Collecting customer data and using it in ads are two different jobs. Data activation is the bridge: the step that turns CRM records, loyalty lists or warehouse segments into an audience a platform can actually target, suppress or bid on.
And it is where most first-party data dies. Experian’s 2025 Media Buying in Transition report found that 72% of marketers struggled to turn first-party data into media activation.
What data activation actually means
An audience only changes which ads run once it reaches a buying or selling system. That delivery can be an upload to Google or Meta, conversion events sent to a bidding algorithm, or a seller attaching its audience to a deal.
Most activation moves through five stages, and every stage can lose people:
- Selection: define a segment from source data, such as buyers in the past 90 days or lapsed subscribers.
- Preparation: normalise identifiers and hash them with SHA-256 so they can be matched consistently.
- Matching: the destination compares hashed values against its own users. Google puts the reachable share of a list at 1% to 99%, and one ISBA/PwC study matched around 11.6% of impressions end to end.
- Delivery: the matched audience becomes a Customer Match list, Custom Audience or DSP segment.
- Refresh: audiences decay, so pipelines resync on schedule. Google’s Customer Match memberships expire after 540 days, and a list needs at least 100 active members added or updated in that window.
Floor sizes and match rates decide feasibility
Platform minimums can disqualify a list before launch. OpenAI requires 25,000 matched users for targeting in ChatGPT ads. A 50,000-person file at a 40% match rate yields 20,000 people, too few to use there.
Who runs activation
On the buy side, it is CRM and data teams, agency data units and DSPs. The Trade Desk’s Galileo, launched on January 5, 2023, ingests first-party data through partners including Adobe, LiveRamp, Salesforce and Snowflake. StackAdapt added a Snowflake Native App so segments can be selected inside the warehouse. On the sell side, Walmart Connect put shopper segments into Yahoo DSP on May 28, 2026, and Magnite’s ClearLine Activate added 27 data partners.
Where the legal risk hides
Consent is the harder constraint. Norway’s Datatilsynet fined two Elkjop companies NOK 20 million, about EUR 1.85 million, on June 1, 2026, partly because loyalty club data was going to be reused for Customer Match without assessing whether the new purpose was compatible. IAB Tech Lab has argued the consent layer should mature before activation tooling.
Regulators also reject the idea that technical steps erase liability. The US FTC said in July 2024 that hashing is not anonymisation, and later warned that clean rooms do not clean data.
What to do about it
Treat activation as a monitored pipeline, not a one-time upload. Check match rates before you spend, schedule refreshes well inside Google’s 540-day window, and confirm consent covers the new use. If a suppression list fails to sync, automated bidding can waste budget in campaigns no one thinks of as audience-based.
Recent moves matter because destinations keep multiplying. LiveRamp connected customer lists to ChatGPT ads in 11 markets on September 28, 2026. Google began accepting IP addresses through Data Manager API in May 2026, excluding users in the EEA, UK and Switzerland. Each new input can lift match rates on paper; whether the matches are accurate and lawful is the part to verify.
Source: PPC Land
