Customer data glossary

First-party data

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

First-party data is information an organisation collects directly from its own customers through its own websites, apps, transactions and service channels.

Part of the Learn hub and the customer data glossary.

What it means in practice

First-party data comes from your own relationship with people: website and app behaviour, purchases, account details, support contacts, form submissions and stated preferences. Provenance is known, the lawful basis can be traced to a notice or contract, and the data can be corrected at source. That is why it underpins most customer data platforms.

It is not automatically compliant. It is personal data and is subject to consent, purpose and retention rules. It also stops being first-party in practice if it leaves your control: scripts and pixels on your own site can pass page and identifier data to advertising and analytics vendors. In US healthcare, the HHS tracking-technology bulletin (December 2022, updated March 2024) and the June 2024 decision in AHA v. Becerra, which vacated part of it, shape what hospitals can send from their own sites; see the healthcare pixels article, and note that our summary of the case comes from secondary sources.

The term also applies to cookies: a first-party cookie is set by the site the visitor is on.

Observed and declared first-party data differ in reliability. Observed behaviour shows what people did; declared data, often called zero-party data, says what they prefer. Good profiles keep the two apart.

Example (hospital system): appointment-booking activity on the hospital's own portal is first-party data. If an advertising pixel on authenticated booking pages sends page URLs and a user identifier to an ad platform, the data has left the hospital's control and may be protected health information disclosed to a third party.

Zero-party data: declared by the customer.
Third-party data: bought from outside.
Customer data platform (CDP): where first-party data is unified.
Consent state: governs its use.
Event stream: how behavioural data arrives.

Where it matters

Zero-party, first-party and third-party data: definitions and what changes after cookies.
Healthcare marketing pixels after HHS guidance: first-party data leaving your site.

Frequently asked questions

Do you own your first-party data?

You hold it as a controller, but privacy law frames it around individual rights rather than ownership. People keep rights to access, object and delete, so you hold it subject to those rights.

Is first-party data better than third-party data?

Usually more reliable and easier to justify, because you know where it came from. Its reach is limited to people who deal with you.

What is a first-party cookie?

A cookie set by the website the visitor is on, as opposed to one set by another domain. Consent rules can still apply to first-party cookies that are not strictly necessary.

Back to the customer data glossary or the Learn hub.

First-party data

What it means in practice

Related terms

Where it matters

Frequently asked questions

Further reading