First-party data is key in a new era of digital advertising

Expedia Group:

What is first-party data, and could you give us some historical context around how it’s used in travel advertising and marketing?  

Jason Standifer:  

First-party data is any data collected by a domain owner like Expedia.com, Hotels.com, or Vrbo.com about the users who come to our sites. Any domain owner can collect first-party data through user interactions like searches and bookings, or by invoking filters that tailor site content or product listings to the users’ interests. 

First-party cookies, which help domain owners create personalized site experiences by storing information about your online interactions, are not impacted by third-party cookie deprecation and will continue to be essential for creating user profiles. These profiles enhance targeting during a visit and personalize the user’s experience during future interactions. 

Can you expand a little bit on the value of that personalization? 

From a domain owner perspective, you’re making it more likely for the user to come back because they’re enjoying the experience more holistically than they would without personalization. Your goal is to get a visitor to come back and transact again or interact with the content on the site.  

The more pages a user sees and the more ads they consume, the more impressions a business can monetize. By leveraging information users provide or that can be inferred from their interactions, domain owners can delight them and make their experiences better, helping their site content — or that of their advertisers — stand out from competitors. 

Could you explain first-party data versus third-party data and how are the cookies different?  

First-party data is collected by a domain owner, and they have the right in that capacity to collect this data, subject to data privacy laws applicable within each regulatory jurisdiction. As for third-party cookies and third-party data, think of that as some other domain dropping a cookie that collects data or powers functionality on the domain owner’s site. Third-party cookies can stitch together data from multiple websites, and advertisers can use these cookies to measure conversions and understand user interactions on different domains.  

For example, if you’ve ever shopped online for a pair of shoes, inevitably you’ll start seeing all kinds of advertising for shoes. Maybe you went to Zappos and they are retargeting you based on third-party cookies that they’re using to identify you as someone who browsed their website. Basically, a third-party tracking cookie is being dropped on your browser, which makes Zappos able to retarget you on other sites via third-party cookies. 

Why is first-party data critical for advertisers? 

Browsers like Safari and Firefox stopped supporting third-party cookies to protect user data and privacy, responding to concerns over tracking users’ browsing habits and stricter data protection laws. 

There has been an incremental loss of third-party cookies, and we know that Google is going to deprecate third-party cookie tracking in Chrome, which is about 50%-60% of the browser market worldwide. So that’s a very impactful event.  

To be clear, third-party cookies will be deprecated and this will have a tremendous impact, particularly around attribution and reporting in terms of what can be understood outside of the domain owner’s site.  

What happens if you don’t have a lot of first-party data? Can you build a strategy for collecting more first-party data as these third-party cookies deprecate? 

It’s about the way you wire up your sites and what data you collect and how you store that against the individual user profile. For example, you do a search on one of our sites for a group of four people, and maybe two of those travelers you’ve indicated are kids. We might infer that’s a family traveling. That’s a first-party data point even though we’re not explicitly collecting family information — it’s about looking for signals that you feel you can collect with confidence, whether it’s a direct data point or an inferred data point that you store against that user profile.  

When that person comes back to our site based on our recognition, powered by first-party cookies in a first-party data profile, Expedia Group or an advertiser may want to target that user with a promotion for a family trip. 

What should advertisers be aware of when it comes to data privacy and tracking if they want to collect first-party data on their own? 

There are all kinds of data privacy regulations, and cookies are at the heart of it. Regulatory bodies don’t want cookies to track a user when a user hasn’t opted in to be tracked, even on a first-party data basis. 

Here’s a scenario: When third-party cookies are deprecated, and I go to a website and accept cookies, does that mean I accept that that domain owner can collect first-party data and store it?  

There’s different types of purposes cookies serve. Some cookies are only analytics cookies that allow you to understand in aggregate what is going on in your site, how many visitors, or different web analytics.  

Advertising cookies are different because they’re for the purposes of advertising. If you are not opting in, in certain jurisdictions where consent is required for cookies, that’s basically against the law and we’re not able to collect and store user data.  

For example, in Europe, unless we have a user’s consent, we can’t serve ads beyond what we know from the user’s current session. If they do opt in for tracking, then we can create and use a robust historical profile of that user. But even first-party cookies and first-party data profiles are impacted by data regulation.  

If advertisers can’t get the data they need to inform their advertising efforts through their own first-party data, would they need to seek out our first-party data then to inform their strategies? 

If you’re a domain owner, it becomes a matter of what you’re seeking to do with your first-party data. You’ll want to enrich your experiences as you recognize users who come back. If you support advertising on your site, what types of sponsored content would be meaningful to those visitors based on what you know about them? Third-party cookie deprecation makes it much more difficult to reach users outside of your domain, but it gives you more control over your first-party data.  

One important thing to understand is that third-party cookies will still exist, but they’ll be limited to vendor cookies deployed by site owners to power specific functionality. In our case, we use Google Ad Manager as our ad server. It requires Google to drop third-party cookies associated with Expedia Group websites so that the ad server can properly function. However, third-party cookies that are strictly used to track user data across domains will cease to work because browsers will not allow or recognize a cookie from another domain — they will only allow that cookie to be used on the domain itself. 

Google has announced they are now looking at deprecating third-party cookies in 2025 — do you know why it’s taking them so long to sunset those cookies? 

It is a massive change in the industry that you don’t make lightly. They made the announcement years ago but decided there’s no way the industry was ready.  

From Google’s perspective, they have a business that is reliant on third-party cookies. What is the alternative solution to what third-party cookies do today? Then they have the daunting challenge of being a service provider in the tech industry with customer relationships on the supply and demand side of advertising. They have massive liability, so they’re relying on a third-party regulatory body to dictate when they make this move. They have been working on this for a long time because there’s so much complexity and money and enterprise on the line. The third-party cookie has been such a dominant part of the tech industry, it’s not easily unwound. 

Is there anything else you want to add or that you think advertisers need to know to prepare for the deprecation of third-party cookies? 

The thing to think about is that it does change the way you execute your marketing campaigns. The absence of third-party cookies makes advertising more complex and makes performance more difficult to understand. 

Today, it’s still easy to understand your marketing spend. That will no longer be the case. You’ll have to do a more isolated analysis of your media spend as you go from provider to provider. There won’t be third-party cookies to enable apples-to-apples comparisons of campaign performance. Your understanding of user identity will be key. It’s going to be much more difficult to go back after anonymous site visitors because you won’t have the benefit of the third-party cookie allowing you to reach those users.