First-party data has quietly become the most valuable asset in performance marketing. It is not a new format: it is the purchase history in a retailer’s CRM, the login records of a publisher, the app events a brand’s SDK captures and the customer number collected at checkout. What changed is that browsers, mobile operating systems and regulators made data that travels between companies far harder to use. Data you collect directly still carries a consent basis at the point of collection, so it remains usable when third-party signals are not.
The pipeline from collection to activation
Collection happens through a website tag or an in-app SDK that logs views, searches, basket additions and purchases. Forms and loyalty schemes add emails, phone numbers and customer IDs. As browser scripts get blocked, more advertisers move to server-side collection, where their own server forwards events to ad platforms.
Then comes governance. Under GDPR, consent must be freely given, specific, informed and unambiguous. That permission travels as a signal – a TC String, a Global Privacy Platform string or a Google Consent Mode state. Google began enforcing Consent Mode V2 for UK and EEA advertisers on 21 July 2025.
Unification is where many teams lose performance. Records are stitched in a CRM or CDP, normalised – trimmed, lowercased, phone numbers set to international format – and hashed with SHA-256 into a 64-character string. A formatting error is not rejected at upload; it simply fails to match later. Activation then means uploading audiences, sending conversion events or running clean-room analysis.
Where owned data gets used
On the buy side, Google’s Customer Match has accepted uploaded email lists since September 2015, and Meta custom audiences work on the same principle. Google recommends at least 5,000 members per list and caps membership at 540 days.
On the sell side, publishers use Google’s PPID – a hashed or encrypted string of 22 to 150 characters – for frequency capping and targeting without third-party cookies. Prebid and IAB Tech Lab’s Curated Audiences send numeric audience codes in OpenRTB instead of identifiers.
- Buy side: hashed lists feed Customer Match, custom audiences and enhanced conversions for attribution.
- Sell side: publisher-provided IDs and Curated Audiences keep frequency and segmentation alive without cookies.
- Clean rooms: two parties combine datasets in a governed environment, and only aggregate results leave.
Why the numbers are suddenly promising
The promise is concrete. A Deloitte Digital report commissioned by Meta found 18 percent lower acquisition costs and 27 percent higher conversion rates for businesses using first-party data for tailored experiences. That research has a commercial sponsor, so treat it as directional. Google’s own data strength framework reports an 11 percent average Search conversion lift from enhanced conversions – also self-reported.
But the real shift is operational. Owned records determine how much budget finds known customers, how well automated bidding is fed and how accurately sales are credited.
The weak points to fix before you scale
Scale is the first limit: you only know people who have bought, subscribed or logged in, so prospecting still needs other sources. Quality is next. In a September 2026 Firmable survey of 222 B2B professionals, respondents estimated 32 percent of CRM records were inaccurate, incomplete or outdated.
Law and consent are the sharpest risk. On 1 June 2026, Norway’s Datatilsynet fined two Elkjop companies NOK 20 million, about EUR 1.85 million, after a loyalty club bundled consent and reused data for Customer Match without a compatibility assessment. A single misconfigured consent banner cut one agency account’s conversions by 90 percent overnight. The FTC also warns that hashed data is not anonymous; a hash is a persistent identifier.
What to do about it
Make consent mature before activation tooling, as IAB Tech Lab’s guidance argues. That means collecting valid consent at the moment of data collection, monitoring that the signal reaches Google’s tags, and cleaning and normalising records before every upload. Move Customer Match uploads to the Data Manager API, since older Google Ads API routes closed for inactive developers on 1 April 2026.
Do not confuse hashing with anonymisation, do not bundle consent for unrelated processing, and do not let one vendor’s stack quietly become your only measurement layer.
Source: PPC Land
