How much personal information does a brand genuinely need to deliver a relevant experience? That question increasingly shapes how organizations design digital systems, and it explains the growing interest in the data that customers intentionally share. As AI systems multiply the ways personal information is inferred and reused, we examine this shift across our work, including our overview of the Agent Data Protocol (standardizing AI agents).
Consumer expectations pull in two directions at once. According to Kantar's 2026 trends report cited by Raconteur, 76% of consumers are deeply concerned about brands harvesting data, while 70% still want personalization and relevance. Resolving that tension without expanding surveillance is precisely why marketers, product teams, and privacy leaders are paying closer attention to voluntarily shared information.
What zero-party data actually means
Zero-party data is information that a customer intentionally and proactively provides to a brand, rather than data observed, inferred, or purchased. It typically covers stated preferences, purchase intentions, personal context, and how an individual wants to be recognized. The defining trait is customer intent: the person chooses to share, usually in exchange for a clearer benefit.
The term was popularized by Forrester Research. In a widely cited 2018 report, analyst Fatemeh Khatibloo framed it as an alternative to third-party data at a time when regulation was tightening. You can review the original Forrester report summary for the foundational definition that most of the industry still references today.
It helps to distinguish this category from the others. Behavioral first-party data is collected from your own channels through observation, such as pages visited or items purchased. Second-party data is another company's first-party data shared through a partnership. Third-party data is aggregated from external sources and sold, often without a direct relationship with the individual. The table below summarizes how these approaches compare on consent and exposure.
Approach | How it is obtained | Explicit consent | Personal data exposure |
|---|---|---|---|
Third-party data | Aggregated and purchased externally | Usually none | High |
Second-party data | Shared via partnership | Often indirect | Moderate to high |
First-party data | Observed on your own channels | Notice-based | Moderate |
Zero-party data | Voluntarily provided by the customer | Explicit customer input | Lower, but still retained |
Zero-data approach (our framing) | Collect only what is functionally necessary | Explicit and minimized | Lowest, by design |
Why this matters right now in 2026
Two forces converge. First, third-party tracking keeps eroding as browsers restrict cookies and regulators sharpen enforcement of frameworks such as the GDPR and the CCPA. Second, consumer trust in passive data collection is fragile. In its 2023 privacy study, the Pew Research Center reported that most Americans feel they have little or no control over the data companies collect, and a majority say they do not understand what companies do with it.
because it is intentionally and explicitly provided by the customer. When a customer selects preferred topics or communication frequency, you no longer need to guess. This directness also reduces the "creepy factor" that undermines customer trust, because the person recognizes why an experience is tailored. However, consent-based collection is not a license to accumulate indefinitely, which is where architecture becomes as important as strategy.
A zero-data lens: is the personal data even necessary?
Most guidance treats collecting more preference data as an unqualified good. A structural perspective asks a prior question: does the system actually need this identity or personal attribute to function? This is the direction behind Zero Data Protocol (ZDP), an emerging independent framework built on three principles: Zero Collection, Zero Retention, and Zero Exploitation. Their human consequence is Human Freedom Choice, meaning that when identity or personal data is not functionally necessary, the user should remain free not to provide it.
This framing complements a zero-party approach rather than replacing it. Consent-based information is still valuable, but every field you collect becomes something you must secure, store, and eventually justify. The safest record is often the one you never gathered. For teams weighing how to build capability without hoarding personal information, our perspective on Data readiness without data dependency explains how function can be prioritized over extraction.
The same logic applies to performance-driven data practices that are sometimes confused with privacy. Reducing copies or speeding up access does not, by itself, reduce dependency on personal information. We unpack that distinction in our comparison of Zero-Copy Data vs Zero Data Protocol, which argues that efficiency and privacy are separate objectives that should not be conflated.
How to collect zero-party data responsibly
Collection succeeds when it feels like a fair exchange rather than an interrogation. The information should be requested in context, tied to a clear benefit, and never more than the experience requires. Practical methods include:
Preference centers where customers choose topics, channels, and frequency.
Short, relevant surveys and quizzes that return a personalized result.
Interactive tools such as calculators or assessments that deliver immediate value.
Post-purchase feedback that informs future recommendations.
Optional profile fields during registration, never mandatory ones.
Whatever method you choose, honor the implied promise. If a person states a preference, reflect it in their experience, and do not repurpose the information for undisclosed uses. Communicating the value exchange transparently is what sustains participation over time. Equally important, apply a minimization test to each field: if an attribute does not change the experience, consider not asking for it.
Limits, residual risks, and honest caveats
Consent-based data is not a guarantee. Academic work cautions against treating it as a cure-all. A 2022 peer-reviewed analysis, Zero party data between hype and hope, notes that stated preferences can diverge from real behavior, and that self-reported information carries its own biases. Customers do not always report accurately, and preferences shift over time, so accuracy claims should stay measured.
There are also structural risks. Any personal information you retain expands your attack surface, your compliance obligations, and your exposure in the event of a breach. In AI-driven environments, even consented data can feed profiling or inference that the customer never intended. We examine those specific exposures in our analysis of Generative AI Data Privacy (risks and controls for 2026). None of these approaches, including a zero-data framing, eliminates risk entirely; they reduce it. The responsible position is to collect less, retain less, and exploit less, while acknowledging that residual risk always remains.
Bringing it together
The data that customers intentionally share offers a consent-based path to personalization at a moment when tracking is declining and trust is scarce. It is more transparent than inferred or purchased information, yet it is not risk-free, and it should never become a pretext for accumulation. The most durable strategy pairs honest, well-designed collection with a structural discipline: ask whether an identity or attribute is genuinely necessary, retain only what you must, and preserve the user's freedom not to provide what a system does not need.
Take action with Zero Data Protocol
If you are weighing how much personal information your systems truly require, the choice is not only which data to collect, but whether to depend on it at all. That is the practical difference between a consent-first mindset and an architecture designed to need less.
Zero Data Protocol presents a structural approach built on Zero Collection, Zero Retention, and Zero Exploitation, connecting privacy, cybersecurity, and AI governance into one direction. To understand how these ideas relate and where each fits, read our explainer on zero-party data versus the zero data protocol and reconsider how much dependency your digital systems really carry.
Frequently Asked Questions
Is zero-party data the same as first-party data?
No. First-party data is observed from a customer's behavior on your own channels, such as clicks and purchases. Zero-party data is explicitly and voluntarily provided by the customer, for example a stated preference, which makes intent the key differentiator.
Does collecting consent-based data make a system compliant?
Not automatically. Explicit consent may be one lawful basis under regulations such as the GDPR, but compliance also depends on purpose limitation, data minimization, retention, security and other applicable obligations.
How does a zero-data approach differ from a zero-party data strategy?
A zero-party strategy focuses on collecting information customers willingly share. Our zero-data framing asks a prior question, namely whether the personal data is functionally necessary at all, and favors collecting less, retaining less, and exploiting less by design.
What are the most reliable ways to collect this data?
Preference centers, short contextual surveys, quizzes with a useful result, and optional profile fields tend to work well. The common factor is a transparent value exchange, where the customer clearly understands what they receive in return for sharing.
Can voluntarily shared data still create privacy risk?
Yes. Any retained information expands your exposure, liability, and potential attack surface, and it can feed profiling or inference in AI systems. Minimizing what you keep, and questioning what you collect, are the most effective ways to limit that residual risk.
