Most first-party data programmes were sold on a deadline that never arrived. The reasoning was simple enough, third-party cookies were going away, so firms needed their own data before the lights went out. That deadline is gone, and a great many programmes have been left running without the argument that justified them. Which is one reason so many of them stop at collection.
The case for owning your customer data is stronger than the deadline ever was. It just has to be made on different grounds.
The deadline that never arrived
On 22 April 2025 Google confirmed it would keep third-party cookies in Chrome, abandoning the phase-out it had promised since 2020. On 17 October 2025 it retired ten Privacy Sandbox technologies outright, citing low adoption, and the UK Competition and Markets Authority released Google from the commitments that had governed the process.
If your business case rested on that timetable, it no longer rests on anything. This matters more than it looks. A programme with a dead rationale rarely gets cancelled outright, it gets quietly deprioritised, which is exactly how an organisation ends up collecting data diligently and using almost none of it.
The durable arguments were never about cookies. They are measurement quality, regulatory exposure, and the fact that a data asset compounds while a rented audience does not.
What the collection numbers actually show
Collection is close to universal and maturity is not. In the 2026 B2B research from the Content Marketing Institute and MarketingProfs, fielded between June and August 2025 across just over a thousand B2B marketers and weighted towards North America, 91 per cent collect first-party data, yet only 13 per cent rate their strategy advanced or leading. The split between established-or-better and exploratory-or-developing is an almost exact 50/50.
Gartner’s survey work points the same way from a different angle, though it is older than it usually gets presented as. On fieldwork run in mid-2021 and published in January 2022, only 14 per cent of organisations had achieved a single view of the customer, against 82 per cent who said they wanted one. The detail worth sitting with is that close to half cannot agree internally on what a single customer view would even mean. That is a definitions problem wearing a technology costume, and no purchase order fixes it.
The gap is activation, not collection
The most useful picture of the problem comes from work Boston Consulting Group did with Google. Across eleven common uses of first-party data, the three most widely deployed sit between 81 and 87 per cent adoption. The four that the same study associates with measured revenue uplift sit between 24 and 38 per cent.
Read the shape rather than the individual bars. Everything above 80 per cent is descriptive, it tells you what already happened. Everything the study links to revenue sits at the bottom. Brands deploying at least one of those four saw 1.5 times higher revenue uplift than brands deploying none, and brands deploying all four saw 2.9 times. Both of those multiples measure revenue uplift, which is worth stating plainly because the figure is often repeated as though one of them referred to cost savings.
One caveat belongs with the chart rather than in a footnote. The fieldwork is from 2019, covers Asia Pacific, and is cross-sector rather than B2B. It is the clearest published picture of the activation gap, and there is no B2B-specific or Africa-specific equivalent in the public record. Treat the shape as instructive and the precise percentages as indicative, and do not read the 1.5 and 2.9 multiples as current B2B benchmarks.
What a working system actually contains
Four components, and only one of them is software.
Collection points with a real value exchange. People give accurate information when they get something for it. In the BCG work, 87 per cent of brands called first-party data very important while 56 per cent rated themselves average or worse at using it, which is the gap between wanting the asset and earning it.
One place where signals land. Note the order. Within that same 2021 Gartner sample, roughly three times as many organisations had bought a customer data platform as had achieved a single customer view, and Gartner found CDP capability utilisation falling from 55 to 47 per cent year on year. The platform is not the system.
Agreed definitions of what a signal means. If sales and marketing cannot state what a qualified signal is, no amount of tooling will reconcile them.
Closed-loop use. Concretely, at least one of the four activations that the evidence connects to revenue, wired so outcomes feed back into the definitions.
Where implementations stall
Three patterns, each with evidence behind it.
Fragmentation. The BCG work identifies the inability to link tools across silos as a leading barrier, though it reports this qualitatively rather than as one headline percentage. Data that cannot move is inventory, not an asset.
Unclear ownership. More than 40 per cent cite team structure and talent, and 78 per cent have centralised customer data management inside IT. That can work, but only if marketing still owns the definitions.
Measuring activity instead of outcomes. The falling utilisation figure is the tell. Spending more on the platform did not convert into using it. The same pattern shows up in B2B personalisation, where 89 per cent of marketers say they personalise while close to 60 per cent do so in only one or two channels, usually email.
Consent is the binding constraint, and African regimes are tightening
For firms operating across African markets, the regulatory picture is converging on GDPR-style consent rather than diverging from it, and enforcement has stopped being theoretical.
The African Union’s Malabo Convention entered into force on 8 June 2023. Nigeria’s Data Protection Act 2023 exposes controllers of major importance to penalties calculated against a share of annual revenue. Kenya’s Office of the Data Protection Commissioner has issued penalty notices and processed thousands of complaints under the 2019 Act. South Africa’s Information Regulator has moved from guidance to fines.
Mauritius sits at the strong end of this. Its Data Protection Act came into force on 15 January 2018 on a GDPR model, it has been a party to Convention 108 since 2016, and it was the first African state to ratify Convention 108+. A firm domiciled there is already operating to a standard that travels, which is a genuine commercial advantage when a European counterparty asks how you handle personal data.
The practical consequence is that consent architecture is not a compliance afterthought bolted on at the end. It determines what you are permitted to collect, and therefore what the system can ever do.
Where to start if the programme has stalled
Pick one of the four revenue-linked activations and make it work end to end for a single segment. Not a platform migration, not a data audit that runs for two quarters. One activation, one segment, one measurable outcome, with the consent basis documented before the first record is collected.
That sequence is deliberately unglamorous, and it is the same discipline that separates the firms which get value from AI pilots from those which do not, a pattern we set out in moving agentic AI from pilot to production. It also compounds in the same way owned media systems compound, because the cost is paid once and the asset keeps working.
Key takeaways
- The cookie deadline is gone. Google kept third-party cookies in April 2025 and retired ten Privacy Sandbox technologies that October, so a programme justified on that timetable now needs a different argument.
- Collection is not the problem. 91 per cent of B2B marketers collect first-party data and 13 per cent rate their strategy advanced or leading.
- The activations linked to measured revenue uplift are the least deployed, at 24 to 38 per cent against 81 to 87 per cent for descriptive uses.
- Buying a customer data platform is not the same as achieving a single customer view. Three times as many firms did the former as the latter, and utilisation is falling.
- Consent architecture is the binding constraint across African markets, and it decides what the system can ever do.
- Start with one revenue-linked activation, one segment, one measurable outcome.
Frequently asked questions
If third-party cookies are staying, is first-party data still worth the investment?
Yes, but for different reasons. The durable arguments are measurement quality, regulatory exposure and the fact that an owned data asset compounds while a rented audience does not. What has changed is that the work no longer has an external deadline forcing it, so it needs an internal owner and a stated outcome.
Do we need a customer data platform before we can do any of this?
No, and buying one first is a common way to stall. Three times as many organisations purchased a platform as achieved a single customer view, and measured utilisation of the capability they bought has been falling. Agree the definitions and prove one activation first, then buy the tooling that the proven activation actually requires.
Which activation should a mid-sized B2B firm build first?
Lifecycle marketing is usually the most tractable of the four revenue-linked activations, because it uses data you already hold about existing customers and does not depend on resolving identity across channels. Cross-channel lead management and a personalisation engine both require the single customer view that most firms have not yet built.
How do African data protection rules change the design?
They change what you can collect and on what basis, which is upstream of everything else. Nigeria, Kenya and South Africa all have active enforcement, and the regional direction is towards GDPR-style consent. Design the consent capture and record-keeping first, because retrofitting a lawful basis onto data already collected is rarely possible.
How long before a first-party data programme shows a return?
A single activation against a single segment can show a measurable result within a quarter. Programmes framed as multi-year platform builds tend to show nothing for far longer, which is precisely when they lose their sponsor. The evidence on uplift compares brands deploying these activations against brands deploying none, so the first one is where the step change sits.
Sources
- Content Marketing Institute and MarketingProfs, B2B Content and Marketing Trends, 2026 research, published 8 October 2025. contentmarketinginstitute.com
- Anthony Chavez, Google, Next steps for Privacy Sandbox, 22 April 2025. privacysandbox.google.com
- Anthony Chavez, Google, Update on Plans for Privacy Sandbox Technologies, 17 October 2025. privacysandbox.google.com
- UK Competition and Markets Authority, consultation on releasing Google’s Privacy Sandbox commitments, October 2025. connect.cma.gov.uk
- Boston Consulting Group and Google, Responsible Marketing with First-Party Data, based on the BCG Digital Marketing Maturity study 2019. thinkwithgoogle.com
- Gartner, only 14 per cent of organisations have achieved a 360-degree customer view. gartner.com
- Gartner, 78 per cent of organisations have centralised customer data management within IT, 10 October 2023. gartner.com
- African Union Convention on Cyber Security and Personal Data Protection, in force 8 June 2023. dig.watch
- Future of Privacy Forum, Nigeria’s New Data Protection Act, Explained. fpf.org
- Kenya Data Protection Act No. 24 of 2019, official text. kenyalaw.org
- Data Protection Office, Republic of Mauritius. dataprotection.govmu.org
