Third-party data

Third-party data is information about people collected by an organisation with no direct relationship to them and sold or licensed to others for targeting and enrichment.

Part of the Learn hub and the customer data glossary.

What it means in practice

Third-party data comes from organisations that collected it for their own purposes, or aggregated it from many sources, and then license it to others. Typical sources are data brokers, audience marketplaces and cookie-based segments. Buyers use it to find prospects, enrich profiles and extend reach beyond their own customers.

The compliance problem is provenance. If you cannot show how the data was collected, what people were told and on what basis, you cannot safely rely on it. Under GDPR, when personal data is not obtained from the person, the controller must give them the required information within a reasonable period and at the latest within one month (Article 14(3)(a)) 1, and still needs its own lawful basis. Accuracy and coverage vary and are hard to audit.

Enrichment can also change the risk of a decision. If purchased attributes feed a system that evaluates creditworthiness, or assesses risk and prices life or health insurance, that system may be high-risk under the EU AI Act (Annex III, points 5(b) and 5(c)) 2. Marketing personalisation on its own is not high-risk.

A first-party identity graph reduces dependence on vendor-supplied identity links.

Example (insurance): an insurer enriches leads with purchased lifestyle attributes. It must tell the individuals where their data came from, document its lawful basis, and assess the AI Act position before those attributes influence any model that prices life or health cover.

Related terms

• First-party data: collected directly.
• Zero-party data: declared by the customer.
• Identity graph: vendor graphs rest on this data.
• Purpose limitation: limits how it can be reused.
• High-risk AI system: when enrichment feeds regulated decisions.

Where it matters

• Zero-party, first-party and third-party data: what changes after cookies.
• EU AI Act for marketing and customer decisioning: when enrichment becomes high-risk.

Back to the customer data glossary or the Learn hub.