First-party data strategy for US brands after cookies

Three forces converged. Apple's tracking restrictions removed most cross-site identity on iPhones, which carry over half of US mobile traffic. Ad platforms responded with conversion APIs that depend on advertisers sending hashed first-party identifiers. And US states passed a wave of privacy laws; by 2026, roughly twenty states have comprehensive statutes in force, most modeled on California's.

The practical effect for a mid-size business: retargeting pools shrank, lookalike audiences built on pixel data weakened, and acquisition costs rose. Brands that collect and activate their own data have offset this; brands that relied on platform data have not.

Collect only what you will use. Every field you ask for reduces completion rates by a measurable amount, typically 3 to 8 percent per additional required field on a form.

Tiered capture works best. Ask for email first, phone second once trust exists, preferences third through a quiz or preference center. A well-built quiz on a consumer brand site typically converts 10 to 25 percent of starters into email subscribers with declared preferences, far above a generic pop-up at 2 to 5 percent.

Progressive profiling for B2B. Capture email and company on the first download, role and timeline on the second, budget on a demo request. Never ask twice for something you already have.

Transactional data is the richest source. Orders, order frequency, categories, average order value, returns, support tickets. Make sure your commerce platform, CRM and support tool feed one customer record. This is usually the integration work that decides whether the strategy succeeds; see our approach to systems integration.

Messaging channels as data sources. A WhatsApp or SMS entry point that routes to forms and human support collects consented phone numbers and conversation context at the same time. Our WhatsApp automation work treats the entry point as both a service channel and a first-party data source.

US rules differ from Europe's, and copying a European cookie banner is both unnecessary and often insufficient.

State privacy laws (CCPA/CPRA and peers). Requirements that affect marketing directly:

• A privacy notice at or before collection stating what you collect and why.
• A "Do Not Sell or Share My Personal Information" link, or an equivalent "Your Privacy Choices" link, if you share data with ad platforms. Sending hashed emails or pixel data to Meta or Google is generally treated as sharing for cross-context behavioral advertising.
• Honoring Global Privacy Control browser signals as a valid opt-out. California enforces this actively.
• Rights to access, delete and correct data, answered within 45 days. Your email platform, CRM and data warehouse all need a deletion path.
• Limits on using sensitive personal information, which includes precise location, health, biometrics and financial account data.

TCPA for SMS and calls. Text marketing requires prior express written consent, with clear disclosure that consent is not a condition of purchase, message frequency and opt-out instructions. A pre-checked box does not count. Violations carry statutory damages of $500 to $1,500 per message, and class actions are common. Keep consent records with timestamp, source and the exact language shown.

CAN-SPAM for email. Accurate headers, a physical mailing address in every message, a working unsubscribe honored within 10 business days, and no deceptive subject lines. Opt-in is not legally required, but deliverability effectively requires it.

HIPAA if you are a covered entity or business associate. Pixels and analytics on pages that can reveal a person's health status have drawn federal enforcement and litigation. If you are a provider, payer or health-adjacent business, keep marketing tags off authenticated and condition-specific pages, or use a vendor that will sign a business associate agreement.

FTC rules. Your privacy notice must match your practices. Retroactive changes to how you use already-collected data require fresh consent. Dark patterns that make opting out harder than opting in are an enforcement target.

Children. COPPA applies under 13, and several states extend protections to under 16 or 18. If your audience includes teens, get legal advice before building audiences.

For most mid-size businesses, the customer data platform question has a simpler answer than vendors suggest:

1. Under about $10 million in revenue: your email/SMS platform (Klaviyo, Attentive, HubSpot or similar) is the customer record, fed by the commerce platform and forms. No separate CDP.
2. $10 million to $100 million: add a cloud data warehouse (BigQuery, Snowflake) fed by the commerce platform, GA4 export, ad platforms and CRM. Use a reverse-ETL tool to push segments back to activation channels. This is often called a composable CDP and costs a fraction of a packaged one.
3. Above that: evaluate a packaged CDP, but only after the warehouse model exists.

Whatever the size, maintain one identity key, usually a hashed email, and document every system that holds personal data so deletion requests can actually be fulfilled.

Rank by return and speed:

1. Lifecycle email and SMS flows. Welcome, abandoned cart or abandoned browse, post-purchase, replenishment, win-back. For US ecommerce brands, these flows typically produce 20 to 35 percent of email-attributed revenue on automated sends that cost almost nothing. Build these before any campaign calendar.

2. Conversion APIs and enhanced conversions. Send hashed first-party identifiers server-side to Meta, Google and TikTok. This restores a portion of the signal lost to browser restrictions and usually improves reported event match quality from poor to good within weeks. It is also what makes the next item work.

3. Customer-match audiences. Upload or sync hashed customer lists for suppression (do not pay to acquire existing customers), for lookalikes seeded on your best customers rather than all site visitors, and for retention campaigns. Match rates of 40 to 70 percent on US email lists are normal.

4. On-site personalization. Returning visitor recognition, category-based merchandising, cart recovery messaging. Start with rules, not machine learning.

5. Measurement. First-party identifiers allow you to tie ad exposure to purchases and to run cleaner incrementality tests. This is the hidden payoff: better data makes the whole budget smarter.

• Identified share of traffic and of revenue (what percentage of sessions and orders are tied to a known customer). Aim to grow this quarter over quarter.
• Opt-in rate per capture point, and completion rate per form.
• Flow revenue as a share of total revenue.
• Match quality scores in each ad platform.
• Repeat purchase rate and 90-day retention.
• Privacy request volume and time to fulfill.

• Collecting data you never activate. It is liability without return.
• Buying lists. Illegal for SMS, destructive for email deliverability.
• Separate consent records in five tools. Centralize them.
• Treating the privacy notice as boilerplate. It is the contract regulators test you against.
• Ignoring GPC signals because the banner vendor's default is off.
• Launching SMS without TCPA-compliant language reviewed by counsel.

First-party data touches brand, growth, web and automation at once, so we run it as one program through discover, plan, build, improve.

Discover. We inventory every system that holds customer data, map current capture points and their conversion rates, review consent language against CCPA/CPRA, TCPA and CAN-SPAM requirements, and quantify the identified share of revenue.

Plan. We define the identity key, the data model, the capture tiers and value exchanges, the compliance controls and the first three activation use cases, each with a target metric.

Build. We implement capture experiences on the site and in messaging channels, integrate commerce, CRM and email/SMS platforms, set up conversion APIs and audience syncs, and automate deletion and preference workflows through our AI and workflow automation practice.

Improve. We review opt-in rates, flow performance and match quality monthly, add activation use cases quarterly and re-audit compliance whenever a new state law takes effect.

Our WhatsApp Service Automation engagement is a representative example. The client needed one messaging entry point connected to forms, internal systems and human support. Every conversation created or enriched a consented customer record, with opt-in captured at the first interaction, and the same record then powered follow-up and reporting. The pattern applies to any channel: a service touchpoint, designed carefully, is also the most trusted place to collect first-party data.