What is first-party data?
The “first party” is you. First-party data is created wherever people come into direct contact with your company:
- visits and interactions on your website or in your app, measured with your web analytics
- orders, enquiries and customer accounts
- newsletter sign-ups and responses to emails
- conversations with sales and customer service, surveys, events
This is distinguished from:
- Second-party data: another company’s first-party data that it makes available to you as part of a partnership.
- Third-party data: data that providers have collected on other websites and resell, traditionally via third-party cookies.
You will sometimes also hear of zero-party data. This means information customers deliberately share with you, such as preferences in a customer profile.
Why first-party data is becoming more important
Third-party cookies no longer work in many browsers:
- Safari has blocked them completely by default since 2020, according to WebKit.
- Firefox has separated cookies by website by default since 2022, so a provider can no longer use cookies to follow users across different websites.
- Chrome still allows them. In April 2025, Google announced that it would not introduce a standalone prompt. Users can, however, block third-party cookies in the settings.
On top of this come ad blockers and visitors who decline in the cookie banner. Data from your own sources is therefore often the most reliable basis for analytics and advertising.
What you can use first-party data for
- Web analytics: Google Analytics works with cookies on your own domain, i.e. first-party cookies.
- Enhanced conversions in Google Ads: when a customer enters their email address with an order, it is hashed, i.e. irreversibly converted into a string of characters, and sent to Google. This allows conversions to be attributed more accurately.
- Customer Match: your own customer lists are uploaded to Google Ads to reach or exclude existing customers in Search, on YouTube, in Gmail and on the Display Network.
- Remarketing and audiences: reaching visitors again who have viewed certain pages; see retargeting for more.
- Cross-channel analysis: combining data from your shop, CRM and ad accounts, for example to evaluate revenue rather than just clicks.
First-party data and consent
A common misconception is that your own data can automatically be used without consent. That is not the case. In the EU, storing and accessing information on a user’s device, for example via cookies, generally requires consent under the ePrivacy rules (in Germany under § 25 TDDDG) unless it is strictly necessary. The GDPR also applies to the processing of personal data. Whether a cookie comes from your own domain or someone else’s makes no difference.
Google also requires consent signals: anyone sending data about users in the European Economic Area to Google for advertising must pass on their consent, usually via Consent Mode v2. You should clarify the appropriate legal basis in each case with your data protection officer.
First-party data and server-side tracking
With classic tracking in the browser, every advertising and analytics tool sends its data directly to its own provider. With server-side tracking, the data first goes to a server running on your own domain. According to Google, this gives you full control over which data is passed on to which services and in what form.
This has several advantages: you can filter out personal data before it is passed on, enrich data with your own values such as margin, and use the same data for several services. The comparison client-side vs server-side tracking shows the differences in detail.
Important: server-side tracking is not a way around consent. The choice made in the cookie banner must be respected on the server too.
Would you like to use your own data reliably and in compliance with data protection rules for analytics and advertising? Then get in touch with us or read more about our server-side tracking!
