Zero-Party Data vs First-Party vs Third-Party Data: Definitions and What Changes After Cookies

Zero-party data is information a customer intentionally and proactively shares with a business, such as stated preferences, survey answers and preference-centre choices. First-party data is what a business collects directly from its own interactions, and third-party data is bought or licensed from outside sources. In a customer data platform (CDP), keep declared and observed data separate, each with its source, purpose and consent attached.

Who this is for: marketing, CRM and privacy leads and data architects. You will get definitions, examples, the 2026 cookie status with dates, a storage model, regulatory notes and a checklist. More explainers: the Learn hub.

Definitions and examples

Your own inferences (a churn score, a predicted interest) are a fifth thing: first-party in origin, lower in trust. Store them separately.

Zero-party data examples and how to collect them

• Preference centre: topics, channels, frequency, language, pause options.
• Onboarding and progressive profiling: one or two questions per visit instead of a long form.
• Quizzes and configurators: skin type, budget, product fit.
• Account settings: communication preferences, accessibility needs.
• Conversational capture: a chat or call agent records a stated preference.

Principles for zero-party data collection: offer a clear value in exchange; ask one thing at a time; say what you will do with the answer; record who said what and when; make answers easy to change; expire or re-confirm old answers.

Care is needed with sensitive answers. Data concerning health, sexual orientation, religion or similar is a special category under GDPR Article 9 and generally needs explicit consent for a specified purpose 12. California treats health, precise geolocation and similar data as sensitive personal information, with a right to limit its use 13. A quiz question that reveals a health condition is not a harmless preference.

Zero-party data vs first-party data

The practical difference is declared versus observed. Declared data states intent but can be stale or aspirational; observed data shows behaviour but not reasons. Use declared data to decide what you may do (channel, topic, frequency) and observed data to decide what is relevant. When they conflict, let the declared value win for its stated purpose: a customer who asks for email only should not get push messages because they open the app often. Braze shows a similar rule in identity merging: when an anonymous profile merges into an identified one and fields conflict, the identified user's values win 16.

Third-party cookies: where things stand in 2026

Google's decisions, in order:

• 22 July 2024: Google said it would not deprecate third-party cookies and proposed a Chrome experience giving people an informed choice that applies across browsing 3.
• 22 April 2025: Google decided to maintain its current approach to third-party cookie choice and not roll out a new standalone prompt; users choose in Chrome's Privacy and Security settings 4.
• 17 October 2025: Google retired several Privacy Sandbox technologies citing low adoption, including the Attribution Reporting API, Protected Audience and Topics, while continuing CHIPS, FedCM and Private State Tokens, and said Chrome keeps its current approach to cookie choice 5.

What this means:

First-party data strategy and the first-party data platform

A first-party data platform stores, unifies and governs the data you collect directly. A customer data platform is the usual form: software that keeps a persistent, unified customer record accessible to other systems 2. Others build the same on a warehouse; see composable vs packaged vs private. New to the category? Read what a customer data platform is. A workable strategy:

1. Inventory what you hold, from where, and on what basis.
2. Choose identity keys (login, verified email or phone, customer ID); see identity resolution explained.
3. Collect server-side and set identifiers from your own domain.
4. Capture consent and preferences as data, with provenance.
5. Unify in a customer data platform or warehouse, keeping declared, observed and inferred data apart.
6. Activate through owned channels first, with suppression applied; see customer journey orchestration.
7. Use partner data only under contract and documented consent.
8. Review, expire and delete on a schedule.

How a CDP stores declared and observed data

Give every attribute metadata, not just a value:

Bloomreach documents the same idea for consent: each consent has a status, category and optional expiry, and the system records its source, timestamp and changes over time 15. Four rules keep the model honest: declared outranks observed for its stated purpose; inferred data never silently becomes declared; every attribute is bound to purposes; deletion and access requests follow lineage.

Regulatory notes

• GDPR purpose limitation: personal data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly 12. A size entered for fit advice is not a licence for ad targeting. Data minimisation limits collection to what is necessary 12.
• Consent: must be freely given, specific, informed and unambiguous, by a statement or clear affirmative action 12. Profiling means automated evaluation of personal aspects such as preferences, interests and behaviour, so inferences are personal data 12.
• Direct marketing: people can object at any time, including to related profiling 12.
• California: sensitive personal information has a right to limit; opt-out of sale or sharing must be honoured, including a user-enabled global privacy control 1314. See US state privacy laws.

For withdrawal handling, see consent withdrawal across channels.

First-party data readiness checklist

• Every attribute has a method, source, time and purpose.
• Declared and observed data live in separate namespaces.
• Preference choices and consent are stored as events with provenance.
• Sensitive questions are reviewed against Article 9 and state sensitive-data rules.
• Identifiers are set server-side from your own domain.
• Global privacy control and opt-out signals are honoured.
• Suppression reaches every channel and tool.
• Old answers expire or are re-confirmed.
• Partner and purchased data has contractual consent evidence.