What is third-party data?

Google's ad policy frames it as user information you purchase or otherwise obtain from other sources. The seller is typically an aggregator that has combined many feeds: public records, retailer files, app signals, surveys and other providers' lists.

The trade-off

Buyers like it because it fills gaps quickly and covers people or businesses they have never dealt with. The trade-off is distance. Each step between the original collector and the final user makes it harder to know whether a record is accurate, current and lawfully shared.

When the Federal Trade Commission studied nine data brokers in 2014, it found they drew on extensive online and offline sources, from purchase records and warranty registrations to magazine subscriptions and social media.

It also found that seven of the nine had shared information with another broker in the study. That circulation is the defining feature of the market: the same record can pass through several hands before it reaches a buyer.

• Government and court records that are open to the public.
• Files licensed from retailers, publishers and apps under their own terms.
• Signals gathered by advertising technology across many websites and apps.
• Lists and models bought from other compilers and blended together.

In advertising, the phrase is tied to third-party cookies, which let ad networks follow people across sites. Google spent years planning to phase them out of Chrome and then changed course.

Chrome's 2025 decision

In April 2025 it said it would keep its existing approach of letting users choose in Chrome's settings and would not launch a separate prompt. So browser-level tracking continues for now, but privacy law has moved independently of that decision.

What the law now says

California's Delete Act defines a data broker as a business that knowingly collects and sells to third parties the personal information of consumers it has no direct relationship with. That is close to a description of third-party consumer data selling, and it brings registration and deletion duties. Other states run their own registries.

Treat this as a hypothetical. A home-improvement retailer is offered a file of homeowners with estimated property ages, which it wants for a roof-repair campaign. The seller is a small reseller. The retailer asks a broker it trusts to look over the offer before paying anything.

Tracing each column

The broker asks the reseller where each column came from. Property ages trace back to county assessor records. Homeowner names and phone numbers came from another compiler, which got some of them from sweepstakes entries.

The reseller can't produce the original consent wording for those entries. That gap is the whole story: the property facts are low-risk public information, while the contact details may be unusable for calls under telemarketing rules.

The broker suggests a narrower purchase: property-level attributes only, matched against the retailer's existing customer addresses. The retailer contacts people it already has a relationship with and skips the questionable phone list. What started as a third-party file becomes enrichment of the retailer's own records, which is easier to defend.

• A source list for every field, not a general claim that data is "fully compliant".
• Whether the seller is registered where registration is required for the data it sells.
• How opt-outs and deletion requests are passed down to buyers.
• Restrictions on use: many files forbid eligibility decisions, which can fall under the Fair Credit Reporting Act.
• Recency and match rates measured on a sample of your own records.