Zero-party data is information a customer intentionally and proactively shares with a brand: preferences, purchase intentions, personal context, and how they want to be recognized. Forrester Research introduced the term in 2017. It differs from first-party data because nobody observed or inferred it. Someone was asked a question and chose to answer. Quizzes, preference centers, surveys, and conversations produce it.
Read ten marketing glossaries on this term and you get the same page ten times: the definition above, a four-column table, a list of quizzes and pop-ups, and one justification. Third-party cookies are going away, so start collecting what customers hand you directly. That justification expired in April 2025, and almost nobody has updated the page.
This guide covers the taxonomy, what changed with cookies and why the idea survived it, the four things declared data contains, six places the ask can live and what each costs the person answering, the surface every glossary leaves out, and the consent record you need before storing an answer.
Key Takeaways
- The defining feature is intent, not ownership. First-party data comes from watching your own properties. Zero-party data exists because someone was asked and decided to answer.
- The standard justification is out of date. Google confirmed in April 2025 it will not deprecate third-party cookies in Chrome, and the UK Competition and Markets Authority released Google’s Privacy Sandbox commitments on 17 October 2025 (gov.uk, August 2026).
- The idea survives that reversal for a better reason. Behavior tells you what a person did. Only an answer tells you what they intend, and 61% of consumers do not believe brands use their data in their best interest (Twilio State of Customer Engagement Report, 2025).
- Every ask is a trade. The person spends attention and gets something specific back. Asks that skip the return half get abandoned partway through.
- Nine of the ten surfaces in a typical guide need site traffic. Forms, quizzes, and preference centers all sit on a website. Brands whose audience lives on social need a surface that works where the attention already is.
- Consent is judged on how you asked, not what you collected. GDPR requires it to be freely given, specific, informed, and unambiguous, given by a clear affirmative action.
What Is Zero-Party Data?
Zero-party data is what a customer deliberately gives you, knowing they are giving it, usually in exchange for something. Forrester’s definition covers four things: preference center data, purchase intentions, personal context, and how the individual wants the brand to recognize them (forrester.com, August 2026). The category exists because marketers kept filing declared answers and observed behavior under one heading, and the two behave nothing alike.
A person clicking three product pages is first-party data. The same person typing “I’m buying this as a gift” is not. The first is a signal you interpret. The second is a statement you can act on without interpreting anything.
Zero-Party vs First-Party vs Second-Party vs Third-Party Data
The four categories are usually taught by who holds the data. Sorting them by who produced it, and by what makes each stop working, is more useful.
| Type | Who produced it | How you get it | Example | What breaks it |
|---|---|---|---|---|
| Zero-party | The customer, on purpose | You ask, they answer | ”Buying for someone else”, “Email me monthly”, a stated budget or size | Their preference changes and nobody updates the record |
| First-party | The customer, incidentally | You observe your own site, app, or store | Pages viewed, orders placed, emails opened, support tickets | Blocked tracking, logged-out sessions, guest checkout |
| Second-party | Another company’s customers | A partner shares its first-party data with you | A co-marketing partner’s opted-in list | The partnership ending, or consent that never covered you |
| Third-party | People you have no relationship with | You buy it from an aggregator | Inferred household income, propensity scores, modeled segments | Accuracy decay, browser blocking, regulatory scrutiny |
Two practical differences follow. The top row is the only one where the person knows you hold the record, which is why it carries the least reputational risk. It is also the only one that goes stale for a human reason rather than a technical one: somebody’s size, budget, or interest changes, and nothing in your stack notices until you ask again.
The Reason Everyone Gives For This Has Expired
The standard argument runs like this: third-party cookies are disappearing, so brands need what customers give them directly. The first half of that sentence is no longer accurate.
Google planned to phase out third-party cookies in Chrome, moved the date from 2022 to 2024 to 2025, then shifted in July 2024 to a user-choice model with a standalone prompt. In April 2025 it confirmed it would not roll out that prompt and restated its intention not to deprecate third-party cookies at all. Chrome keeps its existing privacy settings instead. The UK Competition and Markets Authority then issued its decision to release Google’s Privacy Sandbox commitments on 17 October 2025 (gov.uk, August 2026).
Google went further on the same date, retiring most of the replacement technology it had spent six years building, including Topics, Protected Audience, Attribution Reporting and Private Aggregation, and keeping only a small remainder such as CHIPS, FedCM and Private State Tokens (privacysandbox.google.com, October 2025).
Safari and Firefox still block third-party cookies by default, so the picture is mixed rather than reversed. What ended is the deadline. The industry spent five years telling marketers to prepare for a date that never arrived.
Three reasons to ask customers directly survive that news, and they are stronger than the one that expired.
Inference cannot produce intent. Behavior tells you what somebody did, not why, who for, or what next. A person viewing running shoes four times might be a runner, might be gift shopping, might be checking prices for a friend. Three different follow-ups, one identical signal.
Trust is the constraint now, not tracking. Twilio’s 2025 State of Customer Engagement Report found 61% of consumers do not believe brands use their data in their best interest, and that 88% are more likely to buy when engagement is personalized in real time while only 44% of brands say they execute at that level (twilio.com, 2025). Better inference does not close a trust gap. Asking does.
Regulation targets the method, not the cookie. GDPR governs personal data regardless of the technology that captured it. A cookie-free system collecting email addresses without valid consent is exactly as exposed as a cookie-based one.
What Zero-Party Data Actually Contains
Forrester’s four categories translate into concrete fields.
Stated preferences. Product categories, content topics, sizes, dietary restrictions, style. The information a recommendation engine tries to reverse-engineer from clicks and gets partly wrong.
Purchase intentions. What they plan to buy, who it is for, what problem it solves, roughly what they expect to spend, and when. The highest-value field, and the one behavior almost never reveals cleanly.
Personal context. Birthdays, renewal dates, the fact that they have a dog or a small kitchen or three team members. Details that make a message land as relevant rather than as targeting.
Communication preferences. Which channel, how often, about what. The field most brands ask for last and should ask for first, because getting it wrong produces unsubscribes that good targeting never recovers.
A test for any field you are about to collect: could you have guessed it from behavior? If yes, it is first-party data with extra steps. If no, it is worth the ask.
Where the Ask Lives, and What Each Surface Costs
Every collection method is a trade. The person spends attention, and the design of the surface decides how much. Sorting the options by cost explains why some produce ten fields and some produce one.
| Surface | What you learn | What it costs the person | Where it falls down |
|---|---|---|---|
| Sign-up form | Email plus one or two fields | About 10 seconds | Needs traffic already on your site |
| Product quiz | Five to twenty attributes at once | 60 to 90 seconds | Build effort, and drop-off partway through |
| Preference center | Channel, frequency, topics | About 30 seconds | Only reaches people who already subscribed |
| Post-purchase survey | Why they bought and who for | About 30 seconds | Only reaches buyers, after the decision is made |
| Social poll or sticker | One attribute, no identity attached | Two seconds | Anonymous, so it cannot be joined to a person |
| Conversation | Stated intent plus contact, per person | One message | Bound by platform reply windows |
Four rules separate asks that get answered from asks that get abandoned.
Name the trade before the question. “Answer three questions and get a fit recommendation” beats three questions with no stated return, because the person can price the exchange before spending anything.
Ask for one thing at a time. A quiz holds twenty questions because each is small and the progress is visible. A form demanding six fields at once reads as an interrogation.
Deliver in the same session. Value that arrives in a Tuesday newsletter teaches people the next ask is not worth answering.
Make refusal cheap. A skippable question gets honest answers from the people who answer it. A required one gets fake answers from everybody.
One test decides whether a question earns its slot: if both answers lead to the same follow-up, the question is decoration. These four pass it.
| Business | The question | Options | What the answer changes |
|---|---|---|---|
| Coach | What are you working on first? | Fat loss / Strength / Both | Which case study opens the sequence |
| Skincare brand | What is your skin doing right now? | Dry / Oily / Breaking out | Which product the first email shows |
| Course creator | Where are you starting from? | No audience / Under 1,000 / Already selling | Which module preview goes out |
| Multi-site studio | Which location is closest to you? | Three named areas | Which timetable and offers they receive |
Closed choices beat open text on every one of them. Three named options can be stored, counted and segmented. A pile of free-text sentences cannot be acted on at volume.
The Collection Surface Most Guides Skip
Look again at that table. Forms, quizzes, preference centers, and post-purchase surveys all sit on a website, and all assume the person already arrived there. For a brand whose audience lives on social, that assumption does most of the damage. The attention is on the platform, the form is on the site, and the gap between them is where the record never gets created.
The conversation closes that gap, and it has a property no form has: the person opens it. Someone who comments a keyword under a post or replies to a Story has named an intent unprompted, before you asked anything. Every other surface has to buy attention before it can ask a question. This one starts with the question already answered, leaving only the contact field to request.
Two platform clocks shape the exchange. When someone comments on a post or Reel, you can send one private reply, and it has to go out within seven days. Once a person messages you, you have 24 hours to respond, and messages inside that window can carry promotional content (developers.facebook.com, August 2026). One permitted message to a commenter means the trade has to be complete in a single send: what you are offering, what you need to send it, and enough context to agree.
Those two clocks leave room for four asks, in order. The trigger word is the first and cheapest: offering two keywords under one post instead of one turns the trigger itself into a question, answered before any message exists. The single private reply is the second, and it should request the contact address and nothing else. The 24-hour window that opens when the person replies is the third and the highest-response moment in the sequence, because they are already typing. Delivery of the asset is the fourth, since people answer more readily after they have received something than before.
Tools built for this run the exchange on a keyword. Someone comments a word, the reply goes out in seconds, and an email gate asks for the address before the link. CreatorFlow does this with keyword triggers, Story reply automation, a Follow Gate and an Email Gate on paid plans, plus click tracking and clicks by country and city, so you can see which post produced which record. It is a Meta Tech Provider (since December 2025) running on the official Instagram API, and Pro is $15 per month flat regardless of how many contacts you collect. Contacts export to CSV for whichever email tool you already use.
Two adjacent pieces go deeper on the platform side: what Instagram’s API returns about an engaged follower covers the seven fields Meta hands over, and this breakdown of social media personalization maps which kinds of data support which depth of personalization. If you are weighing surfaces directly, the comparison of link-in-bio forms against DM capture runs the arithmetic on 1,000 engaged viewers.
The Consent Record You Need Before You Store an Answer
Someone volunteering information does not by itself make the record lawful to keep and use. GDPR judges consent on how it was obtained: freely given, specific, informed, and unambiguous, given by a clear affirmative action. Silence, pre-ticked boxes, and consent buried in terms and conditions do not qualify (iapp.org, August 2026).
Three parts of that standard catch people out. Specific means one purpose per consent: permission to send a lead magnet is not permission to send a weekly newsletter, and permission for email is not permission for SMS. Informed means the person knew who you are, what you will send, and how to stop it at the moment of the ask, rather than in a footer they never opened. Freely given means refusal has to be real, so gating the thing behind marketing they do not want produces weak consent.
Store four items with every record: the exact wording shown, what the person typed or selected, the timestamp, and the surface it came from. That set is what turns a database row into something you can defend. Keeping the answer without the ask leaves you holding data you cannot prove you were allowed to collect. Once the records are clean, keeping them organized in one place is what makes them usable.
How to Tell Whether It Is Working
Most reporting here measures collection volume and stops. Three numbers say more.
Completion rate per surface. Of the people who started the quiz, form, or conversation, how many finished. Under 50% usually means the trade was priced wrong, not that the audience was uninterested.
Records per 1,000 engaged viewers. Volume divided by reach, so the figure survives a viral post and a quiet week equally. This tells you whether a channel produces anything durable or only produces impressions.
Share of records carrying a stated attribute. An email address alone is a contact. An email address plus what the person said they wanted is a segment, and only the second one lets the next send change.
Run those monthly against a single question: how many people told us something this month that we could not have guessed? That is the only output this work has.
FAQ
What is the difference between zero-party data and first-party data?
Zero-party data is what a customer deliberately tells you: preferences, intentions, context. First-party data is what you observe on your own properties: pages viewed, purchases made, emails opened. Both are collected without an intermediary, so both are yours. The distinction is that one is interpreted behavior and the other is a stated answer that needs no interpretation.
Is zero-party data still worth collecting now that third-party cookies are staying?
Yes, for reasons unconnected to cookies. Google confirmed in April 2025 that it will not deprecate third-party cookies in Chrome (gov.uk, August 2026), which removes a deadline rather than a rationale. Observed behavior still cannot tell you what someone intends or who they are buying for, and bought data cannot tell you either. An answer can.
What are examples of zero-party data?
Quiz responses about skin type or fitness goals, a stated budget range, a size or dietary restriction, a birthday given in a sign-up form, a preference for monthly rather than weekly email, a note that a purchase is a gift, and the keyword someone types to request a specific resource. Anything the person chose to state.
Do you need consent to use it for marketing?
Usually yes. Volunteering information is not the same as consenting to marketing. Under GDPR, consent must be freely given, specific, informed, and unambiguous, given by a clear affirmative action, and it covers one purpose at a time (iapp.org, August 2026). Store the wording shown, the answer given, and the timestamp for every record.
How do you collect zero-party data without a website?
Ask on the surface where the audience already is. Social polls and Story stickers collect one anonymous attribute each. A comment keyword or Story reply opens a conversation where you can ask for both an attribute and a contact address, with the intent already declared by whatever word the person typed. Meta allows one private reply within seven days of a comment, and a 24-hour window once somebody messages you (developers.facebook.com, August 2026).
Is zero-party data the same as Customer-First Data?
Not quite. Customer-First Data is Klaviyo’s trademarked term for zero-party and first-party data taken together (klaviyo.com, August 2026). Grouping them makes sense when the subject is privacy, since neither category is bought from a broker. It blurs the distinction that matters for personalization, where a stated answer and an observed click do different jobs.
Is survey data zero-party?
Yes, when it is your survey, your customers, and the respondent knows the brand is asking. A survey run by a research panel on your behalf, where the respondent never sees your name, produces second-party data instead. The test is whether the person knew who they were telling.
Definition and category framing verified against Forrester’s published definition; cookie deprecation status verified against the UK Competition and Markets Authority case record and the Privacy Sandbox announcements of 22 April and 17 October 2025; consent standard verified against IAPP guidance on GDPR opt-in; Instagram messaging windows verified against Meta developer documentation. All as of August 2026. Individual results vary.
