What is first-party data?

Definition

First-party data is information a business collects directly from the people who use its own website, app, store or service, such as purchases, sign-ups and the pages they visit, rather than buying it from someone else.

Full glossary
Category
Data
Also called
first party data, 1st party data
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: support.google.com, ftc.gov

Last verified against the official page:

How we research this Report an error

Google's advertising policies describe first-party data as information a company collects from its customers, site visitors and app users when they interact with its products and services. The collection happens on the company's own properties or through direct contact: its website, its app, its shops, or a form you filled in.

What counts as first-party data

If you buy a pair of shoes online, the shop now has your name, delivery address, email and order history. If you sign up for a newsletter, it has your email. If you browse the site while logged in or with cookies on, it can record which pages you looked at. All of that is first-party data for that shop, because you dealt with it directly.

First-party data vs. third-party data

Third-party data comes from a company you never dealt with. A data broker collects it from many places, joins it into profiles, and sells it on. A 2017 FTC staff report on cross-device tracking describes marketers buying lists of emails or cookied browser links from list resellers and data brokers, where no first-party relationship exists between the person and the original company. That difference is the whole point: with first-party data you have at least met the business that holds it. With third-party data you often have no idea who has your details.

Why it matters to you

First-party data is not automatically safe. A business can still sell or share what it collects, and a breach of its systems exposes it like any other data. What does change is who you can ask. You know which company collected it, so you can use its privacy settings or send it a deletion request under laws such as the CCPA or GDPR. For data brokers, you usually have to find the listing first and then work out each opt-out.

The term is also in the news because advertisers are moving away from third-party cookies and leaning more on the data they collect themselves.

How to protect yourself

  1. 1

    Read what the business says it does with your data

    Check the privacy policy before you hand over details. Look for whether it shares or sells personal information, and for the settings or form it offers to opt out.

  2. 2

    Give the minimum

    Skip optional fields on sign-up and checkout forms. Use a separate email address for shops and newsletters so one leak does not expose your main account.

  3. 3

    Use your privacy rights

    Depending on where you live, you can ask a company what it holds on you and ask it to delete or stop selling it. Look for a 'Do not sell or share my personal information' link or a privacy request form.

  4. 4

    Check where else your details are listed

    Details you gave one business can end up with data brokers and people-search sites. Serus finds where your address and phone number are listed and removes them for you.

See it in action

Serus

See where your personal data is exposed

Serus finds it on data brokers and people-search sites and removes it.

Run a free scan

Frequently asked

What is an example of first-party data?

An email address you typed into a shop's newsletter form, your order history in that shop's account, or the products you viewed while using its app. Google's Ads help lists buyers, people who signed up for marketing messages and loyalty program members as examples of customer data you share directly with a business.

What is the difference between first-party and third-party data?

First-party data is collected by the business itself from its own customers and visitors. Third-party data is collected by another company, such as a data broker, and sold or shared with a business that has no direct relationship with you.

Is first-party data private?

Not necessarily. Collecting data directly does not stop a business from sharing it with partners or being breached. Its privacy policy and your account settings show what it does with the data.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Related research Scams, exposure, erasure: how people protect themselves online

Related terms

Full glossary

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.