First-party data: the asset most companies own but don't use

Advertising that depends on following people across websites sees less than it used to. Chrome still allows third-party cookies, but Safari and Firefox block them, many European visitors decline tracking on cookie banners, and Apple's App Tracking Transparency lets iPhone users refuse tracking across apps. Retargeting audiences shrink, platform reports miss conversions, and you pay for targeting that is less precise than the dashboards suggest.

First-party data is the information people give you directly: their email address, what they bought or asked about, and how they use your website, app or product. Most companies already hold plenty of it in their CRM (customer relationship management system), webshop and email tool, but it never reaches their advertising or their reports. Used with proper consent, it makes targeting, measurement and email more accurate, and it does not erode when browsers tighten their rules.

This article covers where your first-party data sits and what GDPR (the EU's General Data Protection Regulation) asks before you use it in advertising. It then turns to three practical uses: customer lists in ad platforms, better conversion measurement and a loop that turns visitors into known contacts. None of it needs new software to begin, only better connections between the tools you already pay for.

What counts as first-party data, and where yours sits

First-party data is anything you collect from your own customers and prospects through your own channels. Details people volunteer on purpose, such as preferences or sizes saved in a profile, are sometimes called zero-party data; for practical purposes, treat them as part of the same asset.

In a growing business it is usually spread across tools that do not talk to each other. These are the places to look first:

• Your CRM holds contacts, companies, enquiry dates, deal values and, ideally, where each enquiry came from.
• Your webshop or invoicing system records who bought what, when, how often and for how much.
• Your email tool knows who signed up, which messages they clicked and which emails led to a purchase.
• Your website or app shows what logged-in users and known contacts looked at, downloaded or used.
• Customer service notes, reviews and surveys capture the questions, complaints and needs people told you about.

The email address is usually the key that links these records, because almost every tool stores it. Pick one system as the master record, normally the CRM, or the shop platform if you sell only online, and make the others sync to it rather than keep their own versions of the truth.

Consent first: what GDPR expects before the data goes into ads

Before you upload customer data to an ad platform you need a lawful basis under GDPR, and for advertising the safe default is consent. Google's policy for users in the European Economic Area (EEA) requires consent for personalised advertising, and your privacy notice must say plainly that you share contact details with advertising platforms. If you are unsure whether your existing sign-ups cover this, ask whoever advises you on data protection before the first upload.

The data is hashed before matching, which turns each email address into a scrambled code, and the platforms or your tools usually do this automatically. Hashing means the platform never receives the plain address, but hashed emails still count as personal data under GDPR, so the consent and notice rules apply all the same.

In practice, record consent in your CRM with the date and the form it came from, and keep consent for email marketing separate from consent for advertising. Make sure people who unsubscribe or ask to be deleted also disappear from the lists you send to ad platforms. On the website itself, Consent Mode v2 passes each visitor's cookie choice to Google's tags, and Google requires it in the EEA for ads measurement.

Customer lists: the quickest return from data you already hold

The most direct use of first-party data is uploading a customer list to the ad platforms, which match the email addresses or phone numbers to their own users. Google calls this Customer Match; Meta and LinkedIn offer the same idea as audiences built from an uploaded contact list. Because the matching happens on the platform's side, these audiences do not depend on cookies and stay accurate as browsers change.

A matched list is more than a retargeting tool. It can do four separate jobs:

• Exclude existing customers from acquisition campaigns, so you stop paying to win people you have already won.
• Show lapsed or one-off buyers a reason to come back, such as a new range or a reorder reminder.
• Seed a lookalike audience on Meta from your best customers, so its prospecting starts from people who resemble them.
• Guide Google's automated campaigns: Google retired Similar Audiences, but Performance Max uses your lists as signals about who to look for, and Demand Gen can build lookalike segments from them.

The exclusion alone can pay for the effort. Say a fifth of the people clicking your prospecting ads are already customers: on a €5,000 monthly budget, that is roughly €1,000 a month spent reaching people you have already won. Excluding the customer list moves that money to genuine prospects.

Match rates depend on the data you hold: personal email addresses tend to match better on Meta and Google, work addresses better on LinkedIn. Each platform also needs a minimum number of matched people before it will use a list, so note the match rate it reports after every upload. And keep lists current: many CRMs, email tools and shop platforms can sync audiences to the ad platforms automatically, which beats a spreadsheet uploaded once and forgotten.

Better measurement from data you already collect

First-party data also repairs measurement. When a browser blocks a tracking script or a cookie expires, the platform loses sight of the conversion. When the sale is reported with a hashed email attached, ideally from your own server, the platform can still match it to the ad. Meta's Conversions API and Google's enhanced conversions are both built on this principle, and both belong in a standard set-up rather than on a list of extras.

If you sell through a sales team, by phone or in a showroom, the bigger win is sending outcomes back. Google Ads can import offline conversions and Meta can receive events from your CRM, so you can report a qualified enquiry or a signed contract to the platform days or weeks after the click. Its automated bidding then learns to find people who become customers, not just people who fill in forms.

If you make only one technical change after reading this, make it this one. A campaign told to find form fillers will find form fillers, and they are not always the people who buy.

These connections must respect consent too. Send only what your visitors and customers agreed to share, and let your consent settings and your CRM's consent fields decide what goes through.

The loop that turns visitors into known customers

First-party data grows fastest when campaigns are designed to turn anonymous visitors into known contacts. The loop has five steps, and each pass makes the next one work better:

1. 1.Ads, search and content bring visitors to your website.
2. 2.You give them a clear reason to identify themselves: a useful guide, a price calculator, a sample, a first-order offer or a newsletter worth reading.
3. 3.The form saves their contact details, their consent and the source of the visit in your CRM.
4. 4.Every later interaction adds to the record: what they bought or asked about, which emails they clicked and what they returned.
5. 5.Segments built from those records go back into your ads and emails as exclusions, reactivation lists and lookalike seeds, while outcomes go back to the platforms' bidding.

The second step is where most loops break. People share their details when the return is obvious and immediate. A vague 'subscribe for updates' box rarely gets far, while a calculator that emails the result or a guide that answers a real buying question gives people a reason.

Ask only for what you will use. Each extra form field gives people one more reason to abandon the form, and GDPR's principle of data minimisation points the same way. If a field has no named use in your ads, emails or sales process, remove it, and ask for more later as the relationship grows.

Review the loop every quarter: which sign-up reasons bring contacts who later buy, and which bring contacts who never do.

First-party data is not a compliance chore; it is an asset that grows every time a customer deals with you.

What to do this month

1. 1.List every system that holds customer data, choose the master record, and check that the email address is captured in each.
2. 2.Read what your sign-up and checkout forms say about advertising use, and update your privacy notice and consent fields where they fall short.
3. 3.Upload or sync your customer list to your main ad platform, exclude existing customers from prospecting, and note the match rate.
4. 4.Set up server-side conversion tracking through Meta's Conversions API and Google's enhanced conversions, or an offline import of qualified enquiries if you sell through a sales team.
5. 5.Add one clear reason to register on your website, and make sure the form records both source and consent.