Architecture decisions with d-dat.
composable vs full CDP, vendor selection, compliance framework
// guide · first-party data
First-Party Data Strategy: Starting Without a CDP.
As third-party cookies erode, first-party data has become a strategic differentiator. But "strategic" is just a word; for most teams it's still vague where to begin, what tools to choose and how to wire compliance. This guide proposes a composable framework that starts without a CDP, scales gradually, and goes live in 4-6 weeks.
// short answer
First-party data is what customers give you on your own properties (web, app, store, call centre); it survives cookie loss, has legal basis under GDPR/CCPA, and feeds ad platforms and agentic AI directly. Composable CDP starting stack: data warehouse (BigQuery / Snowflake) + Reverse ETL (Hightouch, Census) + CRM/email (HubSpot, Klaviyo) — about 80% of full-CDP value at 1/10th the cost. Initial build: 4-6 weeks. Activation: Google Customer Match, Meta Custom Audiences, email segments, on-site personalization. This guide walks the architecture, GDPR/CCPA framework, 10-step rollout and the five most common mistakes.
// table of contents
// 01First, second, third-party — what's the difference?
"Data" in marketing covers three different categories; conflating them collapses strategy. Clean definitions:
| Type | Definition | Example | Compliance risk |
|---|---|---|---|
| First-party | Data collected on properties you own | Site signup, order history, email open behaviour, store CRM | Low (with managed consent) |
| Zero-party (subset) | Data customers actively give you | Preference centre, surveys, quiz answers, "recommend me X" | Lowest |
| Second-party | Another company's first-party data shared with you | Co-marketing, retailer analytics | Medium (consent chain critical) |
| Third-party | Data bought or aggregated from someone else | Ad-network segments, Lotame, Acxiom | High (compliance exposure) |
The biggest structural shift in marketing 2024-2026 is third-party dying, first-party rising. The forces driving it are technological (cookie loss) and legal (GDPR + CCPA + DPDP) — both pointing the same direction.
// 02Why start without a CDP?
A CDP (Customer Data Platform — Segment, mParticle, Tealium, Treasure Data) sounds like a single-shot answer for customer data. In reality:
- Cost: $50K-500K/year; per-event pricing means it scales with you.
- Build time: 3-6 months; often becomes another business-side project.
- Vendor lock-in: data model and tagging contracts are CDP-specific; exit cost is high.
- Ownership: CDP holds the data on its own infrastructure; your warehouse control is limited.
In return CDPs offer three real advantages: (1) turn-key channel coverage, (2) real-time identity resolution, (3) built-in segmentation UI. When all three matter — for example, real-time personalization across a 100M+ user base — the CDP is the right answer. For most mid-market brands an alternative pattern has rapidly matured since 2024: the composable CDP.
// what is composable CDP?
Collect customer data into the warehouse you own; layer activation via reverse-ETL; segment in SQL inside the warehouse. Data stays with you, no vendor lock-in, cost 1/5 - 1/10. Hightouch, Census and RudderStack are the foundational tools.
// 03The composable architecture: 3 layers
The composable first-party stack is three layers, each a separate purchase but all speaking open standards.
Layer 1: Data warehouse
Where the single source of truth lives. Options:
- Google BigQuery — cheap and fast inside GCP; native GA4 export.
- Snowflake — multi-cloud, strongest ecosystem; the mid-to-large market default.
- AWS Redshift — for AWS-native shops.
- Managed PostgreSQL — fine for starting out; ~$200/mo.
Layer 2: ETL/ELT (sources → warehouse)
Order DB, web events, CRM, payment system — all should flow into the warehouse. Tools:
- Fivetran — most mature, most expensive; 200+ connectors.
- Airbyte — open source alternative, self-hosted or cloud.
- Stitch — Talend-owned, mid-priced.
Layer 3: Reverse ETL (warehouse → activation channels)
The "segment is ready, now ship it to the ad platform / email tool" layer:
- Hightouch — market leader, broadest destination list (200+).
- Census — second alternative, simpler pricing.
- RudderStack — open-source + cloud, dev-friendly.
Total cost: $500-2000/month — about 1/10th of a full CDP.
// consulting
Get in touch →
// 04Sources: what should you collect?
What you collect depends on your business and intended activations. A practical checklist:
Customer identity
- customer_id — your system's primary key.
- email — basis for hashed matching.
- phone — E.164 format; critical for WhatsApp / SMS.
- device_id / mobile advertising id — iOS IDFA and Android AAID, where consented.
Behaviour and engagement
- Order history — order date, items, basket value, discount.
- Web/app events — page view, add-to-cart, abandoned cart.
- Email engagement — opens, clicks, unsubscribes.
- Support contact — complaints, questions, NPS responses.
Preferences and consent
- Channel preferences — email yes/no, SMS yes/no, WhatsApp yes/no.
- Category interest — what the user picked or what behaviour implies.
- Consent records — date, IP, form version, withdrawal date if applicable.
- Regional opt-ins — TCPA-style express written consent for SMS in the US, etc.
// data minimization
A core GDPR principle is collecting only what you need for stated purposes. "Maybe we'll use this someday" data creates compliance risk. For each field, answer "which marketing action will this drive?". No answer → don't collect.
// 05GDPR + CCPA compliance framework
First-party data strategy is inseparable from compliance. Three jurisdictional surfaces:
GDPR (EU)
Marketing use of personal data requires explicit consent or legitimate interest as legal basis. Practically, marketers default to opt-in consent.
- Explicit, affirmative consent (default checkbox unchecked).
- Privacy notice link clear and accessible.
- Withdrawal-of-consent path on every email + footer.
- Data subject rights (DSAR) channel defined.
CCPA / CPRA (California)
"Sale" and "sharing" of personal information must be disclosed; users have right-to-opt-out, right-to-know, right-to-delete. Limit-use of sensitive personal information.
TCPA (US, SMS)
Express written consent for marketing SMS; "stop" mechanism; quiet hours.
Consent Mode v2 integration
For consent collected on-site to flow to advertising platforms, Consent Mode v2 is the protocol layer. See the conversion tracking guide for setup. Consistency between cookie-banner categories and consent records in your warehouse is a frequent audit question.
// 06Activation: turning data into revenue
You've piped data into the warehouse and segmented it. Now what?
Path 1: Ad platforms (hashed audiences)
- Google Customer Match — hashed email/phone list across Search + YouTube + Display.
- Meta Custom Audiences — same data into Meta; basis for Lookalikes.
- TikTok Customer File — same shape on TikTok.
The Reverse ETL tool hashes and pushes; e.g. "customers with > $200 spend in 90 days" becomes a Lookalike seed.
Path 2: Direct comms (email, WhatsApp, SMS)
- Klaviyo / HubSpot / ActiveCampaign — segment-based email automation.
- WhatsApp Business API — VIP communications, abandoned-cart nudges. See WhatsApp BA guide.
- SMS — high urgency, low cost (TCPA constraints in the US).
Path 3: On-site / in-app personalization
- Returning customer sees abandoned-cart reminder.
- Hero banner swaps by segment.
- Recommendations weighted to inferred category interest.
Path 4 (modern): feeding agentic AI
Autonomous marketing agents (e.g. d-lens) take first-party data as input. Hand the agent "high-value but lapsed 60+ days" and it designs a reactivation campaign, picks creative, sets budget, monitors results.
// 0710-step rollout roadmap
First-Party Data Setup
- Assign ownership — one data analyst + one marketing-ops owner + a privacy advisor (for compliance). 1 week
- Source mapping — which system holds which data? Excel "source catalogue". 3-5 days
- Warehouse selection + setup — BigQuery / Snowflake / Postgres; production + dev. 1 week
- ETL/ELT integration — Fivetran / Airbyte to pipe orders, CRM, web events, email into the warehouse. 2 weeks
- Identity stitching — same person, multiple IDs across channels. SQL stitching: email + phone + customer_id chain. 1 week
- GDPR / CCPA / TCPA review — forms, banner, unsubscribe flows. Privacy + tech together. 1 week
- First segment design — VIP (top 10%), reactivation (60-180 days lapsed), abandoned cart (24h), brand-loyal (3+ categories). 3-5 days
- Connect Reverse ETL — Hightouch / Census push segments to ad platforms and email tool. 1 week
- First activation campaigns — VIP WhatsApp invite, reactivation email series, Google Customer Match Lookalike. 2 weeks
- Monitoring + dashboard — segment growth, activation CTR/CR, ROAS comparison (first-party vs broad targeting). 1 week
// 08Five common mistakes
Mistake 1: Leaving compliance for last
Cause: "tech first, legal later" instinct. Result: data without lawful basis piles up; activation can't run until cleanup. Fix: compliance framework defined in week 1, before tech build.
Mistake 2: Skipping identity stitching
Cause: the same customer appears as "anon_id_X" on web, "ali@x.com" in email, "customer_id 123" in orders. Without stitching they look like three people. Fix: SQL stitching with email + phone as anchors; customer_id and anonymous_id chained.
Mistake 3: Going too big at once
Cause: "let's buy a CDP, design 50 segments, wire everything" — 6 month project, ambiguous outcome. Fix: first 4 segments + 3 activation channels live in 4-6 weeks, then scale.
Mistake 4: Collection without activation
Cause: data piles up; nothing connects to action. Classic "data lake → data swamp". Fix: for each field, pre-answer "which segment, which campaign?".
Mistake 5: Segment design left to one analyst
Cause: the data analyst pulls a segment in SQL; business doesn't validate "what does this mean for the product?". Fix: every segment ships with business sign-off; technical sufficiency isn't enough.
// 09FAQ
Will I never need a CDP?
You might. Composable CDP hits limits at scale: real-time 100M+ user base, millisecond personalization, complex identity resolution. At those scales a full CDP earns its cost. Until then composable covers ~80% of value; if you migrate later the warehouse layer is already in place — migration cost is contained.
BigQuery or Snowflake?
If you're inside the GCP ecosystem (Google Ads + GA4 + Looker), BigQuery is the default. Multi-cloud or AWS/Azure-leaning: Snowflake. Pricing varies by workload; small-and-scaling tends to favour BigQuery. Decide in a week — more research stops returning ROI fast.
Is Reverse ETL mandatory? Why not manual CSV uploads?
You can — but it's not sustainable. Manual cadence breaks; segments age; you end up advertising to last month's snapshot. Reverse ETL automates sync, guaranteeing fresh segments daily. The $200-1000/month tool typically pays back in the first month.
Is real-time identity resolution worth chasing?
For most mid-market businesses, batch (daily) identity resolution is enough. Real-time is genuinely useful for: live personalization, fraud detection, real-time bidding scenarios. If those aren't your core use cases, daily is fine.
How does agentic AI use first-party data?
First-party data is the highest-value fuel for agentic AI. Agents (e.g. d-lens for ad optimization, d-reach for segmentation) become dramatically more performant when fed first-party data. Cookie-only data drives small-scope analysis; first-party + Consent Mode v2 underpins agents that drive strategic decisions.
How do retail/store data fit in?
Three approaches: (1) POS integration via webhook (cleanest, near-real-time); (2) daily CSV/SFTP transfer (simple, 24h lag); (3) Reverse ETL pulling from POS — less universal. Ask your POS provider about webhook support; if available, prefer it.
This guide was prepared by d-dat, an agentic AI marketing platform. Get in touch for composable CDP architecture, GDPR/CCPA framework or agent setup; explore d-lens for performance auditing.
// relatedRelated glossary terms.
Quick definitions for the concepts referenced in this guide:
// next step
Own the data. Activate it.
Composable CDP architecture, compliance framework or first-party activation — book a free 30-minute scoping call with d-dat.