What is first-party data?

The label is about who did the collecting. If your own website, till, app, warehouse scanner or sales team captured a record, it is yours in the first-party sense. Marketers use the phrase mostly for customer information, such as email sign-ups, order histories and the pages a logged-in user viewed. In a wider business sense it also covers machine logs, delivery timings, maintenance histories, call transcripts and anything else a company produces simply by operating.

Google's advertising policy describes it as information you collect from your customers, site visitors and app users, and contrasts it with information obtained from other sources. That contrast is the useful part. First-party records arrive with context: the business knows how they were gathered, what the people involved were told, and what gaps exist. Purchased files rarely come with that history.

• Transactions: orders, invoices, refunds, subscription changes, loyalty points.
• Behaviour on owned channels: page views, searches and clicks on the company's own site or app.
• Relationship records: CRM entries, support conversations, survey responses, account settings.
• Operational output: shipment scans, production yields, equipment telemetry, inventory movements.
• Content the business created: product catalogues, internal documentation, code, images it commissioned.

Information volunteered on purpose, such as a quiz answer about preferred sizes, is sometimes split off and called zero-party data. Most people still treat it as a subset of first-party collection.

This scenario is illustrative, not a real transaction. Suppose a regional logistics company runs a few hundred delivery vans. Every parcel is scanned at pickup, at each depot and at the door, so the firm has years of timestamped records showing how long freight takes to move between postcodes, by day of week and season. Nobody sold it those records. They are a by-product of its own work, which makes them first-party data.

A broker who spots this asks three questions before approaching buyers. Does the company own the records outright, or did a customer contract give its clients rights over shipment details? Do the scans contain anything personal, such as recipient names or exact home addresses? And can the useful signal survive if those fields are removed? Here the answer is that transit times between postcode areas, with no names and no house-level locations, keep most of the value.

The broker then introduces the logistics firm to a freight-analytics company that forecasts delivery delays. The analytics buyer licenses the cleaned file straight from the logistics firm, with the broker arranging terms. From the buyer's side, it is now another company's first-party data obtained by direct agreement, which many marketers would call second-party data. The label changes with the viewpoint; the provenance does not.

Most datasets worth brokering between companies start as someone's first-party records. That is good news for provenance, because the seller can explain how each field was gathered. It also puts the hard questions on the seller's side of the table. A buyer will want to know whether the company had the right to collect it, whether customers were told it might be shared, and whether any contract restricts reuse.

• Ask for the privacy notice and customer terms in force when the records were gathered, not just today's version.
• Check client contracts: a service provider often holds data on behalf of its customers and cannot license it as its own.
• Separate personal fields early. Selling personal information about people the buyer never dealt with can bring state data broker rules into play.
• Look for licences inside the data, such as third-party map tiles, images or code, that the seller cannot pass on.

The most frequent error is assuming that "we collected it" means "we can sell it". Collection gives practical control, not unlimited rights. Consent wording, sector rules and customer agreements can all narrow what a company may do. A second mistake is overrating volume. A huge first-party file can still be thin if it only covers one region, one customer type or one short period, and buyers notice quickly.