What is first-party data?

The word “own” does not refer to legal ownership of the data, but to the origin of the relationship: the person hands over the information in a channel the company controls and in which it knows who it is dealing with. A quote form, an order in the shop, a newsletter open, a call to support or the browsing path measured on the company's own domain all produce first-party data.

The difference from the other two types is a question of chain of custody. Second-party data is another organisation's first-party data, passed on or sold under an agreement, for example when a hotel chain shares segments with a partner airline; its origin remains traceable, but the company using it was not present when it was collected. Third-party data comes from intermediaries that aggregate it from many external sources and resell it packaged as audiences; the user rarely knows which company ended up holding the profile.

There is also a fourth category that comes up more and more: declared data, or zero-party data, which a person provides consciously and voluntarily when answering a survey or setting preferences. Technically it is a subset of first-party data, with the difference that the intent is declared rather than inferred.

The mechanism has three parts: a capture point, an identifier that ties together the interactions of the same person, and a store where the data stays under the company's control. The capture point can be a form, a checkout, an account registration, a booking system or the measurement of the company's own website. The identifier is usually a normalised email address, a customer number or a proprietary session ID. The usual store is the CRM, a data warehouse or a customer data platform.

The legal framework in the European Union works in two layers that are best kept apart. The directive on privacy and electronic communications, transposed in Spain in Article 22.2 of the LSSI, governs storing information on the user's terminal equipment or accessing information already stored there: it requires prior informed consent and provides an exception where the storage or access serves solely to carry out the transmission of a communication over a network, or is strictly necessary to provide a service the person has explicitly requested. The rule applies to the terminal equipment regardless of the technology used, so it also reaches device fingerprinting techniques.

The second layer is the GDPR, which governs what happens afterwards with the resulting personal data: it requires a legal basis, a specified purpose, information to the data subject and retention limits. Data being first-party does not take it out of either layer.

The most repeated justification for investing in first-party data has been false for years. The timetable for retiring third-party cookies in Chrome was postponed several times and was eventually cancelled: on 22 April 2025 Google announced that it was keeping its current approach and would not roll out a dedicated prompt for users to decide about third-party cookies, which remain available and are managed from the browser's privacy settings. On 17 October 2025 Google went further and retired ten Privacy Sandbox technologies, among them Topics, Protected Audience and Attribution Reporting, the very set that had been presented as the replacement. In August 2026 that is still the position: Chrome does not block third-party cookies by default, and the announced replacement no longer exists.

The decision that actually depends on first-party data is a different one, and it has not moved. Safari and Firefox do restrict third-party cookies by default, acceptance rates on consent banners leave part of the traffic unmeasured, and attribution built on someone else's identifiers degrades as soon as the journey crosses devices. Anyone who wants to know what a customer is really worth, which channel brings the repeat buyers and who they can reach without an intermediary needs an identifier of their own, collected with consent.

• Decide on the unique identifier before collecting anything, usually the normalised email address or a customer number, and settle how the systems that will use it are joined.
• Ask only for data you will use. Every extra field lowers the completion rate and adds compliance work.
• Store the purpose, the date and the proof of consent alongside the data, and make sure a withdrawal propagates to the connected systems.
• Offer a real return for signing up: price, availability, a configurator, an assessment. A form with nothing in return produces fake addresses.
• Measure quality rather than volume: share of verified addresses, duplicates detected, records with at least one attributed purchase.
• Set retention periods per purpose and automate deletion instead of leaving it to a manual annual review.

• Calling a purchased list first-party data. The origin does not change its nature because the list was imported into the CRM.
• Treating consent as a one-off formality. If the purposes or the third parties involved change, the information on which it was given no longer describes what is happening.
• Running separate silos for shop, newsletter, support and CRM with no common key, so the same person shows up as four different customers and every value calculation comes out too low.
• Resting the project on the argument that cookies are disappearing, and being left without a justification as soon as someone checks that it has not happened.
• Accumulating fields that feed no decision. Data nobody uses is stored risk with nothing on the other side.