CDP & first-party data: foundations & core concepts

Ask four people in a marketing organisation what a CDPCDPSoftware that unifies customer data from every source into one persistent profile that marketing, sales and service teams can act on.View full definition → is and you get four answers: a database, a better CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, the thing the data team already built on the warehouse, a tag manager with ambitions. That confusion is expensive, because it usually gets settled by whoever is selling something.

The context that put the CDP on the agenda has moved too. Google spent years promising to remove third-party cookies from Chrome, delayed the deadline repeatedly, reversed course in July 2024, and in April 2025 confirmed the cookies stay and the planned opt-out prompt is dropped. The wall did not fall on schedule. That changes less than it sounds. Apple's App Tracking Transparency prompt, live since 2021, means most iOS users decline app tracking outright. Safari and Firefox have blocked third-party cookies by default for years. GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition →, the ePrivacy rules and a lengthening list of US state laws keep narrowing what you may collect and how you have to ask. Third-party reach is a shrinking, unreliable slice of the web whatever Chrome does.

So brands go back to the data they collect themselves, and to the system that holds it. This lesson defines that system and the vocabulary around it: what a CDP is, what first-party datafirst-party dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → means, what a profile and a golden record are, and where the CDP stops and the CRM, DMPDMPA Data Management Platform collects, organizes, and activates (often anonymous) audience data into segments used for ad targeting and personalization across channels.View full definition → and warehouse start. Matching rules, schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message.View full definition → and consent design belong to the methodology lesson; who owns the customer record across markets comes after that.

What is a CDP and why is it different

A customer data platform is software that collects customer data from every source your company touches, resolves it into persistent profiles of individual people, and makes those profiles available to other systems for use, close to real time.

Three properties do the work in that sentence:

• Persistent. The profile survives the session, the device and the campaign. It is a stored record that accumulates, not a report you rebuild each time you need it.
• Marketer-controlled. SegmentsSegmentsDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition →, traits and audiences can be built by the marketing team without an engineering release for every change. This is the property vendors oversell and buyers most often fail to get.
• Bidirectional. A CDP takes data in and pushes it back out. Data that only arrives and sits is a database.

Against the tools you probably already own:

• A CRM (Salesforce, HubSpot) manages known relationships and the work done on them: contacts, deals, tickets, calls. It records what your people did with a customer. It handles anonymous web behaviour, high-volume event streams and cross-device stitching badly or not at all.
• A DMP (data management platform) was built for anonymous, mostly third-party audience segments used to buy programmatic media. It works with cookie and device IDs rather than named individuals, and its data decays in weeks. Oracle shut its advertising business, which included the BlueKai DMP assets, in 2024. That tells you how the model aged.
• A data warehousedata warehouseA central repository that consolidates data from many source systems into a structured, query-optimized store designed for analytics, reporting, and business intelligence.View full definition → (BigQuery, Redshift and the like) stores large volumes of history and answers analytical questions well. It is built for query, not for getting an audience into Meta by 9am.
• A tag manager or consent platform collects and governs signals. Neither one builds a profile.

A CDP overlaps all of these and replaces none of them cleanly. Segment (owned by Twilio, and a CDP vendor) made the category mainstream by treating event collection as infrastructure. Adobe Real-Time CDP and Salesforce Data Cloud sell the same promise to enterprises already inside their suites, which is often the real reason either one gets bought.

One pattern to know before you shop: the composable, or warehouse-native, CDP. Rather than copying your data into a separate vendor system, tools such as Hightouch and Census sit on top of the warehouse you already run and activate the data where it lives. If your company has spent two years and a serious budget line building that warehouse, ask why you would now pay to duplicate it.

Key sub-concepts every CMO must own

Sub-concept 1: first-party, second-party and third-party data

First-party data is what you collect from your own customers and prospects, through your own channels, with their consent: site and app behaviour, purchase history, email engagement, loyalty activity, service conversations, survey answers. It is accurate because it comes from real interactions with you, and it is defensible because you can show how it was collected.

"You own it" is the sloppy shorthand. You hold it under permission, for stated purposes, and the person can withdraw that permission. The distinction decides what you are allowed to build on top.

Second-party data is somebody else's first-party data shared with you deliberately: a retailer giving a supplier purchase data on its own shoppers, an airline and a hotel group matching members for co-marketing. Contractual, sourced, usually paid for.

Third-party data is aggregated audience data bought from brokers such as Acxiom or Experian. Broad, cheap, and increasingly hard to prove either accurate or lawfully sourced.

Sub-concept 2: the unified customer profile

The profile is the working unit of a CDP. One record per person, holding identifiers (email, phone, loyalty number, device and cookie IDs), attributes (city, tier, lifetime spend), events (viewed, added, purchased, returned, complained) and consent states per channel and purpose.

Two things make it useful. It carries anonymous behaviour and named history in the same record, so the browsing someone did three weeks before they registered joins their history the moment they log in. And it updates as signals arrive rather than in a nightly batch, which is what lets a suppression list be right today instead of right last Tuesday.

Identity resolution is the process that produces profiles: deciding that the email opened on Monday, the mobile session on Tuesday and the in-store purchase on Saturday belong to one person. How you write those rules, and how much confidence you demand from each match, is the methodology lesson. What matters here is that the profile is the output of rules somebody chose, not a fact the software discovered.

Sub-concept 3: the golden record

Profiles contain contradictions. Two spellings of a surname, three addresses, an old work email and a personal one, a phone number that belonged to the previous account holder.

The golden record is the reconciled version: one preferred value per field, selected from the conflicting inputs, plus one consent state you can act on. The profile is everything you know, mess included. The golden record is the answer you use when systems disagree, and every downstream tool inherits it.

Which means somebody has to decide, field by field, which source wins: the checkout address or the loyalty address, the till email or the app email, the most recent value or the most verified one. Vendors call these survivorship or precedence rules. They are editorial decisions with commercial consequences, and they belong to you rather than to a vendor default.

Sub-concept 4: data activation

Activation is sending profiles, or slices of them, into the systems that spend money and talk to customers. Suppress last week's buyers from acquisition campaigns. Trigger a reminder 72 hours after an abandoned basket. Push your top decile of spenders into a Meta custom audience. Give a service agent the last three orders before they pick up the call.

Without a CDP in the middle, each of those is a manual export, a ticket and a wait. The number worth watching is not how many profiles you hold, it is how many of them a channel actually used last month.

Real-world cases with results

Case 1: tesco clubcard

Tesco launched Clubcard in 1995, with the analysts who went on to become dunnhumby. There was no CDP category then: the mechanics were a plastic card, a till receipt and a mainframe. What it proved is this lesson's point. One persistent record per household, built entirely from data the retailer already generated, changes what a retailer knows. Tesco's then chairman Lord MacLaurin reportedly told the presenters that they knew more about his customers after three months than he had learned in thirty years.

Three decades on, Clubcard covers roughly 20 million UK households, and the same record does several jobs: member-only pricing on shelf, personalised coupons, range and assortment decisions, and a retail media business run with dunnhumby that sells suppliers targeting built on that data. Note what Tesco pays for it. Member pricing is a permanent discount, funded by the retailer. First-party data is bought with something, usually price, convenience or status.

Case 2: sephora

Sephora's Beauty Insider programme has more than 30 million members in North America, and the company has said loyalty members account for around 80% of transactions. The mechanism is the profile: purchases tied to a member ID at the till, app behaviour, browsing, sample and service history, all in one record that feeds recommendations in email, app and on site.

The interesting part is where collection happens. A shade match recorded at a Sephora counter, or a class booking, becomes a profile attribute that changes the next message. The store is part of the collection layer, not only the selling layer. Which vendor sits underneath matters less than the discipline: one identifier presented at every touchpoint, and a reason for the customer to present it.

CMO action items

• Write the definitions down for your own company, on one page: what counts as a profile, which identifiers you actually capture at each touchpoint, and what your golden record rules are today. There are some already, even if nobody wrote them. If no one can produce that page, you have your first finding.
• Establish whether you have a CDP layer or a CRM with a segment builder. The test: can a marketer build an audience from anonymous plus known behaviour and send it to two channels this week, without a ticket? Then book demos with a packaged CDP (Segment, Adobe Real-Time CDP) and, if you already run a warehouse, one composable option. Ask each how they price: per profile, per event, per destination.
• Pick two activation use cases for the first 90 days, both cheap and measurable: suppressing recent buyers from acquisition campaigns, and a lapsed-customer trigger. They tell you whether the plumbing works before you commit to anything ambitious.

Common mistakes that kill results

Mistake 1: buying a CDP to create data you never collected

A CDP unifies what you feed it. It invents no identifiers. If checkout does not capture an email you can match, if store staff never ask for the loyalty number, if the app and the site name the same event two different ways, the platform will faithfully unify nothing and you will blame the software. Collection and naming come first; the licence does not fix either.

Mistake 2: treating first-party data as property

Data held under permission is not data you own. Purposes, retention periods and withdrawal all bind you, and the fines are real: Ireland's Data Protection Commission fined Meta 1.2 billion euros in 2023 over transfers of European user data. Get consent capture and storage working before you scale collection, and store the consent state on the profile itself, not in a separate tool nobody queries. Consent platforms (OneTrust, Cookiebot) handle the capture; the profile has to carry the result.

Mistake 3: confusing volume with data quality

A CDP full of duplicates, dead addresses and mismatched devices personalises worse than a smaller clean set, because it acts on confident wrong answers. Sephora's advantage comes from 30 million records that are accurate, consented and updated, not from the count. Data hygiene is an operating discipline with an owner and a budget line, not a migration task you finish.

Key takeaways

• A CDP collects data from every source, resolves it into persistent individual profiles, and pushes those profiles back out to other systems. Persistent, marketer-controlled, bidirectional: if a tool fails one of the three, it is something else.
• The CRM holds relationships and the work done on them, the DMP holds anonymous audience segments for media, the warehouse holds history for analysis. The CDP connects to all three and substitutes for none of them.
• First-party data is collected through your own channels with consent. You hold it under permission rather than own it, and you buy it with price, convenience or status. Clubcard's discount is the honest version of that cost.
• The profile is everything you know about one person, contradictions included. The golden record is the reconciled version you act on, and choosing which source wins each field is a decision you make, not a default you accept.
• Google keeping third-party cookies in Chrome changed the deadline, not the direction. Safari and Firefox still block, ATT still suppresses mobile signal, regulation still tightens.