A first-party data strategy is a written plan for which customer data you collect directly, why you need each piece, and how it feeds your ads, email and site. If you are collecting everything and using almost none of it, you don’t have a strategy. You have a storage bill.
This guide is for Australian e-commerce and DTC brands that want a plan they can run in a quarter. It covers the data types, a seven-step build, email capture, the Australian rules that apply, activation in paid media and the numbers to track.
Key takeaways
First-party data is what you collect directly from your own customers and audience. Zero-party data is what they tell you on purpose. Second- and third-party data come from someone else.
Start with one business question, such as lowering customer acquisition cost (CAC) or lifting repeat purchase, and collect only the data that answers it. BCG’s guidance is blunt on this: value comes from a defined use, not from volume.
In Australia, email and SMS marketing need consent and a working unsubscribe under the Spam Act. Tracking pixels need privacy due diligence under the Privacy Act.
Test one narrow use case, prove it, then expand. Most brands do the reverse and wonder why nothing pays back.
Table of Contents
What a first-party data strategy is (and the four data types it sits among)
Our view: strategy is a media problem, not a database problem
What a first-party data strategy is (and the four data types it sits among)
First-party data is information a business collects directly from the individual, online and offline. Think purchases, site behaviour, app activity, loyalty sign-ups and customer service logs. SmartCompany’s Australian guide describes it as information obtained through your own relationship with the consumer, including transaction history and browsing behaviour.
The four types differ in who gave it to you and how:
| Type | Where it comes from | Example | Your control |
|---|---|---|---|
| Zero-party | Customer states it on purpose | Quiz answers, preference centre choices | Highest |
| First-party | You observe it from their behaviour | Purchase history, browsing, email clicks | High |
| Second-party | A partner shares its first-party data with you | A co-marketing audience swap | Medium |
| Third-party | Aggregated and sold by outside vendors | Broker-built interest segments | Lowest |
The split between zero- and first-party matters more than most guides admit. Zero-party data is stated intent and preference; first-party data is typically observed behaviour. A purchase tells you what someone did. A quiz answer tells you why. You want both, because behaviour alone makes you guess at motive.
Third-party data is the weak link. The OAIC describes data brokers as collecting consumer data from other sources and selling or sharing it without a direct consumer relationship. You didn’t earn that data and you can’t vouch for how it was gathered. Build on what you own.
Why the “collect everything” habit fails
The unnamed crowd telling you to “capture every data point and sort it out later” is wrong, and it costs you in three ways.
Cost. Every field you store needs cleaning, matching and securing.
Friction. Every extra form field cuts completions. A seven-field signup form asks a stranger to do homework for a discount code.
Risk. Under the Privacy Act, you must limit use to the purpose you collected it for, and you must secure what you hold. Data you never use is pure liability.
BCG’s 29 March 2021 guidance gets the mechanism right: set organisation-wide goals, separate essential data from merely desirable data, cost the risks, then build a roadmap. Where it needs a caveat: BCG wrote for large enterprises with data teams. A brand turning over a few million dollars a year doesn’t need a roadmap with twelve workstreams. It needs one question and a spreadsheet.
How to build the strategy in seven steps
SmartCompany’s playbook runs eight stages: align with goals, design the data, acquire it, unify it, enrich it, activate it, analyse it and optimise it. We compress that for a small team into seven.
1. Pick one business question
Write it as a number with a deadline. “Cut blended CAC by 15% in two quarters” is a question. “Understand our customers better” is a mood.
2. List the data that answers it
If the goal is lower CAC, you need: which channels produce first orders, which customers buy a second time, and what those repeat customers have in common. That’s three data sets, not thirty. Anything else goes on a “later” list.
3. Map where each piece enters
Plot the customer journey and mark every point where data arrives: site visit, email signup, checkout, post-purchase survey, customer service, in-store or marketplace. Most brands find two or three gaps. The common one is the post-purchase moment, when the customer is most willing to tell you something.
4. Fix the tracking before you add collection
Browser tracking loses signal. Server-side setups recover some of it, but they also change what you must disclose and how you test. We cover the trade-offs in what server-side tracking fixes and what it breaks. Do this before you spend more on ads, because every ad dollar after that feeds a cleaner loop.
5. Unify it into one customer record
Match email, order ID and device signals into a single record per customer. For most DTC brands the store platform plus an email platform is enough. A customer data platform becomes worth the money when you run several channels and the same person appears under three IDs. Not before.
6. Activate one use case
BCG recommends starting with a specific business case and a narrow test-and-learn use case, expanding only after measurement shows value. A good first case: upload your top 20% of customers by lifetime value as a seed audience, and compare its CAC against your current prospecting audience.
7. Measure, then expand
Compare against a holdout. If the segment-based campaign doesn’t beat the broad one, you’ve learned that cheaply. If it does, add the next use case.
Email capture: the front door of the strategy
Email is the identifier that ties most first-party data together. It’s also the one you own outright. Shopify’s guidance lists the standard capture points: website and social forms, well-timed pop-ups and point-of-sale sign-ups, and says effective capture comes from simple forms, good timing and a relevant offer.
Three tactics that work for the mechanism, not the fashion:
Ask a micro-yes first. Shopify’s experts advocate a small, low-friction question before the email field. Why it works: a person who has already tapped “Skincare” or “Gifts” has started the interaction, and finishing feels cheaper than abandoning. It also gives you a zero-party signal before you have an address.
Trade value, not a coupon alone. Discount-only capture fills your list with people who buy once at a discount. Offer something matched to the segment: a fit guide, a restock alert, early access. (Offer design ≠ discount.)
Capture again after purchase. The order confirmation page is the highest-intent screen you own. One question there (“How did you hear about us?” or “What’s this for?”) costs a few seconds and returns attribution data that ad platforms can’t give you.
Once an address is in, what you send next decides whether it stays. Sequencing matters, and this guide to event email automation shows how a short automated series can be built around inbox rules. If you want the programme built and run for you, that’s what our email and SMS marketing team does.
Caveat: capture rate is not the goal. A pop-up that doubles signups and halves email engagement hurts deliverability. Track signup-to-first-purchase rate, not signups alone.
What Australian law requires
This section is general information, not legal advice. For a specific situation, such as health data, children’s data or a cross-border platform, see a privacy lawyer.
Email and SMS: the Spam Act 2003. You need express or inferred consent before sending commercial electronic messages. You must also keep records of who consented, when and how, because the ACMA can ask for proof. Every message needs an unsubscribe that is actioned within 5 working days, costs nothing and works for at least 30 days after sending. And you can’t hand off the risk: the ACMA says businesses are liable for their electronic marketing, including what an agency or platform sends for them.
Tracking pixels: the Privacy Act. The OAIC says organisations using third-party pixels must do due diligence, limit collection to what’s necessary, give clear privacy information and avoid covert collection. Sensitive information gathered through a pixel needs express consent. If you sell health-adjacent products, audit your pixel events now.
Collection and use rules. Under the Privacy Principles, personal information should generally be collected directly from the individual, and secondary use needs consent or another exception. For direct marketing, the OAIC notes that APP 7 requires a simple opt-out, though the Spam Act can displace it for covered messages. Note that the Privacy Act applies to entities that meet its coverage rules, so confirm whether your business is covered. The Spam Act applies regardless.
Privacy rules in Australia have been under reform, so check the OAIC’s site for current obligations before you finalise your policy.
Trust is the supply chain
Your data supply depends on people choosing to give it. The OAIC’s 2023 community attitudes survey found only 2 in 5 Australians feel most organisations are transparent about how they handle information, and 84% want more control and choice over collection and use. That’s a gap you can sell into.
What to do about it:
Say what you’ll do with the data at the point of asking, in one plain sentence beside the field.
Make the preference centre real. Let people pick frequency and topics, not just “unsubscribe from all”.
Don’t use data in ways that would surprise the person who gave it. If a customer shared a skin concern for a routine quiz, don’t retarget them with an ad that names it.
The OAIC’s own summary of trust is short: governance, transparency, consent and a simple opt-out. None of it is expensive. All of it is skipped.
Activating first-party data in paid media
This is where the strategy earns its keep, and where we see the most waste.
Customer list uploads. Hash and upload a list of your best customers to Meta or Google, then build lookalike or similar audiences from them. Why it works: the platform’s model learns from people who bought and came back, not just people who clicked. A list seeded with all buyers includes the one-time discount hunters. Seed with repeat or high-value customers and the audience skews toward people like them.
Suppression. Exclude existing customers from prospecting. If 15% of your prospecting spend reaches people who already bought, you’re paying acquisition prices for retention results. Check your own number; ours is a rule of thumb, not a benchmark.
Creative by segment. Use what the data says about why people buy to brief creative. A post-purchase survey that shows “gift” as the top reason should shape the next batch of ads, not just the email subject line. We run ad creative production and Meta and TikTok ads from the same brief for this reason: the person reading the numbers also briefs the creators.
On-site. First-party signals let you personalise the post-click experience: returning visitors see different proof, a different offer or a shorter path to checkout. That’s conversion optimisation work, and it’s where a clean customer record shows up as revenue. For retargeting without cookies, see our piece on mapping consent before reach falls.
What to measure
BCG advises using robust measurement of media reach and efficiency, data collection, revenue lift and other business outcomes. Turned into a scorecard:
| Metric | What it tells you | Review |
|---|---|---|
| Email/SMS list growth (net of unsubscribes) | Is collection healthy? | Monthly |
| Signup-to-first-purchase rate | Is the list worth having? | Monthly |
| Share of customers with a unified record | Is the data usable? | Quarterly |
| CAC: first-party-seeded vs broad audiences | Is activation paying? | Per test |
| Repeat purchase rate at 90 days | Is retention improving? | Quarterly |
| Revenue per email sent | Is the channel earning? | Monthly |
Set the baseline before you change anything. Without a before number, any after number is a story.
Nobody can tell you the “right” benchmark for your category from a blog post. Anyone quoting an average list-to-revenue figure without a source and a date made it up. Use your own baseline and the trend.
Our view: strategy is a media problem, not a database problem
Most first-party data projects fail at the hand-off. A data team builds the customer record. A media team runs the ads. A creative team makes the assets. Nobody owns the question the data was meant to answer, so the audience files sit unused and the CAC doesn’t move.
We run it as one senior team. The strategists who read the numbers also brief the creators and sign off the edit. That means a finding in the data (say, repeat buyers cluster around one product) turns into a creative brief and a test within the same week, not a slide in next quarter’s review. We aim to deliver at least 3 times your investment in us, and we say so because it forces the first question: what number are we moving?
Our advice is narrower than the usual playbook. Skip the platform shopping list. Pick one goal, fix tracking, capture one extra signal at checkout, build one seed audience and test it against your current prospecting. If it works, scale it. If it doesn’t, you’ve spent weeks, not a year.
— Harry Sekhon
Want a second pair of eyes on your data plan?
If your list is growing but CAC isn’t falling, the gap is usually between the data and the ads. We build and run that link across strategy, creative, paid media, conversion and email. See our full marketing services or talk to us through the Thrive site.
Bring your current tracking setup and your last 90 days of CAC. We’ll tell you plainly where the first test should go. If it’s easier, our growth strategy articles cover the surrounding decisions.
FAQ
What is the difference between zero-party and first-party data?
Zero-party data is what a customer deliberately tells you, such as quiz answers or preference choices. First-party data is what you observe from their behaviour, such as purchases and site visits. HubSpot’s framing is useful: first-party shows what someone did, zero-party shows what they want, so you use both together.
How do I collect first-party data without hurting conversion?
Ask for one thing at a time and give a reason. Put a one-tap question before the email field, keep forms short, and collect richer data after purchase, when intent is high. Measure signup-to-purchase rate, not signups alone.
Do I need consent to email Australian customers?
Yes. The Spam Act requires express or inferred consent for commercial email and SMS, a working unsubscribe, and records that prove the consent. If you’re unsure whether your list qualifies, get advice from a privacy or marketing lawyer before you send.
Is second-party data worth it?
Sometimes. It’s one company’s first-party data shared with another, so it’s cleaner than broker data, but it comes with the partner’s consent terms. Check that the people involved agreed to that use before you touch it, and start with a small test.
