Lead-generation website due diligence

Once a lead-generation deal is under LOI, diligence moves past the traffic summary and into the handful of places risk in this business actually hides: the lead-buyer contracts, the gap between leads delivered and leads paid for, and the consent trail behind every contact record the site has ever sold. None of the three shows up in a standard set of financial statements, and a buyer who treats this like an ordinary website acquisition can close the deal without ever finding the problem that was sitting there the whole time.

The documents that actually matter

The central file is whatever exists in writing with each lead buyer — a signed agreement where one exists, or at minimum a correspondence history showing pricing, delivery terms and any prior discussion of what happens if ownership changes. Billing and collections records matter just as much, because they let a buyer separate leads that were actually paid for in full from leads that were delivered but discounted, disputed or never billed — a business that looks strong on a lead-volume chart can look very different once a buyer pulls the collections history behind it. Consent records for how each lead’s contact information was gathered and passed on round out the core file, along with any correspondence a buyer might already have from a lead buyer over quality complaints.

Checks beyond the paper file

There is no dedicated registry search for a lead-generation site the way there is for a licensed trade, but a buyer should still independently confirm domain and trademark ownership sit with the entity being sold rather than with the founder personally, and check that the ranking a listing claims actually shows up in a live search rather than relying entirely on the seller’s own analytics. Where the site’s ranking is concentrated on a small number of pages, it is worth understanding exactly how concentrated before closing, since that concentration is a structural risk no amount of paperwork can fix.

The findings that actually kill this kind of deal

The most common deal-killer is a lead buyer who, once asked directly, will not commit to continuing on the same terms for a new owner — sometimes out of loyalty to the person they already know, sometimes because they were already planning to change terms regardless of who owns the site. A close second is a reconciliation that shows a meaningful share of reported leads were never actually collected on, revealing that the real, paid revenue is materially lower than the headline lead count suggested. A third is a consent record that turns out to be missing or inconsistent for a significant share of the list, which exposes the buyer to privacy-law risk on day one for leads collected before they ever owned the business.

What a finding actually means once it appears

Not every finding carries the same weight, and treating them all as equally serious wastes negotiating leverage on the ones that do not matter. A lead buyer who is simply slow to respond in writing, but ultimately confirms continuation, is a manageable timing issue; a lead buyer who goes silent entirely, or confirms only at a materially lower rate, is telling the buyer that the asset the purchase price assumes is transferring may not actually be there after closing. Similarly, a handful of old, resolved billing disputes reads very differently than a collections gap that is still growing right up to close — the first is history, the second is an active problem the buyer is about to inherit.

Verifying privacy and marketing compliance in practice

Confirming that a privacy policy exists is not the same as confirming the site actually collects and discloses consent the way that policy claims, and a buyer should ask to see the underlying record for a sample of leads rather than accept the policy document on its own. For any Quebec-resident leads, the same check needs to apply the province’s own, stricter privacy standard rather than assuming the federal baseline covers it. Any follow-up email or text the site or a lead buyer has sent using this data is separately subject to Canada’s anti-spam legislation, so a buyer should confirm consent records and a working unsubscribe mechanism actually exist behind that messaging, not just that nothing has gone wrong with it yet.

Confirming the site itself transfers cleanly

Underneath the lead-buyer contracts and the consent trail, a buyer still needs to confirm the more basic question of who actually owns the site: is the domain registered to the entity being sold, or has it simply always sat in the founder’s personal registrar account without anyone formalizing the difference? The same question applies to any trademark used in the site’s branding, and to the lead-tracking or CRM software the business relies on — a licence held personally by the founder rather than by the business does not automatically transfer with a sale, and discovering that gap after closing is a far more expensive way to find out than confirming it during diligence. A buyer should also verify that the analytics and search-console access showing the site’s ranking history is genuinely tied to the site itself, not to an account the seller intends to keep.