How to Use First-Party Data in Programmatic Advertising

Most brands already own more useful advertising data than they realise. Every lead form, app install, abandoned cart and repeat order says something about who buys from you. First-party data is simply that information, collected directly from your own visitors and customers, with their consent.

Having it is rarely the problem. The work is getting it into your buying platform in a usable form, then pointing it at jobs where it saves money. DV360 is the example throughout, but the principles apply to any DSP.

What counts as first-party data?

First-party data is information you collect yourself: site visits, app events, form fills, purchases and CRM records. It is different from data you borrow or buy.

To make it concrete, take an illustrative D2C skincare brand. Its first-party data might include 3 lakh monthly site visitors, 40,000 people who added to cart without buying, and 1.2 lakh past buyers. For an NBFC, it could be loan applicants who stopped at the KYC step. Both are far more specific than any interest segment on sale.

Why does first-party data matter more now?

Because borrowed identifiers are less dependable than they were. Safari and Firefox block or restrict third-party cookies by default. Google said in July 2024 that it would not remove third-party cookies from Chrome and would focus on user choice instead, and in October 2025 it announced it was retiring most of its Privacy Sandbox technologies, including Topics and Protected Audience. So the cookie has not vanished, but you cannot build a plan on it alone. On iPhones, apps must ask permission before tracking people across other companies' apps and websites.

Your own data is also the only data that tells you who already bought. That fact alone saves money, as the worked example further down shows.

How do you get first-party data into DV360?

There are five main routes. Most advertisers use two or three of them.

For many teams the GA4 route is the easiest place to start, because audiences are built in a tool the marketing team already uses. Our guide to connecting DV360 with GA4 covers the link, permissions and settings.

Floodlight is the better choice when you need precise control over events, such as separating "loan application started" from "documents uploaded". Customer Match is the route for CRM data, and works best for YouTube and Google Ad Manager reach.

How should you organise your lists before you use them?

A little structure up front saves weeks of confusion later. Before you build anything in DV360, do five things.

1. List every source. Website, app, CRM, call centre, offline stores and lead partners. Note who owns each one.
2. Define a short set of segments that map to decisions. For example: bought in the last 180 days, added to cart in the last 7 days, stopped at KYC, lapsed for 12 months or more, and high-value customers. Five to eight segments is plenty to start.
3. Name lists so anyone can read them. A name like "FL_cart_7d" or "CM_buyers_180d" tells the next person the source and the window at a glance.
4. Agree a refresh schedule and an owner. Tag-based lists update themselves. CRM uploads do not, so someone has to own them.
5. Record consent status for each source. If you cannot say how a list was consented, leave it out until you can.

What can you do with first-party data?

Five jobs, roughly in the order they pay back.

1. Exclude people who already converted. Stop paying acquisition CPMs to last month's buyers or existing borrowers.
2. Retarget people who showed intent. Cart abandoners, application drop-offs and pricing page visitors. Recency windows, frequency caps and segment-by-segment creative are covered in our guide to running retargeting campaigns in DV360.
3. Cross-sell and win back. Show a top-up loan offer to customers who took a loan a year ago, or a refill reminder to buyers whose product runs out in about 60 days.
4. Seed prospecting. Your converter lists act as signals for optimised targeting, and as seed lists for lookalike segments on Demand Gen line items, so the system looks for people similar to your best customers. Clean, well-defined converter lists make better signals, which is why our explainer on how AI optimises programmatic advertising puts data quality first.
5. Read results more clearly. Comparing how known customers and new prospects respond tells you whether the budget is finding new people or just talking to old ones.

For the targeting mechanics, including how your lists combine with Google audiences, see how to target audiences in DV360.

A worked example: what exclusions alone can save

Take an illustrative D2C brand spending ₹8 lakh a month on prospecting display and video at an average CPM of ₹120. That buys about 66.7 lakh impressions.

Suppose 12% of those impressions reach people who bought in the last six months. That is about 8 lakh impressions, or roughly ₹96,000 a month, spent telling existing customers to "try us for the first time".

A Floodlight purchase list excluded on every prospecting line item removes much of that waste on the open web, though not all of it, because a tag-based list only knows the browsers and devices it has seen. A Customer Match list of buyers, excluded on YouTube lines, covers people who bought through other channels. Part of the ₹96,000 then goes to genuine prospects, and part can fund a small, capped cross-sell line with a message that fits people who already know you.

The 12% figure will be different for your brand. The point is to measure your own overlap instead of assuming it is zero.

What about consent and the DPDP Act?

Consent is the foundation, not paperwork. India's Digital Personal Data Protection Act, 2023 is being brought into force through the DPDP Rules notified in November 2025, with most business obligations, including notice and consent, phased in over about 18 months. Build your processes for it now rather than later.

In practice:

• Say it plainly. Tell people, in simple language, that their data may be used for advertising, and get consent before you upload it anywhere.
• Honour withdrawals. If someone opts out, remove them before your next upload.
• Send only what matching needs. An email or phone number is enough. Never upload loan amounts, health details or other sensitive fields.
• Hash where your policy requires it. DV360 hashes plain-text contact data with SHA256 on upload, and you can hash it yourself before sending.
• Follow Google's Customer Match policy, which applies to every account that uses it.

This is general guidance, not legal advice. Your legal or compliance team should sign off the consent wording and data flows.

What mistakes should you avoid?

• Uploading a list once and forgetting it. Lists go stale. Refresh CRM uploads on a schedule, weekly or monthly.
• Expecting full reach from contact-based lists. Customer Match matches only part of any list, and contact-based lists do not serve on third-party exchanges.
• Using the longest window available. A 540-day maximum does not make 540 days right. A cart abandoner from eight months ago is no longer a warm lead.
• Mixing consented and unconsented records. One bad source puts the whole programme at risk.
• Relying only on first-party lists. They are small by nature. Pair them with contextual targeting and broad prospecting so the pool keeps growing.
• Ignoring tag health. A broken Floodlight tag quietly empties your lists. Check tags after every site release.

Next step

Map your data first: list each source, what it captures and whether you have consent to use it for ads. If you want a team to set up the tags, lists and exclusions, our DV360 Managed Service includes an audience strategy built on first-party and Google data. For category ideas, our e-commerce planning page shows how online brands use their own data across the funnel.