First-party data in UK media buying

First-party data describes people you have an actual relationship with: customers, subscribers, visitors, enquirers. It is accurate in a way third-party segments cannot be, because it is observation rather than inference, and it is yours rather than licensed.

It is also the foundation for the derived audiences that work best on the platforms: suppression lists so you stop paying to reach existing customers, and lookalike modelling that finds people resembling your best ones.

The caution worth stating about lookalikes: they inherit every bias in the seed. Modelling on existing customers reliably finds more people like existing customers, which is not the same as finding growth, and for a business trying to enter a new segment it can be actively counterproductive.

Social platforms can use your list because they hold matching identifiers: they know the email address behind the account. Connected television, audio and out-of-home do not, which means activating a list there requires a shared identifier that neither party has to hand over in the clear.

The mechanism is a consent-based identifier derived from a hashed email or phone number, provided with consent, which lets a first-party audience be addressed across publishers without third-party cookies. European Unified ID is the implementation for Europe and the UK; it is built on the UID2 framework, its North American counterpart, and runs as a separate framework.

This route requires a signed agreement: EUID's own documentation says access comes with an appropriate participation agreement. Signing that contract is harder than the engineering, which is why the capability is more often described than delivered.

The phrase appears constantly in audience marketplaces and is weaker than it sounds. It means the data provider asserts that a consent chain exists back to the individual. It does not mean that anyone downstream has verified every link, and no buying platform can verify it on your behalf.

What a responsible platform can do is record the assertion and the conditions that come with it. AdBuyMCP's policy engine attaches a standing condition to every consent-chained source requiring the supply chain to be framework-validated and the vendor attestation verified on connection. That condition is a statement of what you still owe rather than confirmation it is done.

A data protection review turns on this distinction, and a manifest that records the basis and the outstanding condition gives the reviewer something to check.

On AdBuyMCP specifically: the client for the consent-based identifier is built and waits on an EUID participation agreement, and the connected-television compiler emits an empty identifier list. No compiled plan carries one. There is also no CRM connector and no account-list ingestion.

What does work is semantic definition: describing the audience in terms of sector, seniority, firmographics, interests and geography, which compiles into licensed marketplace segments (Bombora intent topics, Dun & Bradstreet firmographics) rather than into your own records.

That route targets licensed segments instead of your own records, so it is weaker than matching a list. If matching a named list is the requirement, the capability to look for is a live identifier integration with a participation agreement behind it, and it is worth asking any vendor to evidence rather than describe.