First-party data in UK media buying

First-party data describes people you have an actual relationship with: customers, subscribers, visitors, enquirers. It is accurate in a way third-party segments cannot be, because it is observation rather than inference, and it is yours rather than licensed.

It is also the foundation for the derived audiences that work best on the platforms — suppression lists so you stop paying to reach existing customers, and lookalike modelling that finds people resembling your best ones.

The caution worth stating about lookalikes: they inherit every bias in the seed. Modelling on existing customers reliably finds more people like existing customers, which is not the same as finding growth, and for a business trying to enter a new segment it can be actively counterproductive.

Social platforms can use your list because they hold matching identifiers: they know the email address behind the account. Connected television, audio and out-of-home do not, which means activating a list there requires a shared identifier that neither party has to hand over in the clear.

The mechanism is a consent-based identifier derived from a hashed email or phone number, provided with consent, which lets a first-party audience be addressed across publishers without third-party cookies. The European implementation and its North American counterpart are the two that matter.

The requirement is an operator agreement rather than a setting. That is the honest reason this capability is more often described than delivered: the engineering is tractable and the contract is the constraint.

The phrase appears constantly in audience marketplaces and is weaker than it sounds. It means the data provider asserts that a consent chain exists back to the individual. It does not mean that anyone downstream has verified every link, and no buying platform can verify it on your behalf.

What a responsible platform can do is record the assertion and the conditions that come with it. AdBuyMCP's policy engine attaches a standing condition to every consent-chained source requiring the supply chain to be framework-validated and the vendor attestation verified on connection — which is a statement of what you still owe rather than confirmation it is done.

For a data protection review this distinction is the whole conversation. A manifest that records the basis and the outstanding condition is useful; a claim of compliance is not.

On AdBuyMCP specifically: the consent-based identifier adapter is an explicit non-transacting stub pending an operator agreement, and the connected-television compiler emits an empty identifier list. No compiled plan carries one. There is also no CRM connector and no account-list ingestion.

What does work is semantic definition: describing the audience in terms of sector, seniority, firmographics, interests and geography, which compiles into licensed marketplace segments — Bombora intent topics, Dun & Bradstreet firmographics — rather than into your own records.

That is a weaker route and it is the honest one. If matching a named list is the requirement, the capability to look for is a live identifier integration with an operator agreement behind it, and it is worth asking any vendor to evidence rather than describe.