First-party data

First-party data is customer data a business collects directly through its own channels: website, app, sign-up forms, CRM, orders, call center and loyalty program. The business knows where the data came from and what the customer agreed to let it be used for.

What is first-party data?

Typical examples: the name and phone number a customer leaves on a quote request form, purchase history on the website, in-app behavior, loyalty card points, a sales rep’s notes in the CRM. What they have in common is that the data comes from a direct relationship between the customer and the business. Nobody bought it from someone else.

In advertising, first-party data is used in three main ways:

• Building audiences: upload customer lists to Google (Customer Match) or Meta to reach past customers again, exclude them from new-customer campaigns, or find people with similar traits (Google Ads Help, About Customer Match, accessed October 2026).
• Measuring conversions more accurately: send server-side events through the Conversions API or Google’s Enhanced conversions.
• Personalizing email, Zalo ZNS (business notification messages sent through Zalo, a Vietnamese messaging app) and offers based on purchase history.

First-party data vs. other types of data

Why is first-party data getting so much attention in 2025 and 2026?

In Vietnam, the main reason is the law. Personal Data Protection Law No. 91/2025/QH15 was passed by the National Assembly on June 26, 2025 and took effect on January 1, 2026 (Vietnam Government Portal, Law No. 91/2025/QH15, June 2025). The law strictly prohibits buying and selling personal data, unless another law provides otherwise (Chinhphu.vn, Notable provisions of the 2025 Personal Data Protection Law, December 2025). A purchased list of phone numbers is therefore no longer a usable lead source.

Decree 356/2025/ND-CP replaces Decree 13/2023/ND-CP and also took effect on January 1, 2026. According to EY, the new decree requires consent to be clear, recorded and verifiable as to when it was given and what it covered, and consent cannot be pre-selected by default (EY Vietnam, Legal Alert, March 2026). Data you collect through your own forms, with a separate consent checkbox, is data whose origin you can prove.

Measurement is the other reason, since tracking through browsers and devices keeps getting weaker.

A Vietnam example (hypothetical)

A spa chain in Ho Chi Minh City has 25,000 customers in its booking software but no idea who has agreed to receive ads. The chain adds two separate consent checkboxes (receive messages on Zalo, and use my phone number to show me ads), records when each customer ticks them, then uploads to Meta and Google only the customers who ticked the second box. The list is smaller, but it can be used to exclude existing customers from new-customer campaigns. To pull data from many stores and channels into one place, businesses usually need a CDP (customer data platform).

Frequently asked questions

Is a purchased phone number list first-party data?

No. That data was collected by another party, usually without proof of customer consent, and buying and selling personal data is now banned by law.

Has Chrome dropped third-party cookies?

No. In April 2025, Google said it would keep the current approach of letting users choose in Chrome’s settings and would not roll out a separate prompt about third-party cookies (Google Privacy Sandbox, April 2025).

This entry summarizes regulations for reference only and is not legal advice. If you want to review your lead forms and how customer data is fed into your ads, Adtek’s Lead Generation team can go through it with you. Reach us via the contact page.