First-party data for small businesses: what to collect and why

First-party data is what customers and visitors give you directly, on channels you own: orders, email addresses from your forms, what they clicked in your emails, and answers to questions you ask. For a small business, five kinds are worth collecting: orders with their source, a contact for each lead, consent, email and text engagement, and the answer to "how did you hear about us?". Each of them makes ads, email and reporting better; collecting more than that adds risk without adding value.

This guide covers what to collect, what each piece is for, what to leave out, and the rules that apply.

Why it matters more now#

The data that used to fill the gaps is going away. Safari blocks third-party cookies and limits script-set cookies to 7 days without a visit; Apple removes click ids from links in Mail, Messages and Private Browsing; iPhone apps need permission to track. See iOS and Safari tracking changes.

What still works is what your customers give you. A sale matched to an ad by a hashed email does not depend on a cookie or a click id. See offline conversions explained.

What to collect#

Asking customers directly, such as the "how did you hear" question or a preference in a signup form, is sometimes called zero-party data. It is the only way to learn about the sources that never leave a trace in analytics.

What to leave out#

Data protection law says personal data must be "adequate, relevant and limited to what is necessary" for its purpose, and the UK regulator is blunt: "You must not collect personal data on the off-chance that it might be useful in the future" (ICO; the EU text is GDPR Article 5). In practice:

• Date of birth, gender, full address unless you ship to it or the product needs it. Every field on a form costs signups.
• Full IP addresses and device fingerprints. Analytics does not need them.
• Personal data in URLs and analytics. Emails in page addresses or UTM tags end up in reports and in other companies' logs. Google asks you never to send it to Google Analytics (Google).
• Old data with no use. Set a retention period, such as deleting leads that never bought after two years, and follow it.

Using it for ads#

Two common uses, with their own rules:

• Sending conversions back. Hashed email and phone on a lead or sale let Google and Meta match it to an ad click. See the Meta Conversions API guide.
• Customer lists. Uploading customers to target them or exclude them, such as Google's Customer Match, which reaches customers across Search, YouTube, Gmail and Display (Google). Google sets its own policy on who may use it and which data may be uploaded (Google).

Hashing does not make the data anonymous. Where the law asks for consent to use data for advertising, as it usually does in the EU and UK, a customer who declined must not be uploaded. Say in your privacy notice which ad platforms receive data.

A worked example#

Example numbers, made up for illustration. A garden center with an online shop and a store:

1. Checkout and the newsletter form collect email, with a separate box for marketing consent.
2. The analytics tool ties each order to the visit's source. The order email ties later orders to the same customer.
3. A one-question card after checkout asks how they heard about the shop. In spring, 22 percent answer "a friend" or "the local paper", sources the analytics showed as Direct.
4. Each month, orders from customers who consented go back to Meta and Google with hashed emails.

Result: the owner learns the local paper brings repeat buyers worth twice the Instagram ones, and moves budget. None of it needed a third-party cookie.

Where Sporetag fits#

From Sporetag's code and help: in 90-day tracking, a visitor who gives an email in a form, at checkout or through the identify call becomes one profile with every visit, click, email, text and order, and their first and last source. Emails and phone numbers are hashed with SHA-256 for matching, and anonymous profiles are deleted 90 days after the last visit. The "How did you hear about us" card asks once per person and shows answers next to the tracked source, on paid plans. Private mode, the default, stores nothing on the device.

Common questions#

What is first-party data?

Data your business collects directly from its own customers and visitors, through its own website, store, forms, emails and conversations, as opposed to data bought from or collected by another company.

What is the difference between first-party and zero-party data?

Zero-party data is what customers tell you on purpose, such as preferences or how they heard about you. First-party data also includes what you observe, such as orders and email clicks.

Do I need consent to collect first-party data?

You need a lawful basis for each use. Fulfilling an order needs no marketing consent, but emailing offers, storing data on the device for analytics in the EU and UK, and uploading customers to ad platforms usually do.

How much first-party data does a small business need?

Enough to answer three questions: where customers come from, which ones come back, and which leads buy. Orders, a contact per customer, their source and their consent cover all three.

Sources#

• ICO: Principle (c): Data minimisation. Checked October 2026.
• GDPR: Article 5, principles relating to processing of personal data. Checked October 2026.
• Google: About Customer Match, Customer Match policy, Best practices to avoid sending PII. Checked October 2026.
• Figures marked as examples are made up for illustration.