Third-party data is information about people gathered by a company that has no direct relationship with them, then sold or licensed to advertisers who never collected it. A car buyer who fills in a warranty card, a reader whose browser loads a tracking pixel, or a phone that reports its location to an app's software kit can all end up in an audience segment labelled "auto intender" or "frequent traveller" and bought by a brand the person has never heard of. It exists because most advertisers know little about the people they want to reach before those people become customers.

California's legal definition captures the relationship test. A data broker, under Civil Code section 1798.99.80, is "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."

How the data is made and sold

Supply comes from several streams. Offline compilers such as Acxiom, Experian and Epsilon draw on public records, purchase transactions, surveys and loyalty files. Online providers collect browsing signals through cookies and pixels placed on partner sites, while location vendors buy coordinates from app developers. Much of the result is modelled: a provider observes a small group with a known attribute and projects that attribute onto look-alike profiles.

Raw records become segments, lists of identifiers sharing an attribute. An onboarding step matches offline records such as names and postal addresses to online identifiers like cookies, mobile advertising IDs or hashed email addresses. The segments are then pushed into the platforms where media is bought: data management platforms (DMPs), demand-side platforms (DSPs) and, increasingly, supply-side platforms (SSPs) that package data with inventory in curated deals.

Google's Display & Video 360 (DV360) documentation describes "tens of thousands of audience lists" from "dozens of third-party data providers" available for targeting. In a real-time auction, the DSP checks whether the user behind a bid request sits in a purchased segment. When segments travel inside the bid request itself, they occupy the user.data object of OpenRTB, tagged with a taxonomy code.

That taxonomy is standardised. IAB Tech Lab published Audience Taxonomy 1.0 in May 2018 and version 1.1 in October 2020, with 1,558 nodes split into 197 demographic, 497 interest and 864 purchase-intent categories.

Pricing usually takes one of two forms. The DV360 help centre puts typical data fees at "$0.50 to more than $2 CPM", charged per thousand impressions on top of the media cost. A buyer combining lists from several providers pays each provider whose list matched; with several lists from one provider, only the most expensive matching list is charged. LiveRamp's Data Marketplace documentation offers a hybrid used by The Trade Desk, charging a percentage of media spend capped at a CPM, with $1.25 given as an example rate. DataBeat put the average US mobile CPM at $1.44 in April 2026, so a data fee of that size nearly doubles the price of a typical impression. The Trade Desk said in September 2025 that advertisers using third-party data typically spent close to 20% of media costs on it, a company figure not independently verified.

Origin and evolution

Data brokerage predates the internet. Acxiom's predecessor was incorporated in Arkansas in 1969 as Demographics, Inc., according to the company's 1995 annual filing with the Securities and Exchange Commission, and the trade grew on mailing lists for catalogue retailers.

Programmatic buying turned those lists into a real-time commodity. Oracle bought BlueKai in 2014 for a reported $400 million to $450 million and Datalogix that December, assembling the largest third-party data business in advertising. Facebook's Partner Categories, launched in 2013, let advertisers target users with broker data from Acxiom, Experian, Epsilon, Oracle and others until Facebook announced in March 2018 that the programme would wind down over six months. Acxiom estimated the change could cost it up to $25 million in revenue.

The Federal Trade Commission's May 27, 2014 study of nine brokers found that seven had shared data with another broker in the study. One held "more than 1.4 billion consumer transactions and over 700 billion aggregated data elements", according to the FTC.

Standards followed criticism. IAB Tech Lab proposed a Data Transparency Framework on May 24, 2018, the day before the General Data Protection Regulation (GDPR) applied. Dennis Buchheim, then general manager, said it "enables meaningful understanding of attributes and sourcing practices across data providers." The Data Transparency Standard 1.0 and its audited compliance seal arrived in mid-2019, likened to a food nutrition label. Its roughly 20 disclosure fields cover the data source, collection method, whether data was modelled, refresh cadence, lookback window and segment criteria. Version 1.1 arrived in February 2022.

The business then contracted. Oracle stopped selling third-party data in Europe on September 15, 2020, weeks after GDPR class actions were filed against it in the UK and the Netherlands. Its advertising revenue fell from $2 billion in 2022 to $300 million in fiscal 2024, and Oracle audiences left DV360 on September 30, 2024.

Why it matters

For advertisers with small customer files, third-party segments remain the main way to find prospects at scale, and for publishers, data attached to inventory raises bids. Fees, accuracy and provenance dominate the trade discussion.

Transparency has lagged. Yahoo's DSP became the first to adopt the IAB Tech Lab labels in January 2025, six years after their release. Anthony Katsur, chief executive of IAB Tech Lab, called the slow uptake "a travesty". Yahoo's Giovanni Gardelli compared segment shopping to a supermarket where buyers "can only see the product names and prices."

Regulation

In Europe, GDPR Article 14 requires a company holding personal data not obtained from the person to tell that person who it is, what it holds and where the data came from. France's data protection authority, the CNIL, issued a formal warning to the location data firm Vectaury on November 9, 2018, finding that consent gathered through apps was not informed. The UK Information Commissioner's Office (ICO) served Experian an enforcement notice in October 2020 over offline marketing profiles. In February 2023 a tribunal agreed that Experian had failed to tell more than five million of about 51 million people that their data was used for direct marketing, while overturning the order to notify them.

American law has relied on registries. Vermont created the first in 2018, effective January 1, 2019. Texas followed from September 1, 2023, with a $300 fee, and Oregon from January 1, 2024. California's Delete Act, signed on October 10, 2023, produced the Delete Request and Opt-out Platform (DROP), which opened on January 1, 2026. More than 242,000 Californians signed up in eight weeks, and more than 575 brokers were registered. From August 1, 2026, brokers must check the platform at least every 45 days or face fines of $200 per consumer per day. California's first Delete Act fine, $45,000 in December 2025, went to a Texas firm selling lists such as 435,245 people with Alzheimer's at $40 per thousand records.

Federal action has come through enforcement. The FTC's settlement with Kochava, filed on May 5, 2026, bars sales of sensitive location data without affirmative express consent. The proposed SECURE Data Act, introduced on April 21, 2026, would create federal broker rules and preempt state laws including California's. It has not passed as of October 2026.

Accuracy and other criticisms

Accuracy is the sharpest dispute. Nico Neumann, Catherine Tucker and Timothy Whitfield tested more than 90 segments from 19 brokers in field studies published in Marketing Science in 2019. Gender segments often identified a male user only about half the time, and black-box profiles improved on random selection by 0% to 77%. The authors concluded that third-party audiences "are often economically unattractive, except for higher-priced media placements."

Later measurements are similar. Truthset's 2026 State of Data Accuracy report put gender accuracy at 61% and age accuracy at 13%. Truthset sells accuracy validation, so its figures carry a commercial interest. A separate Adstra and InterMedia study found that only 23% of residential IP addresses reached their intended geographic target.

Provenance is the second objection. Segments pass through several hands, and consent obtained in an app's terms rarely names the eventual buyer. Providers counter that labels, audits and registries now make the chain more visible.

Not the same as

First-party data is collected directly by an organisation from its own customers, such as purchases or site behaviour. Second-party data is another company's first-party data shared under a direct agreement, as when a retailer opens its shopper file to a brand. Zero-party data, a term attributed to Forrester Research, is information a person volunteers on purpose, such as quiz answers. PPC Land's first-party data explainer sets out all four. A data broker is the company; third-party data is the product it sells.

Recent developments

The market is consolidating. The Trade Desk's Audience Unlimited, announced on September 29, 2025, charges 3.3% or 4.4% of impression cost in one mode and includes data at no extra charge in another. Publicis Groupe agreed on May 17, 2026 to buy LiveRamp for an enterprise value of $2.167 billion.

Distribution is moving to the sell side and to software agents. Magnite added 27 data partners to ClearLine Activate on September 9, 2026. AudienceMix opened its segment catalogue to AI buying agents through a Model Context Protocol (MCP) server in September 2026. Chrome, which retired most of its Privacy Sandbox technologies in October 2025, still allows third-party cookies by default, so web-based collection continues where browsers and regulators permit it.

Timeline

  • 1969: Acxiom's predecessor is incorporated in Arkansas as Demographics, Inc.
  • 2013: Facebook launches Partner Categories with data brokers
  • 2014: Oracle acquires BlueKai, for a reported $400 million to $450 million
  • May 27, 2014: FTC publishes its report on nine data brokers
  • December 2014: Oracle agrees to acquire Datalogix
  • March 2018: Facebook announces the end of Partner Categories
  • May 22, 2018: Vermont's data broker registry law, Act 171, becomes law
  • May 2018: IAB Tech Lab publishes Audience Taxonomy 1.0
  • May 24, 2018: IAB Tech Lab proposes the Data Transparency Framework
  • May 25, 2018: GDPR applies across the EU
  • November 9, 2018: CNIL issues a formal warning to Vectaury
  • January 1, 2019: Vermont's registry takes effect
  • June 2019: IAB Tech Lab releases the Data Transparency Standard 1.0 with a compliance programme
  • January 1, 2020: The California Consumer Privacy Act takes effect
  • September 15, 2020: Oracle stops selling third-party data in Europe
  • October 2020: ICO serves an enforcement notice on Experian; Audience Taxonomy 1.1 is released
  • February 24, 2022: IAB Tech Lab releases Data Transparency Standard 1.1
  • February 2023: UK tribunal rules on Experian's appeal
  • September 1, 2023: Texas data broker law takes effect
  • October 10, 2023: California's Delete Act is signed
  • January 1, 2024: Oregon data broker law takes effect
  • June 11, 2024: Oracle announces its exit from advertising
  • September 30, 2024: Oracle advertising services end and Oracle audiences leave DV360
  • January 28, 2025: Yahoo DSP adopts Data Transparency Labels
  • September 29, 2025: The Trade Desk announces Audience Unlimited
  • December 30, 2025: California issues its first Delete Act fine
  • January 1, 2026: DROP opens to Californians
  • April 21, 2026: SECURE Data Act is introduced in Congress
  • May 5, 2026: FTC files its Kochava settlement
  • May 17, 2026: Publicis Groupe agrees to acquire LiveRamp
  • August 1, 2026: Brokers must begin processing DROP deletion requests
  • September 9, 2026: Magnite adds 27 data partners to ClearLine Activate

Summary

Who. Data brokers and audience data providers such as Acxiom, Experian, Epsilon and Lotame create third-party data. Onboarders such as LiveRamp connect it to online identifiers, and DSPs, DMPs and SSPs sell it to advertisers and agencies. IAB Tech Lab sets the labelling standards; the FTC, state regulators and European data protection authorities police it.

What. Third-party data is personal or behavioural information collected by a company with no direct relationship to the people it describes, organised into segments and licensed for ad targeting, usually for a CPM fee or a percentage of media spend.

When. Offline brokerage dates to the late 1960s. Programmatic third-party data grew from the late 2000s, peaked in the mid-2010s and has contracted since GDPR in 2018, with registries, DROP and federal enforcement tightening rules through 2026.

Where. It flows through DSP data marketplaces, DMPs, curated SSP deals, social platforms and connected television, and travels in OpenRTB bid requests labelled with Audience Taxonomy codes.

Why. Advertisers lack information about people before they become customers. Third-party data rents that information at scale, at the cost of extra fees, uneven accuracy and consent chains that regulators increasingly challenge.