AI lead generation tools: where the contact data comes from, what a contact costs and which outreach rules apply (October 2026)

What AI lead generation tools do, and where the AI sits

A lead generation tool does two jobs. It finds the right accounts and people with filters such as industry, company size, job title and country. Then it reveals the contact details, usually an email address and a phone number, and passes them to a CRM or a sequencing tool. The reveal is the moment a credit is charged.

The AI sits at the front, in search and research. Apollo lists AI research next to emails, phone numbers and enrichment among the things credits pay for. Leadfeeder names building prospect lists with AI in its Activate plan, and Amplemarket's plan table lists AI intent signals and a copilot. Leadfeeder also lists an MCP server for AI assistants that it marks as beta, so we leave it out of the comparison.

Not every tool in the prospecting niche sells people data. Leadfeeder identifies companies that visit your own website. Its free Lite plan covers up to 100 identified companies a month with unlimited users, and verified emails and phones start in the Activate plan at 369 euros a month billed annually. Lusha, Surfe, Apollo and Cognism sell the contact data directly, which is where credits and legal questions become central.

Sources: [1][2][3][4][5]

Where the contact data comes from: shared inboxes, the public web and licensed providers

Apollo is unusually specific about its sources. Its Article 14 notice names three: a contributor network, a scan of public websites and trusted third-party providers. In the contributor network, customers who use Apollo's email finder or tracking features share business contacts, and Apollo says this may include emails exchanged with you. Lusha names four sources: members of its community who share contacts from email headers and signatures, licensed partners, public business information and its own analysis of email patterns. It says it does not scrape professional networks and does not buy from data brokers.

Apollo says it relies on legitimate interests, its own and its customers', as the legal basis. Apollo and Lusha both say they are registered data brokers in California. Cognism says it notifies the business contacts in its database within the GDPR timeframes and checks its data against 15 major do-not-call and TPS lists. These are vendor statements that we have not audited, and not every vendor in the niche describes its sources this precisely. For a buyer, that gap is a finding by itself.

The risk is real. On December 5, 2024, the French authority CNIL fined Kaspr 240,000 euros. Kaspr sells a browser extension that shows professional contact details on LinkedIn profiles, and its database held about 160 million contacts. The CNIL found breaches of the legal basis (Article 6 GDPR), of the limit on how long data may be kept (Article 5(1)(e)) and of the information duties (Articles 12 and 14). It also found that Kaspr collected details of people who had restricted who can see them. Kaspr is not in our directory. The fine hit the vendor, but a customer who uses such data for direct marketing has duties of its own, covered below.

Even clean data goes stale. Lusha's own measurement from September 2026 found that 12.25 percent of US sales leaders changed roles within twelve months and 25.67 percent within twenty-four. That is a vendor figure for one group, but it explains why enrichment runs on a schedule.

Sources: [1][6][7][8][9][10][11]

What a contact costs: the credit definition decides, not the seat price

The headline price says little, because the credit rules decide what you can reveal. Lusha charges 1 credit for a verified email and 5 for a phone number. Apollo says it never charges more than 1 credit per contact for an email and charges only for emails it can verify. Cognism counts 1 credit per revealed contact, email and phone together, and charges nothing for viewing a contact you already revealed. Surfe and Amplemarket skip the shared pool and give separate allowances for emails and phone numbers.

Phone numbers are the scarce item. Surfe's Essential plan includes 1,800 email credits and 600 mobile credits a year, three emails for each mobile number. On Pro it is 12,000 against 1,200, ten to one. Amplemarket's Startup plan has 13,500 email credits and 600 phone credits per user and year, 22.5 to one. If your reps call prospects, the phone allowance sets the real limit.

Lusha publishes the most detailed price ladder. Starter costs $49.90 a month for 400 credits, Professional $69.90 for 600 credits and 2 users, and Premium $399.90 for 3,400 credits and 5 users. Annual billing brings Starter down to $449.10 a year for 4,800 credits. On monthly plans unused credits roll over up to twice the plan's credit limit. On annual plans all credits arrive up front and reset at the end of the year. Apollo's credits expire at the end of every billing cycle.

Other vendors publish less. Cognism lists Standard and Pro plans with 5 seats each and sells extra credits on top, but no prices. Apollo's plan table loads by script, so we could not read plan amounts from the page and give no figure. Apollo also states an email credit limit: the lesser of the amount paid divided by $0.025 or 1 million email credits per account and year. That works out to at most 40 email credits per dollar paid.

Sources: [5][12][4][13][1][2][3]

Who sells prospecting tools in our directory, and who publishes prices

Our directory lists 25 tools in the prospecting niche. 11 of them have prospecting as their main niche. The others list it as a second niche, for example tools for sending sequences, writing copy or measuring website traffic. 17 of the 25 are headquartered in the United States and 1 in Germany.

On pricing, the largest groups are freemium, flat fee and on request, with the same number of tools each. 8 tools offer a free plan and 12 a free trial. Leadfeeder identifies companies on your own website rather than selling a people database, and its free Lite plan has no end date.

Only 4 tools, 16 percent of the niche, can host customer data in the EU or offer an EU region. Security certificates are common: 17 tools name SOC 2 and 10 name ISO/IEC 27001. The standard for AI management systems, ISO/IEC 42001, is named by 2 tool, Lusha, which lists it on its own FAQ. Those certificates say how a vendor protects data. They do not say where the data came from or whether you may use it for cold outreach.

Sources: [14][3][7]

Your duties under the GDPR when you use a bought list

Having a list is one step, using it is another. A company that gets contact data from a third party must inform each person within a reasonable period, at the latest within one month, and must say where the data originated (Article 14 GDPR). People can object to direct marketing at any time, and once they do their data may no longer be used for it (Article 21).

For the legal basis, Recital 47 says that processing for direct marketing may be regarded as a legitimate interest, after a careful assessment that includes what the person can reasonably expect. In October 2024 the Court of Justice added that a commercial interest can count as a legitimate interest if it is lawful, the processing is strictly necessary and the person's rights do not override it. That keeps B2B prospecting possible in principle. It does not answer the question for the channel you use.

Sources: [15][16][17][10]

Cold outreach by country: Germany needs consent, France and the UK allow B2B email, the US asks for an opt-out

The EU ePrivacy Directive allows direct marketing email only with the recipient's prior consent (Article 13(1)). That rule is written for subscribers who are natural persons. For companies, Article 13(5) leaves it to the member states to protect their legitimate interests, which produces a patchwork.

Germany is the strictest case. Section 7(2) no. 2 of the Act against Unfair Competition (UWG) treats advertising email without prior explicit consent as unreasonable harassment, and it applies to business recipients too. For phone advertising to businesses, no. 1 asks for at least presumed consent. France's CNIL takes the opposite line for professionals. B2B email is allowed without prior consent if the offer relates to the person's profession, the person was informed and can object easily, and generic addresses such as info@ fall outside the rules.

In the United Kingdom the ICO says you can email any corporate body, but sole traders and some partnerships count as individuals and need consent. In the United States the CAN-SPAM Act has no B2B exception. It requires honoring opt-outs within 10 business days, and each violating email can cost up to $53,088. California adds a deletion route: since August 1, 2026, registered data brokers must process deletion requests from the state's DROP platform at least every 45 days, at a fine of $200 per day per request.

Sources: [18][19][20][21][22][11]

Questions to put to a vendor before you buy

The comparison above leaves gaps that only the vendor can close. Ask the same questions in writing and keep the answers with your selection record. A vendor that answers precisely on credits and sources has probably thought about them.

Run a short test before you sign: take 50 contacts from your own target market and count bounced emails, wrong numbers and people who have left the company. Check each result against the credits it cost. That test tells you more about the real price of a contact than the price table does.