First-party data is information a business collects directly from the people it deals with; third-party data is information about those same people assembled by outside companies that have no relationship with them. The gap between first-party vs third-party data is where most privacy law lives. Direct collection carries the lightest compliance load because the person knowingly engaged with the collector. Data purchased from brokers triggers the strictest consent rules, the heaviest disclosure obligations, and the sharpest enforcement attention from regulators on both sides of the Atlantic.
What Counts as First-Party Data
When you buy something online, create an account, sign up for a newsletter, or contact customer support, the company records that interaction. Your name, email, purchase history, and browsing behavior on that company’s own site are first-party data. The defining feature is the direct relationship: you handed the information to the business, and the business holds it in its own systems. That direct connection tends to make first-party data more accurate and more legally defensible than data gathered by outsiders, because the person involved knowingly engaged with the collector.
Zero-party data is a narrower slice of the same category. Instead of passively logging what you do, a company explicitly asks what you want through preference centers, quizzes, surveys, or account settings where you state your interests. Because you volunteered the information on purpose and understood what it would be used for, zero-party data carries the clearest possible consent signal, which matters as automated tracking faces tighter restrictions.
What Counts as Third-Party Data
Third-party data comes from companies that have no direct contact with you. These entities, often called data brokers, scrape, purchase, and stitch together fragments of online activity from dozens of unrelated websites, apps, and public records. The resulting profiles can include demographic details, estimated income ranges, browsing habits, and purchasing patterns. Businesses buy these packaged datasets to reach people who have never visited their site.
The accuracy problems are predictable. Because no single source verifies the full picture, third-party profiles often contain stale or conflicting information. A profile might correctly identify your age bracket but wildly misread your interests because it confused your browsing with someone else on a shared device. That unreliability, combined with the absence of a direct consent relationship, is why regulators have increasingly targeted third-party data practices.
Second-party data sits between the two. It is another company’s first-party data, shared through a direct partnership. A hotel chain and an airline, for example, might agree to share customer booking data for a joint loyalty program. Both parties know exactly where the data came from and can negotiate specific terms for its use. The transparency of these arrangements generally makes second-party data easier to defend under privacy frameworks that require clear data provenance.
How Each Type Is Collected
First-party collection is straightforward. Registration forms capture information you type in, and server-side analytics log clicks, page views, and session behavior within the company’s own infrastructure. The data stays in one place, controlled by one entity.
Third-party tracking is more complex. Tracking pixels and cookies placed by outside advertising networks fire signals back to those networks whenever you load a page. Cookies then follow you across every site in the network, building a cross-site behavioral profile. In mobile apps, Software Development Kits serve the same function, collecting device identifiers and location data. Application Programming Interfaces shuttle all of this between advertising platforms, analytics services, and data brokers in near real time.
The technical infrastructure behind third-party tracking is fragmenting. Safari and Firefox blocked third-party cookies years ago. Google announced plans to remove them from Chrome as well but reversed course in July 2024, opting instead to let users manage cookie preferences in their browser settings. European regulators have accelerated the shift. In late 2025, France’s data protection authority imposed nearly half a billion euros in combined fines against major platforms for deploying cookies without clear prior consent. Organizations are responding by investing in first-party identity graphs built from authenticated logins, data clean rooms that let companies match datasets without exposing raw records, and server-side tracking that moves data processing off the user’s browser entirely.
Legal Rules That Apply to First-Party Data
First-party data is not unregulated. It is regulated through a different mix of rules than third-party data, and the compliance obligations depend on what the data is, who holds it, and where the person lives.
The FTC Act and Broken Promises
Section 5 of the FTC Act prohibits unfair or deceptive practices in commerce. If a company’s privacy policy promises to protect your data and the company fails to follow through, the Federal Trade Commission can bring an enforcement action. The agency defines a practice as deceptive when it misleads consumers in a way that is material to their decisions, and as unfair when it causes substantial injury that consumers cannot reasonably avoid.1Federal Trade Commission. Privacy and Security Enforcement This authority is broad enough to reach almost any company that handles personal data and makes representations about how it will be used.
Sector-Specific Rules That Follow the Data
Federal privacy law in the United States is sector-based, so the type of first-party data determines which statute applies. Health information collected by hospitals, insurers, and healthcare providers falls under the Health Insurance Portability and Accountability Act, which limits use to specific purposes and restricts how outside vendors can touch the data.2U.S. Department of Health and Human Services. Business Associates Financial data collected by banks, mortgage brokers, tax preparers, collection agencies, and check cashers falls under the Gramm-Leach-Bliley Act, which requires a written information security program with encryption, multi-factor authentication, and disposal of customer data no later than two years after its last use unless retention is legally required.3eCFR. Standards for Safeguarding Customer Information Information collected from children under 13 falls under the Children’s Online Privacy Protection Rule, which requires verifiable parental consent before collection and carries civil penalties of up to $53,088 per violation.4Federal Trade Commission. Children’s Online Privacy Protection Rule (COPPA)
State Consumer Rights
At least twenty states have enacted comprehensive consumer privacy laws that create rights for individuals and impose data-handling obligations on businesses. Most share a common set of rights: to know what data has been collected, to delete it, to correct inaccurate information, and to limit the use of sensitive personal data such as precise geolocation, biometric identifiers, and financial account numbers. Businesses typically have 45 calendar days to respond to access, deletion, or correction requests, with a possible 45-day extension if they notify the consumer. Penalties tend to range from roughly $2,500 per unintentional violation to $7,500 or more for intentional violations or those involving minors’ data, though some states have adjusted these figures upward for inflation.
GDPR Consent for EU Customers
If a U.S. company sells to European customers or tracks their website behavior, the General Data Protection Regulation applies regardless of where the company is based. Every instance of data processing must rest on one of six lawful bases: consent, contract necessity, legal obligation, protecting vital interests, a public interest task, or legitimate interests balanced against the individual’s rights.5GDPR.eu. Art. 6 GDPR – Lawfulness of Processing Consent must be freely given, informed, specific, and unambiguous. Pre-checked boxes and bundled agreements don’t qualify. This opt-in model is fundamentally different from the opt-out approach most U.S. state laws take, where collection is permitted by default and consumers must affirmatively object. Serious GDPR violations can reach 20 million euros or 4% of global annual turnover, whichever is higher.6GDPR.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines
Legal Rules That Apply to Third-Party Data
Third-party data attracts a heavier compliance load because the person the data describes never dealt with the collector. Two frameworks do most of the work: the Fair Credit Reporting Act on the federal side, and state opt-out rights on the consumer side.
FCRA and the Proposed Data Broker Rule
The Fair Credit Reporting Act limits who can obtain a consumer report and for what purpose. Reports can only be furnished when the requester has a permissible purpose, typically a credit decision, employment screening, insurance underwriting, or a business transaction initiated by the consumer.7Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Marketing does not qualify.
A rule proposed in December 2024 would expand the FCRA’s reach by classifying data brokers that sell information about a consumer’s credit history, credit score, or income tier as consumer reporting agencies. If finalized, those brokers would be barred from selling consumer data unless the buyer has a permissible purpose, and would have to follow accuracy standards and give consumers the right to dispute inaccurate records. The rule would also treat personal identifiers like names, addresses, and Social Security numbers as consumer reports themselves when collected to prepare consumer reports, sharply limiting who can buy them.8Federal Register. Protecting Americans from Harmful Data Broker Practices (Regulation V)
State Opt-Out Rights
The comprehensive state privacy laws described above give consumers a right to opt out of the sale of their personal data and out of targeted advertising built from cross-site tracking. Opt-out requests typically have shorter response windows than access or deletion requests, often around 15 business days. Because these rights target the sale and disclosure of data, they land hardest on businesses whose model depends on third-party data flows.
GDPR Consent and Cross-Border Transfers
Under the GDPR, buying third-party data about EU individuals without a valid lawful basis is a violation regardless of whether the buyer ever contacts those individuals. Consent obtained by the original collector must be specific enough to cover the downstream use, and legitimate interests must survive a balancing test against the individual’s rights. When third-party data crosses out of the EU, the transfer must be authorized by an approved mechanism, whether that is the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another approved method. Companies relying on Standard Contractual Clauses are increasingly expected to document a Transfer Impact Assessment evaluating whether the destination country’s laws provide adequate protection.
Contracts Between Data Buyer and Seller
Where the GDPR governs, sharing personal data with another company requires a written Data Processing Agreement covering the types of data, the purpose of the processing, confidentiality obligations, security measures, and what happens to the data when the contract ends. The vendor can only act on the controller’s documented instructions and must allow the controller to audit its practices.6GDPR.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines Outside the GDPR context, U.S. data licensing is governed almost entirely by contract. Licensing agreements set the commercial boundaries: how long the buyer can keep the data, whether it can be combined with other datasets, whether resale is allowed, and what happens if either party terminates the relationship.
Who Actually Owns the Data
No U.S. federal statute declares that you own your personal data the way you own a car or a house. Rights over data are carved out through a combination of privacy statutes, which give you specific rights like deletion and access, and contracts, which define what the company can do with the data it collects. When you click “I agree” on a terms-of-service document, you are typically granting the business a license to use your information for the purposes described in the agreement.
The company generally owns whatever insights it derives from your data. A retailer that analyzes millions of purchase records to build a demand-forecasting model owns that model, even though the underlying transactions came from individual customers. The raw data points remain subject to privacy laws and the rights those laws grant you, but the aggregated analysis becomes the company’s intellectual property.
Portability rights reflect the same line. Under the GDPR, you can request a copy of the personal data you provided in a structured, commonly used, machine-readable format, and have it transmitted directly to another company where technically feasible.9GDPR.eu. Art. 20 GDPR – Right to Data Portability Several U.S. state laws include similar provisions, generally requiring a “portable and readily useable format” and limiting requests to twice per 12-month period. Portability rights generally don’t extend to proprietary analysis or trade secrets derived from your data. You can get back what you put in, but not what the company built from it.
Breach Notification Applies to Both
Whether the compromised information was collected first-hand or purchased from a broker, breach notification rules apply once it is in your systems. All 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands require companies to notify consumers when a data breach compromises their personal information. Notification deadlines typically run from 30 to 60 days after discovery, though some jurisdictions require notice “as soon as possible” without specifying a fixed window.
Financial institutions covered by the Gramm-Leach-Bliley Act must notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers. If the encryption key itself was compromised, the data is treated as unencrypted regardless of the technical setup.10Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Because every state has its own statute with its own definition of personal information and its own notification window, a single breach affecting customers in multiple states can trigger dozens of different legal obligations at once. A breach response plan needs to account for the strictest applicable deadline, which in the fastest states is effectively immediate.