How to automate lead capture: what you can legitimately know

Lead capture is usually framed as a conversion problem: how do we get more people to fill in the form. The more consequential questions are what you are allowed to know about the people who do not, what you are allowed to do with what they tell you, and whether the form is asking for things that are costing you the submission.

Those three decide both how much you capture and whether the capture is defensible. They are also the parts most often settled by copying whatever the previous site did.

What we'll cover

• Every extra field costs submissions
• Progressive profiling
• Visitor identification and its limits
• Building it with CodeWords
• Consent that actually holds
• Enrichment instead of asking
• Capture points beyond the form
• What happens in the first hour
• Making it survive
• Limits worth knowing about
• What to build first
• Frequently asked questions

Every extra field costs submissions

Each field is a decision point where somebody can leave, and the drop is not evenly distributed across fields.

Phone number costs most, and it is the field most often falsified, so it frequently costs you a submission and gives you nothing.

Company size and role can usually be enriched rather than asked.

"How did you hear about us" is answered inaccurately and is better measured than asked.

Most forms collect fields nobody reads. Audit which are actually used in the last quarter's follow-ups; the answer is usually two or three.

Email alone is often enough to start, with everything else gathered later from a relationship rather than from a stranger.

Progressive profiling

Ask for the minimum first, then more at the next interaction, which spreads the cost of asking over a relationship.

Never ask twice for something you already have, which requires recognising the returning visitor.

Swap the field once answered, so a returning visitor sees a new question rather than a pre-filled one.

Order by value, so the fields you actually use are asked earliest and the speculative ones may never be reached.

Respect the context. A person downloading a guide and a person requesting a demo are at different stages and should not face the same questions.

Make it visibly shorter each time, which is both the point and the thing that makes returning visitors more likely to convert.

Visitor identification and its limits

Identifying anonymous visitors is widely sold and worth being precise about.

Company-level identification from network data is the common approach — and it identifies an organisation, often imprecisely, not a person.

It fails for remote workers, mobile traffic and large providers, which is a growing share of visits.

Identifying an individual without their knowledge is a different proposition entirely, with obligations attached in several jurisdictions.

Transparency is the test. If you would not be comfortable telling the visitor what you collected, that is the answer.

Contacting somebody because their company visited is a decision with a poor reputation among recipients, whatever its legality.

Use it for prioritisation rather than outreach, which is where it is both more defensible and, on most teams' own numbers, more effective.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, so the forms, the CRM, the enrichment source and your channels can meet in one automation.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: what is captured, what is enriched, what consent is recorded, and where it goes.
3. Authorize the connections — the form source, the CRM, and any enrichment provider.
4. Describe the exceptions: an existing customer, a duplicate, a personal address, a submission without consent for marketing.
5. Run it against last month's submissions and check what was captured, enriched and recorded.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Consent that actually holds

Record what they agreed to, when, and on which wording — not simply a true or false.

Separate consents. Sending a requested document is not the same permission as adding somebody to a marketing list.

No pre-ticked boxes, which are invalid in several jurisdictions and reputationally poor everywhere.

Keep the wording with the record, since proving consent later means showing what was on the screen at the time.

Honour withdrawal everywhere, promptly, across every system that holds a copy.

Store the evidence, because an unprovable consent is functionally an absent one when somebody asks.

Enrichment instead of asking

Company from the email domain, which is immediate and free and removes several fields.

Firmographics from a provider, where the accuracy justifies the cost — and verify it, since industry and size are frequently wrong.

Technology signals where relevant and where the source is legitimate.

Existing records first. Check your own CRM before enriching, since this person is often already known.

Flag rather than guess when enrichment fails, and do not let an automation invent a plausible company size.

Check the provider's basis for holding the data, since using it makes their compliance question partly yours.

Capture points beyond the form

Chat, which captures people who would not fill in a form and is a different conversation entirely.

Content that requires no gate, with a request afterwards — which typically produces fewer records and better ones.

Webinars and events, where the exchange is explicit and the consent is clearer.

Newsletter subscription, which is a lower-commitment step that many visitors will take when a demo request is too much.

Product sign-up, which is the strongest signal of all and is frequently handled as a separate system with no connection to marketing.

The reply to an email, which is a capture point nobody treats as one and which produces the highest-intent conversations you will have.

What happens in the first hour

Capture is only worth as much as the response to it, and the response window is far shorter than most processes assume.

Speed dominates. A reply within minutes reaches somebody still thinking about the problem; a reply the next day reaches somebody who has moved on or contacted a competitor.

Acknowledge instantly, always, even when the real response will take longer, so the person knows the form worked.

Deliver what was requested immediately rather than as part of a sequence, since a delayed download is the most avoidable possible disappointment.

Route by fit at capture time, so the ones worth a fast human response get one rather than waiting in a queue behind everything else.

Give the responder the context — what they read, what they asked for, what the company does — so the first reply is about them rather than generic.

Measure time to first human response, by band, because it is usually much worse than anybody believes and it is the number most directly tied to whether capture turns into anything.

Making it survive

Never lose a submission. Persist first, process afterwards.

Deduplicate on email, and handle the same person submitting with different addresses as a merge rather than a duplicate.

Make it idempotent, since form webhooks retry.

Alert on zero captures for a period, because a broken form looks exactly like a quiet week.

Report the outcome: submissions, duplicates merged, enrichment failures, and consent recorded by type.

Limits worth knowing about

Most visitors will never identify themselves, and no capture strategy changes that materially.

Enrichment accuracy is uneven, especially outside large markets and for private companies.

Consent requirements differ by market, including whether business contact details are treated differently.

Attribution is incomplete, since referrer data is missing for a meaningful share of traffic.

More records is not better. A larger list of poorly qualified contacts costs deliverability and attention without producing revenue.

What to build first

The field audit. Take every field on your current forms and check which ones were actually used in the last quarter's follow-ups. Remove the rest. It takes an afternoon, it costs nothing, and it typically increases submissions more than any redesign — because the fields nobody uses were costing you the people who did not want to answer them.

Two habits make the difference. Record the consent wording alongside the consent itself, since proving what somebody agreed to means showing what was on the screen, not a boolean. And check your own CRM before enriching, because a surprising share of new leads are people you already know, and treating them as strangers is both wasteful and noticeable to them.

Frequently asked questions

How many fields should a lead capture form have?

Fewer than it has. Audit which fields were actually used in the last quarter's follow-ups — usually two or three — and remove the rest. Phone number costs the most submissions and is the field most often falsified.

What is progressive profiling?

Asking for the minimum first and gathering more at each subsequent interaction, never asking twice for something you have. It spreads the cost of asking across a relationship rather than front-loading it onto a stranger.

Can I identify anonymous website visitors?

Company-level identification from network data is common and imprecise, and it fails for remote workers, mobile traffic and large providers. Identifying an individual without their knowledge is a different proposition with obligations attached.

Should I contact a company because it visited my site?

It has a poor reputation among recipients whatever its legality. Using the signal for prioritisation rather than outreach is both more defensible and, on most teams' own numbers, more effective.

What does recording consent properly involve?

What they agreed to, when, and on which wording — with the wording kept alongside the record. Separate the consent to receive something requested from the consent to be added to a marketing list, and never use pre-ticked boxes.

What can be enriched rather than asked?

Company from the email domain, firmographics from a provider where accuracy justifies the cost, and anything already in your own CRM — which should always be checked first, since many new leads are people you already know.

What capture points are usually missed?

Chat, ungated content with a request afterwards, newsletter subscription as a lower-commitment step, product sign-up treated as a separate system, and replies to emails — which produce the highest-intent conversations and are almost never captured.

Is a bigger list better?

No. Poorly qualified contacts cost deliverability and attention without producing revenue, and they degrade the sending reputation that your genuine communications depend on.

How quickly should a captured lead be responded to?

Within minutes for anything worth a human response. A reply within minutes reaches somebody still thinking about the problem; the next day reaches somebody who has moved on. Measure time to first human response by band — it is usually worse than anybody believes.

Should the requested content be part of a nurture sequence?

No. Deliver it immediately. Holding back something somebody asked for in order to fit a sequence is the most avoidable disappointment in the whole flow.

Should I gate content behind a form at all?

Sometimes. Ungated content with a request afterwards produces fewer records and better ones, and it reaches the people who would have left rather than fill in a form — who are often the ones evaluating most seriously.

What should happen when enrichment fails?

Flag the gap and proceed with what you have. Never let an automation invent a plausible company size, because wrong fit data is worse than absent fit data and nothing downstream can tell the difference.

Related reading

• Automating form data routing
• Automating lead scoring
• HubSpot and CodeWords