisdictions.

The result is consistent across jurisdictions. Company identity and industry classification are broadly free and redistributable. Contact channels (phone, email, website) are almost never in free open data: they are present in only four jurisdictions (Norway, Brazil, Mexico, and partly Denmark and Romania). Representative names, where free, are personal data gated by GDPR-class regimes or, in two cases, by sanctions.

We benchmark these findings against the academic data-fusion and record-linkage literature and against the disclosed sourcing methods of the proprietary vendors. We also measured our own curated "Gold" dataset and found it to be the inverse of the commercial profile: broad global company identity (10.6M entities) but narrow, US-biased, single-source person-level contactability (covering 1.9% of companies).

We close with a per-attribute resale-legality matrix and argue that a legally-grounded global B2B contact dataset is only achievable by pairing an open-registry identity spine with a downstream enrichment layer, not by harvesting registries alone.

Keywords: open government data, business registries, B2B data, firmographics, entity resolution, data fusion, data quality, GDPR, legitimate interest, data redistribution licensing.

1. Introduction

1.1 Motivation

A modern B2B go-to-market motion needs a dataset that maps, for each target company, (a) its identity and firmographics (name, registration number, industry, size, location) and (b) the people you can contact inside it (name, title, work email, phone). The commercial market for this data is large and mature. It is dominated by vendors whose coverage is impressive but whose sourcing methods keep drawing regulatory and litigation attention: opt-in "community" contact-syncing from users' inboxes, email-signature mining, large-scale web scraping, and ML inference of email addresses (Section 5).

There is another source: the official company registers almost every jurisdiction keeps, increasingly published as open government data, plus the Global Legal Entity Identifier system. The question in this paper is whether these open sources can support a legally clean, commercially redistributable global B2B dataset, and, more precisely, for which attributes and which jurisdictions that holds.

The answer is highly structured, and as far as we know it has not been mapped at this level of detail with every claim verified adversarially.

1.2 Contributions

1. A standardised, adversarially-verified audit that scores any jurisdiction on a fixed 8-attribute rubric and emits a directly comparable structured matrix (Section 2).

2. Jurisdiction-complete coverage by construction. We enumerate from ISO 3166-1 (249 codes) rather than the 193 UN members, which closes the usual blind spot around the SARs (Hong Kong, Macau), Taiwan, and the offshore corporate-registry centres (Cayman, BVI, Bermuda, Jersey, Guernsey, Isle of Man, Gibraltar), with a universal identity backstop covering every jurisdiction (Sections 2.3, 3.5).

3. A global, per-attribute findings map for about 90 deep-audited economies (Section 3). The key result is that the open-data frontier depends on the attribute: identity is free almost everywhere, contact is free almost nowhere.

4. Benchmarks against (a) the disclosed sourcing methods and coverage of eight proprietary vendors (Section 5) and (b) the academic record-linkage, truth-discovery and data-quality literature (Section 6).

5. An empirical measurement of a real curated "Gold" dataset (10.6M companies, 1.3M people) showing the inverse-profile phenomenon and the survivorship trap in naive fill-rate reporting (Section 7).

6. A per-attribute resale-legality matrix separating company data, personal data, and sanctions-blocked data (Section 8), and a build/buy/skip recommendation (Section 9).

1.3 Scope and definitions

We treat a jurisdiction as a distinct company-registry boundary (ISO 3166-1 alpha-2). For each attribute we record: present, absent or paid; the best free source and how you reach it (REST API, bulk download, or web-only scrape); authentication and cost; the licence governing commercial reuse and redistribution; and the data-protection regime.

We keep two things separate on purpose: availability (can you get the value for free?) and redistributability (may a commercial product store and resell it?). In practice the two diverge sharply.

2. Method

2.1 The eight-attribute rubric

Every jurisdiction is scored on: company_name, national_id (registration or tax number), address, industry_code, website, phone, email, and representative_name (director or officer). The first four are firmographic identity. The last four are the contactability and accountability layer that decides whether a record is actionable for outreach. Each attribute gets a structured record: {present, bestSource, sourceType, access, auth, freeOrPaid, license, redistributionVerdict, fillRate, confidence, citations}.

2.2 Adversarial-verification harness

Audits come out of a multi-agent research harness. A scoping stage breaks the question into search angles. Parallel web-search agents retrieve candidate sources. Fetch-and-extract agents pull falsifiable claims (each with a direct quote and an attribute tag) from official sources.

Then a three-vote adversarial verification stage tries to refute each claim: a claim survives only with a quorum of valid votes and fewer than two refutations. A synthesis stage merges the surviving claims into the structured matrix.

This favours precision over recall: claims that cannot be backed against primary sources are dropped rather than reported, and "what was NOT found" is recorded explicitly.

2.3 Jurisdiction completeness ("miss none")

Coverage is enumerated from ISO 3166-1 (249 codes) minus an explicit skip-list (Holy See; uninhabited or territorial codes). This avoids, by construction, the common mistake of working from the 193 UN member states, which drops Hong Kong, Macau, Taiwan, the Crown Dependencies and British Overseas Territories, the Dutch Caribbean, US territories, and Kosovo.

A universal identity source (GLEIF/LEI, Section 3.5) supplies at least company identity for every code, and the audit programme records coverage per ISO-2, so any jurisdiction that lacks a bespoke audit is visible rather than silently missing.

2.4 Measurement limitation found in-method (reported for transparency)

The verification harness has a concurrency-correlated failure mode. When many research jobs run at once, the structured-output tool call fails intermittently across a sustained window, and because immediate retries land back in the same window they cannot always recover.

This drops genuine claims below the survival quorum, showing up as a degraded or empty report rather than a false-positive one. We instrumented the harness to surface it (a hardFails counter) and set an operating rule of at most 2 concurrent jobs, under which failures fall to zero.

This is a property of the measurement apparatus, not the sources, and it biases toward under-reporting (a country may have a better source than we credited), never toward false claims. Affected runs were re-run at low concurrency.

2.5 Source-reliability scoring (relation to the platform)

Each surviving claim is tagged with a source-reliability grade and credibility, mirroring the production "truth layer" that feeds these sources into a Bronze-to-Silver-to-Gold pipeline with per-attribute champion-challenger source scoring (Section 6.4). Primary government registries are graded most reliable; commercial aggregators and scrapers least.

3. Global findings

3.1 The headline structure

Across about 90 deep-audited jurisdictions the pattern holds attribute by attribute. Company name is broadly free and redistributable: free in the large majority of registries, and universal via GLEIF. National ID (registration or VAT number) is broadly free too, wherever the registry is open, and GLEIF's registeredAs field cross-references it. Address is mostly free in open registries, though sometimes partial (postcode-region only).

Industry code is often free: NACE, SIC, SSIC, CIIU and SCIAN codes are free in EU, Nordic and LATAM open registries, though absent in several common-law registries.

Website is rare: free only in Norway and Mexico, absent almost everywhere else. Phone is rare: free only in Norway, Brazil, Mexico, Denmark (partial), and Romania-ANAF (partial). Email is very rare: free only in Norway, Brazil and Mexico, with PEC-only in Italy (scrape, restricted).

Representative name is sometimes free but is personal data: free in DE, AR, CZ, GR, TW, SX, MO, RU (sanctioned) and BR, paid in UK, AU, HK and MY, and gated by GDPR-class regimes throughout.

The practical consequence: a company-identity spine is buildable for free almost everywhere; a contactability layer is not. Only a handful of jurisdictions publish the "contactability triple" (phone plus email plus website) in free open data.

3.2 The four open-contactability jurisdictions

Only four jurisdictions publish free contact data, which is why they are worth naming:

Norway, Bronnoysund Enhetsregisteret: a no-auth REST API (data.brreg.no/enhetsregisteret/api) plus nightly JSON/CSV/XLSX bulk, carrying name, org-number, VAT status, address, NACE, and website, phone, mobile and email, under the permissive NLOD 2.0 licence (commercial reuse and redistribution, attribution only).

This is the single most complete free B2B source we found.

Brazil, CNPJ (Receita Federal, via the open minhareceita.org and bulk distributions): carries corporate phone and email plus the quadro de socios (partner and director names) and CNAE industry, free and no-auth.

Mexico, INEGI DENUE: a free REST API (free emailed token) returning name, SCIAN industry, address, and telephone, email and website, under the INEGI "Terminos de Libre Uso" (commercial plus redistribution). The contact fields are sparsely populated but present in the schema; representative names are deliberately excluded (LFPDPPP).

Denmark (partial), CVR (CC-BY 4.0) carries phone. Romania (partial), the free ANAF VAT-validation API returns a corporate phone alongside CAEN.

Everywhere else, contact channels have to be built downstream (Section 9).

3.3 Identity is broadly free, and broadly redistributable in the right places

Openly licensed, commercially-redistributable identity registries include: Singapore ACRA (OGL), Canada Corporations Canada (OGL-Canada), France SIRENE (Licence Ouverte 2.0), Germany via OffeneRegister (CC-BY-4.0, including officer names), Denmark, Sweden and Finland (CC-BY; Sweden fee-free since Feb 2025 under the EU High-Value-Datasets regulation), Norway (NLOD), Poland KRS (CC0, unauthenticated) and REGON (CC-BY), Greece GEMI (ODC-BY, including director names), Argentina (CC-BY, including director names) and Chile (CC-BY), Australia ABR (CC-BY, identity only), Ecuador SRI, and (with caveats) Israel.

The universal backstop, GLEIF, is CC0 (public domain). Industry codes ride along for free in most of these.

3.4 Where the registry is closed, paid, or non-redistributable

A large set of economically significant jurisdictions do not offer a free, redistributable firmographic feed.

Closed or paid registries: Italy (Registro Imprese, OpenCorporates Open Company Data Index 10/100; only OSS validators and a scrape-only PEC email are free), Austria (Firmenbuch, per-extract fees), Indonesia (AHU, PNBP per-profile fee, PAID_ONLY), Hungary (free web but bulk explicitly barred, programmatic access paid), Malaysia (SSM directors paid).

Free to view but non-redistributable, where the licence is the binding constraint: Nigeria CAC (the Terms of Use explicitly forbid resale or redistribution), South Africa CIPC (2014 T&C re-use restrictions; OCDI 20/100), Jersey (forbids reselling registry data), and the offshore centres generally (Section 3.6).

The United States has no federal company registry: SEC EDGAR (an excellent free JSON API) covers only SEC filers, state registries vary widely, and Delaware, the dominant incorporation state, is web-form-only and prohibits data mining.

Identity-open but contact or owner behind a paywall: the Netherlands KVK (the free open dataset is deliberately anonymised to SBI plus 2-digit postcode; name, address and website require the paid KVK API), Hong Kong (free name, BRN and address; director names paid via ICRIS), and Australia (ASIC officer and industry data paid).

3.5 The universal identity backstop (GLEIF/LEI)

GLEIF publishes Legal Entity Identifier reference data for about 3.3M entities across all ISO-3166 jurisdictions, free, no-auth, CC0, via both a searchable REST API and a 3-times-daily bulk "Golden Copy." It carries legal name, address, the national registry identifier (registeredAs, which cross-references the per-country registries), legal form and status. It carries no website, phone, email, industry, or director name.

GLEIF therefore covers identity in every jurisdiction: even where a national registry is closed, paid, or (for territories) overlooked, company identity stays reachable and redistributable.

We verified this directly for the offshore centres. A live query returned 46,122 Cayman Islands entities, confirming that "miss none" for identity is mechanically satisfied.

3.6 The UN-193 blind spot and the offshore centres

Working from UN membership would have dropped jurisdictions that matter out of proportion for B2B because of holding-company and SPV density. We audited them explicitly.

Hong Kong and Taiwan are useful free identity sources (Taiwan's GCIS OData API even carries representative name plus industry; both are gated, IP-whitelist or custom licence, hence BUILD-GATED).

The offshore corporate-registry centres (Cayman, BVI, Bermuda, Jersey, Guernsey, Isle of Man, Gibraltar) are uniformly restricted or paid, with no free, programmatic, redistributable feed; beneficial-ownership registers are non-public everywhere except Gibraltar. For these, GLEIF identity is the practical coverage and a bespoke connector is not worth building.

Macau and Sint Maarten expose director names in free search (constrained by PDPA or local DP). Greenland has no separate register (it folds into Denmark's CVR). Kosovo and Puerto Rico offer free interactive search but no open dataset.

3.7 Sanctions as a distinct gate

Russia's EGRUL is open and free, including director names, and Belarus is similar, yet both are sanctions-blocked: commercial ingestion or resale by a Western product implicates OFAC and EU restrictive measures, and Russian Decrees 400/729 (2022) deliberately degrade the registry data of sanctioned entities.

So for these jurisdictions we treat "open and free" and "usable" as separate things. Relatedly, the widely-used OpenSanctions aggregation mirrors (including a 52M-entity Russian EGRUL dump) are licensed CC-BY-NC, not commercially usable: even transparency-oriented aggregations are often non-commercial.

4. Attribute deep-dives

Company name and national identifier. The "spine" attributes. Free in the large majority of audited registries and universal via GLEIF. The national identifier (CRN, VAT, UEN, CUIT, CNPJ, SIREN, BIN, and so on) is the natural join key, and GLEIF's registeredAs field links the LEI to it, which lets you resolve across sources.

Redistributability follows the licence (Section 8), but for company identity it is permissive across the open-registry set (CC0, CC-BY, OGL, NLOD, Licence-Ouverte).

Address. Free in most open registries, though sometimes cut back for privacy or competition reasons: the Netherlands' free open dataset gives only a 2-digit postcode region (the full address is paid); Australia's ABR gives state plus postcode only. Where present it is the registered or official address, not necessarily the trading address.

Industry code. Free wherever the registry is open, under national taxonomies (NACE and its derivatives in the EU/EEA; SSIC in Singapore; CIIU in Ecuador and Colombia; SCIAN and SIC in Mexico; SNI in Sweden; CNAE in Brazil and Romania; PKD in Poland; KBLI in Indonesia as a taxonomy only).

Notably absent from several common-law identity registries (UK Companies House core profile, Australia ABR free tier, Hong Kong CR, US state registers, Canada federal bulk), which carry legal form but not an activity code.

Website. The rarest firmographic. Free only in Norway (hjemmeside) and Mexico DENUE (Sitio_internet). Absent from essentially every other free registry, since it is not a field most registrars collect.

This is a main reason enrichment is needed, because the company domain is the keystone for deriving work emails.

Phone and email. Free, as corporate contact points, only in Norway, Brazil CNPJ, and Mexico DENUE. Denmark CVR carries phone. Romania's ANAF API returns a corporate phone. Italy exposes only certified PEC email via INI-PEC (scrape-only, GDPR-restricted). Everywhere else these fields are not in the registry schema. Where a phone or email is tied to a named individual it becomes personal data (Section 8).

Representative or director name. The highest-value accountability attribute and the most legally fraught, because it is always personal data. Free in: Germany (OffeneRegister, CC-BY, officer names), Argentina (IGJ Autoridades, CC-BY), Czechia (ARES VR), Greece (GEMI OpenData), Taiwan (GCIS), Sint Maarten, Macau, Brazil (QSA), and Russia (EGRUL, sanctions-blocked).

Paid in the UK (Companies House officers behind the OGL's personal-data exclusion plus LIA requirement), Australia (ASIC), Hong Kong (ICRIS), Malaysia (SSM). Anonymised for privacy in Poland's open KRS API (initials plus first PESEL digit). Subject to GDPR-class regimes throughout (Section 8).

OSS tooling observed. Beyond raw HTTP and bulk ingestion, the audits surfaced reusable open-source components: python-stdnum and python-codicefiscale (offline validators for VAT and fiscal codes, including Italian Partita IVA and Codice Fiscale), CKAN and Socrata clients for the many data.gov.* portals (Singapore, Israel, Ecuador, Colombia, Thailand, Argentina), and numerous national-registry client wrappers (Norway brreg, Denmark cvrapi.dk clients, Czech ARES).

No OSS tool substitutes for a missing field; they accelerate ingestion of fields the source already exposes.

5. Benchmark: how proprietary B2B datasets are sourced (and at what coverage)

The disclosed methods converge on a multi-source model: ML-driven web crawling of company domains, filings, news and job-postings for firmographics; contributory networks that harvest contact data from consenting users' inboxes (email headers, signature blocks, address books); licensed third-party feeds; manual research; and ML inference of email patterns.

The vendor picture, as disclosed. ZoomInfo sources from a contributory network (its Community Edition mines email signatures, headers and contact books of consenting users) plus a daily ML crawl of 28M+ domains plus licensed partners and in-house research, with a disclosed scale of about 100M+ contacts and a high (vendor-asserted, not independently audited) accuracy claim; its GDPR posture rests on legitimate interest (Art. 6(1)(f)), and it settled a US right-of-publicity class action (Ramos/Martinez) for $29.55M (CA/IL/IN/NV) without admitting wrongdoing, with separate email-scraping litigation (Wysocki).

Cognism sources from community, public, ML and partnerships, with "Diamond Data" being human- or phone-verified mobiles, at about 440M records, claiming 85% accuracy generally and 98% on the roughly 10M phone-verified Diamond subset (about 2.3% of the DB), under Art. 6(1)(f) plus an Art. 14 notified-database model plus DNC screening across 13+ jurisdictions.

People Data Labs takes an aggregator and licensing posture, LinkedIn-heavy, at about 2.46B person records (marketed as 3B+), with low actionable fill (work email about 3.8%, mobile about 20.2% against the full base, degraded outside NA and W-Europe), and is reseller-dependent.

Dun & Bradstreet does global firmographic compilation plus DUNS numbering plus partnerships, covering hundreds of millions of companies, firmographic-oriented and long-established, with a compliance-oriented B2B framing. Clearbit (HubSpot Breeze) does web crawl plus logo and domain enrichment, domain-keyed, firmographic and technographic, under vendor terms.

Lusha and others use contributory and crowdsourced contact, at tens to hundreds of millions of records, vendor-asserted, with EU exposure that varies.

Two findings matter for our comparison. First, headline "billions of records" mask low actionable fill rates per attribute (PDL's 3.8% work-email figure is illustrative): coverage and usable contactability are very different quantities.

Second, the broad person coverage comes precisely from the contributory and scraping methods that carry the documented legal exposure, exactly the exposure an open-data strategy is trying to avoid. All accuracy figures here are vendor-asserted and not independently audited, and should be read that way.

6. Benchmark: the academic literature

6.1 Entity resolution / record linkage

The arc runs from the Fellegi-Sunter probabilistic record-linkage model, through Magellan (Konda et al., PVLDB 9(12), 2016, which reframes entity matching as a whole-pipeline systems problem with a development stage on samples and a production stage at scale, the architectural template for a Silver-to-Gold materialiser), DeepMatcher (Mudgal et al., SIGMOD 2018, which shows deep learning does not beat learning-based matching on structured EM but wins materially on textual and dirty EM), to Ditto (Li et al., PVLDB 14(1), 2020/21, which fine-tunes pre-trained transformers as sequence-pair classification, +29-31% F1 over prior SOTA and 96.5% F1 on a real 789K x 412K company-matching task).

The WDC Products benchmark (Peeters et al., EDBT 2024) shows that all state-of-the-art matchers degrade on unseen entities, which matters directly for a champion-challenger leaderboard, because matcher and source scores measured on seen records do not transfer to the long tail.

6.2 Truth discovery / data fusion

TruthFinder (Yin, Han & Yu, KDD 2007) jointly estimates source trustworthiness and fact confidence by mutual reinforcement, reaching about 95% accuracy versus about 88-95% for majority voting on a book-author benchmark. Crucially, Dong, Berti-Equille & Srivastava (PVLDB 2009) prove that source copying is widespread and that naive majority voting is actively harmful when sources copy, with copy- and quality-aware fusion lifting precision (about.71 to.89).

That is the formal justification for our per-attribute champion-challenger design, which discounts correlated or copied sources rather than treating each as an independent vote.

The Latent Truth Model (Zhao et al., PVLDB 2012) adds two-sided source quality (sensitivity plus specificity) and multi-valued attributes; Knowledge Vault (Dong et al., KDD 2014) is the canonical learned knowledge-fusion formulation, producing calibrated per-fact probabilities.

6.3 Data-quality dimensions and their measurement

[Integrates the dedicated data-quality-frameworks research pass: Wang & Strong (1996) 4-category/15-dimension framework; Pipino, Lee & Wang (2002) objective versus subjective assessment and functional forms; Batini et al. (2009, ACM CSUR) methodologies; ISO 8000 and DAMA-DMBOK, with the canonical definitions and measurement formulas for completeness (fill rate per attribute), accuracy, consistency, timeliness/currency (as a function of age versus volatility) and uniqueness, mapped to company and contact data. To be completed on return of the dedicated research run; see Section 7 for the empirical application of these definitions to our Gold dataset.]

6.4 Open vs commercial business-registry quality

[Integrates the OpenCorporates Open Company Data Index (0-100 scoring of machine-readability, bulk availability, open licence and field granularity; e.g. Italy 10/100, South Africa 20/100 as observed in our audits) and the open-government-data-for-corporate-transparency literature. To be completed on return of the dedicated research run.]

6.5 Mapping to a Bronze-to-Silver-to-Gold truth layer

The literature maps cleanly onto the production architecture. Bronze is the raw per-source records (the connectors of Section 3). Entity resolution (6.1) links Bronze records across sources into entities. Truth discovery and fusion (6.2) selects the best value per attribute while estimating per-source reliability, instantiated as a champion-challenger leaderboard that, per Dong et al., must discount copying.

Silver is the fused canonical entity with calibrated confidence. Gold is the materialised, attributed record. Data-quality dimensions (6.3) become the objective gates (completeness/fill, freshness, uniqueness) that govern promotion between layers.

7. Our curated "Gold" dataset vs the paid datasets: an empirical measurement

We measured a production Gold layer with read-only queries (no sampling, no mocks). The result is the inverse of the commercial profile, and it contains a measurement trap.

Company layer (gold_company, 10,620,248 rows): broadly global (United States only about 11%; Brazil, France, Indonesia, Netherlands, Australia, Turkey, Germany, Russia, Singapore, India, Canada and Thailand each above 100k) but contact-sparse: website 21.4%, domain 22.6%, industry 33.1%, revenue band 23.6%; industry embeddings backfilled to 84.8%.

This is the realistic signature of an open-registry-sourced identity layer (see Section 3.3).

Person layer (gold_person, 1,300,233 rows): the naive headline is "100% email, 100% phone, 100% LinkedIn, 100% title," which would be a survivorship artifact, not a quality result, and we explicitly do not report it as quality. The verified facts:

The person layer covers only 200,982 distinct companies, or 1.9% of the 10.62M company population; 98.1% of companies have zero contactable person. This is the true coverage gap.

It is 76.8% United States (versus about 11% at the company layer, so about 7x more US-concentrated), and 99.98% single-source (one upstream truth-layer/GraphIQ origin).

email_quality_score is NULL for all 1.3M rows: the quality scorer never ran, so the "99.7% validated" flag is a coarse boolean and email quality is, in fact, unmeasured. We flag this as a quality-instrumentation gap, not a quality result.

Interpretation. Paid datasets achieve broad person coverage (hundreds of millions to billions of records) via contributory and scraping methods, at partial per-attribute fill and with documented legal exposure.

Our dataset is the inverse: broad, global, redistributable company identity but narrow, US-biased, single-source, unscored person-level contactability.

Neither registry harvesting (which yields identity, not contact, almost everywhere, Section 3) nor the existing single-source person feed produces broad, legal, global contactability on its own.

8. Per-attribute resale-legality matrix

Combining the per-source licences (Section 3) with the data-protection regimes, the right to resell a curated record depends on the attribute and on the legal basis.

Company identity and firmographics (name, reg/VAT number, address, industry, legal form), for example GLEIF (CC0), NO/DK/SE/FI, SG, CA, FR, PL, GR, AR, CL, EC, AU-ABR and DE-company: redistributable where the source licence permits (CC0, CC-BY, OGL, NLOD, Licence-Ouverte, ODC-BY). Attribution required for CC-BY, OGL and NLOD. Not personal data.

Company contact channels (corporate phone, email, website), for example NO, BR, MX, DK (phone) and RO-ANAF (phone): redistributable under the same open licences as corporate data; but a phone or email tied to a named individual (sole trader, named director) is personal data and shifts to the row below.

Representative or director name and personal contact, for example DE, AR, CZ, GR, TW, BR-QSA, UK (paid) and HK (paid): personal data under a GDPR-class regime. Redistribution for B2B outreach requires a documented legitimate-interest basis plus LIA (UK GDPR Art. 6(1)(f); EU GDPR; LGPD; PDPA; PIPL).

The source's open licence does not grant a personal-data basis (explicit for the UK OGL, which excludes personal data).

Explicitly resale-prohibited, for example Nigeria CAC (ToS forbids resale/redistribution), Jersey (no reselling registry data) and South Africa CIPC (2014 re-use restrictions): not redistributable, regardless of free availability. Free to view does not mean free to resell.

Right-to-object or use-restricted personal data, for example Macau (Act 8/2005, statutory right to object to direct marketing plus pre-disclosure): redistributable only with the marketing-objection right honoured; it constrains outreach use specifically.

ShareAlike or non-commercial, for example Colombia RUES via datos.gov.co (CC BY-SA copyleft, may conflict with proprietary resale) and OpenSanctions mirrors (CC-BY-NC, non-commercial only): copyleft requires same-licence redistribution (incompatible with a closed product without legal review); NC bars commercial resale entirely.

Sanctions-blocked, for example Russia EGRUL and Belarus EGR: not usable by a Western product regardless of openness (OFAC and EU restrictive measures).

Operating rule. Build the resale product on the company-identity and firmographics row (clean and broad) and the corporate-contact row (clean where it exists). Treat representative names and personal contact as a separately-gated layer requiring a per-jurisdiction legitimate-interest assessment.

And exclude the prohibited, NC-only, and sanctions-blocked sources from the redistributable corpus (they may still inform internal resolution but not resale).

9. Recommendations (build / buy / skip)

1. Adopt GLEIF as the universal identity spine (CC0, all 249 jurisdictions). It guarantees redistributable company identity everywhere and supplies the registeredAs join key.

2. Build free connectors to the roughly 20-25 fully open national registries for richer identity and industry (NO, DK, SE, FI, SG, CA, FR, DE, PL, CZ, GR, AR, CL, EC, AU, and the contactability-rich BR and MX). Prioritise the four contactability-rich sources (Norway, Brazil, Mexico, plus Denmark/Romania phone): they are the only places contact comes free.

3. Do not try to source contact from registries globally. It is absent almost everywhere (Section 3.1).

Broad, legal, global contactability has to be built by a downstream enrichment layer off the identity spine (company domain to work-email pattern; OSINT for verification), governed by per-jurisdiction legitimate-interest assessments.

4. Skip or exclude from resale: offshore-centre registries (restricted or paid; GLEIF identity suffices), explicitly resale-prohibited registries (Nigeria, Jersey, SA-CIPC), NC and ShareAlike aggregations (OpenSanctions, Colombia without review), and sanctions-blocked jurisdictions (Russia, Belarus).

5. Buy commercial contact data only where (a) it is unavoidable for a priority market and (b) the vendor's legal basis is defensible (for example Cognism's notified-database plus DNC model), and treat all vendor accuracy claims as un-audited.

6. Close the instrumentation gap surfaced in Section 7: run the email-quality scorer so contactability is measured, not assumed, and report per-attribute fill against the genuine company-population denominator (not the survivorship-filtered person base).

10. Limitations and threats to validity

Measurement apparatus (under-reporting bias). The harness's concurrency-correlated failure (Section 2.4) and the regional-batch claim-budget dilution (a 25-claim budget shared across 10 countries starves the less-documented ones) both bias toward under-crediting sources.

We mitigated with low concurrency, smaller batches and higher claim budgets, and re-ran affected jurisdictions. The residual risk is that a given country has a better free source than we credited, never that we asserted a false one (adversarial verification plus "what was NOT found" recording).

Long-tail coverage. About 90 economies were deep-audited; the rest (micro-states, several Sub-Saharan and Central-Asian states) are covered by GLEIF identity plus the regional pattern, marked as such per ISO-2 so the depth of coverage is transparent. This is appropriate for the economically material set but is not a bespoke audit of all 249.

Vendor claims. All proprietary coverage and accuracy figures (Section 5) are vendor-asserted and not independently audited.

Single-platform Gold snapshot. Section 7 measures one production platform at one time. The structure (broad identity, narrow US-biased contact) is the generalisable finding, not the exact percentages.

Licence interpretation is not legal advice. The redistribution verdicts (Section 8) synthesise published licence text and DP regimes; a production resale posture requires jurisdiction-specific legal sign-off, especially for personal data and the ShareAlike and NC edge cases.

11. Appendix A: ISO-2 coverage ledger

Coverage by jurisdiction (D = deep per-jurisdiction audit; C = production connector built; R = regional-batch audit; G = GLEIF-identity backstop only; verdict where established). The denominator is ISO 3166-1 minus the explicit skip-list; every code not marked D/C/R is G (identity guaranteed, no bespoke audit), making any gap visible by construction.

North America: US (D, MIXED), CA (C, BUILD-FREE identity, OGL), MX (D/C, BUILD-FREE contact-rich), territories PR/GL to DK (T3). Western/Northern Europe: NO (R, BUILD-FREE, contact triple), DK (R, BUILD-FREE plus phone, covers GL), SE (R, BUILD-FREE), FI (R, BUILD-FREE), IE (R, gated), CH (R, BUILD-GATED), BE (R, gated), AT (R, PAID), PT (R, SKIP firmographics), LU (R, licensing-strong/unconfirmed), DE (C, officers CC-BY), FR (C, Licence Ouverte), NL (D, gated), IT (D, paid/closed), ES (D, gated). Central/Eastern Europe: PL (R, BUILD-FREE CC0), CZ (R, BUILD-FREE), GR (R, BUILD-FREE ODC-BY), HU (R, PAID-automation), RO (R, BUILD-GATED plus phone), UA (R, gated, wartime), RU (R, SANCTIONS-BLOCKED), BY (R, SANCTIONS-BLOCKED). LATAM: BR (C, contact-rich), AR (R, BUILD-FREE plus directors), CL (R, BUILD-FREE), CO (C, CC-BY-SA gated), EC (C, BUILD-FREE), PE (C, gated), VE (R, SKIP), DO (R, gated), PA/CR (R, unconfirmed to G). APAC: JP (C), KR (C), SG (C, OGL), IN (C, GODL company-only), AU (D, ABR CC-BY identity), ID (D, PAID), TH (R, gated), VN (R, gated), MY (R, directors paid), PK (R, restricted), BD/LK (R, gated), PH (C, stub), TW (D, BUILD-GATED plus directors), HK (D, identity free/directors paid). MENA / Israel: IL (C, identity), TR/EG/QA/KW/BH/OM/JO/LB/MA/TN/DZ (R, MENA wave), SA (paid), AE (C, gated). Sub-Saharan Africa: NG (R, search-only, resale-prohibited), ZA (R, restricted), KE/GH/TZ/SN (R, search-only), CI (OHADA), ET/UG/RW (G plus regional pattern). Eurasia / C. Asia: KZ (R, BUILD-GATED plus directors), GE (R, BUILD-GATED), AZ (R, closed), UZ (R, unconfirmed to G). SARs and offshore: MO (D, free plus directors, PDPA), KY/VG/BM/JE/GG/IM/GI (T2, restricted/paid to G identity), SX (T3, free plus directors), XK (T3, search-only). Universal: GLEIF/LEI, all 249 ISO-3166 jurisdictions, CC0 identity, covering every cell above.

Appendix B: Artifacts and reproducibility

All per-jurisdiction audit matrices, the proprietary-sourcing and academic research outputs, and the Gold-quality analysis are persisted as structured artifacts under backend/research/global_sourcing/ (audits/<ISO2>.json for deep audits, audits/_<REGION>.json for regional batches, paper_research/), with the audit instrument (b2b-country-source-audit) and the program design (PROGRAM.md, JURISDICTIONS.md) version-controlled. Every claim in Sections 3 and 5-7 traces to a verified, citation-bearing artifact.

References

(Consolidated reference list: academic works cited in Section 6 with DOIs and venues, proprietary-vendor primary sources and the ZoomInfo settlement docket cited in Section 5, and the official registry and licence URLs cited per jurisdiction in Section 3, to be compiled from the per-section citations in the persisted artifacts; the data-quality-frameworks and OpenCorporates references attach with Sections 6.3 and 6.4 on completion of the dedicated research run.)