A shop knows which of its own pages you opened, what you put in your basket and what you bought. That record is first-party data. So what is first-party data in advertising? It is information a business collects directly from its own customers, on its own site or app, and then uses to decide which ads or offers to show. The name sets it apart from data that comes from a partner or from outside companies that gather it across many sites.
The difference matters because it decides who holds the information behind an ad and how far that information travels. Some ad services go further and hold almost none of it: vlvd ads, for example, shows one small ad at a time on a family of game and learning websites, with no cookies and no tracking of visitors.
What is first-party data in advertising, in plain words
Data about people is often sorted by "party", meaning how close it sits to the person it describes. The Wikipedia section on data sources puts it simply: first-party data may be collected by a company directly from its customers. Nobody stands between the person and the business that writes the record down.
In advertising, that usually covers three kinds of record:
- Behaviour on the site itself. Pages opened, searches typed into the site's own search box, items saved or bought.
- Account details. An email address, a delivery country, an order history.
- Replies to the business. Answers to a survey, a newsletter preference, a size chosen in a quiz.
The same section names a fourth, narrower label. Zero-party data is data customers "intentionally and proactively" share, such as answers in preference centers, quizzes, surveys and pop-up forms. The business still collects it directly, so it sits right beside first-party data. The useful line is between what a person hands over on purpose and what the site records while they browse.
First, second and third-party data side by side
The three labels make most sense together.
Second-party data is data obtained from another organization or partner, through purchase or other means. The same source describes it as "another organization's first-party data". A hotel chain receiving customer records from an airline it works with would be one example.
Third-party data is collected by other organizations and then combined from many sources, websites and platforms. The business that ends up with it never met the people in it.
The summary table in that section compares the three. First-party data is owned by the business, marked high for accuracy, used for personalization and retargeting, and carries a low privacy risk. Third-party data is owned by an outside entity, marked low for accuracy, used for broad targeting, and carries a high privacy risk. Second-party data sits between them on each count.
Why third-party cookies pushed first-party data forward
For years, the easiest way to gather third-party data was the third-party cookie. The Wikipedia page on HTTP cookies explains that such a cookie belongs to a domain different from the one in the address bar. It is typically set by content pulled in from another site, such as a banner ad, and it lets advertisers follow a person's browsing history across many sites.
Browsers started to block them. The same page records that since 2020 Safari, Firefox and Brave block all third-party cookies by default. Chrome did not follow: in July 2024, Google announced it would not block them by default and would prompt users to allow them instead.
With fewer cross-site cookies to lean on, businesses put more weight on what they collect themselves. A first-party record does not need a cookie from another domain, because the person is already on the business's own site when it is written.
A worked example with one online bookshop
Follow one imaginary visitor through an imaginary bookshop to see which records are first-party and which are not.
- The visit. Ana opens the bookshop's site and searches its catalogue for "bread baking". The shop's own server logs the search. That is first-party data: collected directly, by the business, on its own site.
- The account. She creates an account to order a sourdough book, giving an email address and a delivery country. Also first-party.
- The preference form. After the purchase, a short form asks which subjects she wants news about, and she ticks "cooking". She shared that on purpose, so many would call it zero-party data.
- The partner. The bookshop agrees with a cookware shop to share lists of customers who like cooking. For the cookware shop, Ana's record is now second-party data: someone else's first-party data, passed across.
- The broker. An outside company that tracks people across hundreds of sites guesses that Ana "likes baking" and sells that label to advertisers who have never dealt with her. That is third-party data.
Only the first three steps happened between Ana and a business she chose to visit. Steps four and five moved her information to companies she never saw. That is the gap the summary table points to when it marks privacy risk low for first-party data and high for third-party data.
Is first-party data private by default?
Not on its own. Being first-party describes where data came from, not how much is kept or what happens to it next. A large shop can still build a detailed profile of each customer from its own records, and the same shop can still send that profile out to partners.
The Wikipedia section notes that companies can exchange first-party data securely using data clean rooms, setups built for exchanging such records securely. That reduces one risk. It does not change the fact that the data now serves two companies instead of one.
So a fairer check asks three questions. What exactly is recorded? Who else does it reach? How long does it stay? Data can pass the first question, coming straight from the customer, and fail the other two.
Ads that need almost no data at all
There is another route: an ad that needs no record of the person in front of it. Behavioral targeting picks an ad from a profile. A contextual or fixed placement picks it from the page or the site, and the visitor stays unknown.
On the vlvd ads privacy page, the people who see the ads get no cookies and no visitor id. A site sends only its own name, the kind of ad and which ads were already shown in that visit, a list the browser keeps until the tab closes, so the same ad does not appear twice. Views and clicks are counted per ad, per site, per day, as numbers only. Every ad, its picture included, loads from ads.vlvd.net, so an advertiser never sees who viewed it.
In that setup, the question "whose data is this?" mostly disappears. There is no profile to be first-party or third-party, only daily counts.
Frequently asked questions
Is first-party data the same as zero-party data?
Not quite. Zero-party data is what a customer shares on purpose, such as answers to a survey or a preference form. First-party data also covers what a site records while the person browses, such as pages opened and searches typed.
Can first-party data be used for retargeting?
Yes. The summary table in the Wikipedia section on data sources lists personalization and retargeting among its uses. A shop can show an ad to people who left items in its own basket.
Does first-party data need a cookie?
A site can use its own cookie, which is sent only back to the server that set it, but it does not need one from another domain. Account details and replies to a form can be stored with no cookie at all.
Why is third-party data seen as less accurate?
It is gathered by outside companies and combined from many sources, so labels about a person are often guesses built from scattered visits. First-party data comes straight from what the person did or said on one site.
Where first-party data in advertising is heading
As browsers block more cross-site cookies, the data behind an ad moves closer to the person it describes. First-party data keeps the record with the business that met the customer, which is why it is marked higher for accuracy and lower for privacy risk than data pieced together by outsiders. Yet "first-party" only names where the record began. How much is kept, how long it stays and who else receives it still decide how private an ad really is, and an ad that never needs a profile at all leaves the least behind.