First-party data

First-party data is data that a company collects itself, directly from its own customers, through its own app, website, shops, call centre or loyalty programme. It includes what each customer bought, what they searched for, which emails they opened and the details they typed in when they signed up. Because the company collected the data itself, with the customer's knowledge, it can trust the data more than data it buys.

Here is how it works in general. A customer does something with the company: signs up, logs in, buys something, or gives a loyalty number at the billing counter. The company's software records each of these events against that customer. A customer data platform joins the events into one profile per person, a step called identity resolution. The company then uses the profile to decide what to show or send that customer, and measures what the customer did next. Under India's data protection law, the Digital Personal Data Protection Act, the company must tell the customer why it collects the data. In most cases, it must also get the customer's consent. These duties apply from 13 May 2027.

Data is usually sorted by who collected it. First-party data is the company's own. Second-party data is another company's first-party data, shared directly under an agreement, such as an airline sharing data with a partner hotel chain. Third-party data is collected by companies that have no direct relationship with the people in it, and sold to many buyers.

Why does it matter more now? Advertisers used to follow people across websites with third-party cookies, and they bought lists of people. The Safari browser blocks all third-party cookies by default. The Firefox browser blocks the cookies of known tracking companies by default. It also keeps every other third-party cookie separate for each website, so the cookie cannot follow a person to other sites. Chrome, the most used browser in India, planned to remove third-party cookies, but Google has decided to keep them. Privacy laws also restrict how companies collect and sell personal data. So a company's own records have become its most reliable way to know its customers.

Take, for example, a supermarket chain. Its loyalty programme records every basket, so the chain knows which families buy baby food and can send them the right offers.

Consider a skincare brand that sells only through its own website and app. As a direct-to-consumer (D2C) brand, it knows who bought each product, which it would not know if it sold through other shops.

Say a news website asks readers to log in after a few free articles. Through its paywall, it learns what each logged-in reader reads, and uses that to choose stories and ads.

How is first-party data different from data gathered with third-party cookies? A third-party cookie is placed by an outside company, usually an advertising company, on the websites a person visits, and it follows the person from site to site. First-party data stays with the company that the customer actually dealt with. Retailers now also sell advertising aimed with their own shopper data, through a retail media network.