First-party data

For most of the last two decades, targeting and measurement ran on identifiers the business did not own: third-party cookies, device identifiers, data bought from brokers. That layer has been dismantled by a combination of regulation, browser policy and platform decisions, and it is not coming back.

What is left is what a business collected itself, from people who dealt with it directly. That is a smaller dataset and a better one: it describes actual customers rather than inferred segments, and it does not depend on a technology anybody can switch off.

The practical uses are concrete. Matched audiences for targeting and suppression, lookalike modelling built from real customers, offline conversion import so the ad platform learns which leads were worth having, and measurement that survives the loss of client-side tracking.

Which makes it the client most durable marketing asset, and the reason the governance around it matters more than the tactics that use it.

The interfaces make this feel like a configuration step. Choose a file, map the columns, name the audience. It is not a configuration step: it is sending personal data about identified people to a third party, and it needs a lawful basis like any other disclosure.

The specific trap is purpose. Consent collected for a newsletter covers sending a newsletter. It does not automatically cover passing the same address to an advertising platform to build a matched audience, unless the privacy notice the person actually read said so.

Legitimate interest is sometimes argued as the basis instead, and sometimes correctly, but it requires a balancing assessment rather than an assumption, and in the EU the ePrivacy rules sit alongside GDPR rather than being replaced by it.

The point for an agency is narrower than the law: it is that the question has to be asked before the upload, of someone at the client who can answer it. An agency that uploads because the account manager sent a spreadsheet has made a decision that was not theirs to make.

Platforms require identifiers to be hashed before upload, usually SHA-256, and the interfaces present this as the privacy protection. It is a real protection and it is narrower than it appears.

What it does is prevent the platform reading the plaintext addresses of people who are not already its users. What it does not do is prevent matching, since the platform hashes its own user list the same way and compares. Matching is the entire point, so a mechanism that prevented it would be useless.

It also does not change the legal character of the transfer. Hashed personal data is still personal data where it can be matched back to an individual, which is precisely the situation here. The GDPR treats pseudonymisation as a safeguard, not as an exemption.

So hashing belongs in the conversation as a reason the transfer is proportionate, not as a reason it does not need a basis. The distinction matters because the first is defensible and the second is not.

Three things, agreed in writing, before any list moves anywhere. Who is the controller and who is the processor, which for an agency is almost always the client and the agency respectively. What the agency may do with the data. And what happens to it on the day the relationship ends.

That third one is the one nobody raises at kickoff and everybody needs at the end. Audiences built inside the client ad accounts stay with the client. Lists sitting in an agency tool, a shared drive or somebody laptop do not, and an agency holding a former client customer list with no agreement about it is a problem waiting for a lawyer.

A data processing agreement covers most of this and exists for exactly this purpose. It is not exotic paperwork; it is the normal instrument, and it is far easier to sign in week one than to negotiate during an offboarding.

The other habit worth having is to build audiences inside the client own accounts rather than the agency. It is better for the client, it removes the offboarding question entirely, and it costs nothing except the ability to reuse the work somewhere it should not be reused anyway.