---
title: 'What is first-party data? Definition and examples for ads'
description: 'First-party data comes from your direct customer interactions. Compare data types and see how visits, purchases, CRM leads and consent choices support ad measurement.'
canonical: https://plainrouter.com/definitions/first-party-data
last_updated: 2026-10-01
---

# What is first-party data?

First-party data is information a business collects through its direct interactions with customers and visitors, such as website activity, completed purchases and enquiries. For advertising measurement, it provides evidence of what happened in your own business; it does not automatically prove which ad caused it or give permission to share it.

The relationship to the person defines “first-party.” Hosting the database yourself is not required, and buying a contact list does not make it first-party just because you import it into your CRM. Google's [advertising data policy](https://support.google.com/adspolicy/answer/6242605?hl=en) similarly distinguishes direct interactions on your sites, apps or stores from information obtained elsewhere.

## Zero-party, first-party, second-party and third-party data

| Term | Where it comes from | Advertising example | What the label does not establish |
| --- | --- | --- | --- |
| Zero-party data | Information someone deliberately volunteers about their preferences or intentions | A prospect selects which product they want help choosing | Permission for unrelated advertising uses |
| First-party data | Your direct customer or visitor interactions, observed or provided | A completed order, enquiry or consent choice | That a campaign caused the outcome |
| Second-party data | Another organization's directly collected data shared with you through a direct arrangement | A partner shares eligible co-marketing leads | That the recipient inherits permission for every purpose |
| Third-party data | Information acquired from outside your direct relationship, often aggregated across sources | A purchased audience segment | Accuracy, provenance or a lawful right to use it |

These are marketing terms, not separate GDPR exemptions. “Second-party” describes the direct sharing arrangement; advertising platforms may still classify that information as third-party for their policies. Forrester uses [zero-party data](https://www.forrester.com/blogs/ask-dont-interrogate-best-practices-for-collecting-zero-party-data/) to distinguish volunteered preferences from observations and inferences. A preference answer can also be part of your directly collected customer record.

## First-party data examples for advertising measurement

- **Website visits:** an arrival request collected through your own domain can indicate that the collector received activity. It is not necessarily a unique visitor, a human session or a visit caused by an ad.
- **Backend-confirmed purchases:** your order or payment system records a completed transaction, its value and currency. Use that business state rather than treating a checkout-button click as a sale.
- **CRM leads:** an enquiry submitted to your business and its later qualified-lead status can describe different funnel stages. A form submission is not automatically a qualified customer.
- **Consent choices:** purpose-specific grants, refusals and withdrawals tell the integration which operations are permitted. Keep the current choice and its capture context; the existence of a contact record is not evidence of advertising consent.

For example, a visitor can decline advertising tracking and still place an order. Your business may need that order record to fulfil the purchase, while sending its identifiers to an advertising platform requires a separate assessment of the permitted use. First-party data is useful even when it cannot be joined to an ad click.

## How first-party data is used in ads

A conversion integration can send an eligible purchase or lead event to an advertising platform through an API. In Meta's case, [Conversions API](/library/meta-conversions-api) carries the event and permitted matching context so Meta can try to associate it with its records.

Keep three checks separate: did the business action happen, did the destination receive the event, and did the platform attribute it to advertising? Good delivery and a high [Event Match Quality score](/library/meta-event-match-quality) do not by themselves prove incremental sales. Send only the data the purpose permits; formatting or hashing an identifier does not grant consent.

## How to collect first-party data

Start with the outcome and source: browser activity from your website, a purchase from your backend, or a lead from your own form. Define the event, when it becomes true, the minimum necessary fields, permitted destinations and retention. Keep collection permission separate from permission to use or share the data for advertising.

Your collection endpoint can be on a subdomain you control or a same-origin route. That routing choice does not determine whether a cookie is used, whether data reaches a vendor or whether consent is required. See [first-party versus third-party cookies](/definitions/first-party-cookies) for the browser-storage distinction.

[Plainrouter Signals](/product/signals) supports a managed collection hostname through a CNAME on your domain, or a same-origin proxy. Its arrival request omits cookies and does not set a visitor cookie in the response; these identity-free counts are separate from consented conversion events and advertising identity. See the [published collection-path contract](https://plainrouter.com/docs/signals/configure-serving).

## Frequently asked questions

### Is first-party data exempt from GDPR?

No. If it is personal data and GDPR applies, directly collecting it does not remove obligations such as a lawful basis, transparency, purpose limitation, minimisation, security and retention limits. Not every processing purpose uses consent as its lawful basis, but device-storage rules and advertising uses can independently require consent. [GDPR Articles 5–6 (official text)](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679)

### Is an email address first-party data?

It can be: an address a person gives directly to your business during signup or checkout is directly collected. An address bought from a broker is not transformed into first-party data by saving it locally. The source and permitted use matter, and an identifiable person's email address is personal data. [GDPR Article 4 (official text)](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679)

### Does first-party data require first-party cookies?

No. An order record, a lead form or a volunteered preference can exist without an advertising cookie. Cookies are one browser-storage mechanism; “first-party data” describes your relationship to the source.