Second-Party Data

Data & Tracking

Also: 2nd-Party Data · Partner Data

What it isSomeone else's first-party data, shared directly

How it movesDirect partner agreement, not a marketplace

QualitySits between first-party and third-party

Watch forConsent must travel with the data

Quick definition

Second-party data is first-party data collected by another organisation and shared directly with you through a formal agreement. Unlike third-party data bought through a broker, second-party data comes straight from the source, with the data owner's consent framework attached.

How it varies across Australia

Second-party data partnerships are more common in Australian retail, travel and financial services than in most other categories. Adoption is growing but the infrastructure to activate it cleanly sits well behind what larger US and UK advertisers have built.

See data and tracking maturity across Australian industries →

The three tiers of data

First-party data(1P)

Data you collect directly from your own customers and site visitors.

Highest trust, highest relevance

Second-party data(2P)

A partner's first-party data, shared directly under a bilateral agreement.

High trust when consent is clean

Third-party data(3P)

Data aggregated and sold by a broker, collected from many sources.

Lower trust, broader reach

What it actually means

The easiest way to understand second-party data is to look at where it sits in the three-tier model. First-party data is what you collect yourself. Third-party data is what a broker aggregated from dozens of sources and sold to anyone who'd pay. Second-party data is the middle case: it's another organisation's first-party data, handed directly to you under a formal agreement between just the two of you.

The canonical example is a retailer sharing purchase data with a bank, or a travel brand sharing booking intent signals with a hotel group. Both parties gain audience insight they couldn't build alone. Neither has to go through a data broker to get it.

What makes second-party data valuable is provenance. You know where it came from, how it was collected and what consents were obtained. That transparency is the whole point. Third-party data from a marketplace often can't tell you any of those things.

What makes it complicated is consent. Under Australia's Privacy Act and the Australian Privacy Principles (APPs), the downstream recipient of data carries real obligations. Receiving another organisation's first-party data does not automatically inherit their consent framework. The agreement between partners has to specify what consents exist, what uses are permitted, and how data subjects can exercise their rights. Attribution and targeting decisions built on second-party data are only as defensible as the consent chain behind them.

Second-party data is someone else's first-party data. The quality is high. The consent obligation is yours the moment it crosses the table.

How it shows up

Second-party data shows up most visibly in clean room environments, where two organisations share aggregated signals without either side exposing raw records to the other. It also shows up in co-marketing arrangements where an airline shares loyalty-member segments with a credit card issuer, or a grocery chain shares purchase-signal cohorts with an FMCG brand.

On the tracking side, it shows up as enriched audience lists in a demand-side platform (DSP) or as matched segments in a customer data platform (CDP). The mechanism varies, but the underlying logic is always the same: structured data exchange between two known parties, governed by a written agreement.

The Australian context

Australia's Privacy Act reform proposals are pushing organisations to be more explicit about secondary uses of personal information, which directly affects how second-party data agreements are structured. The Australian Competition and Consumer Commission (ACCC) has also scrutinised data-sharing arrangements in the digital advertising supply chain, particularly where consumer awareness is low.

Australian data clean room adoption is growing, driven partly by the deprecation of third-party cookies and partly by retail media networks built by Woolworths and Coles. These networks are structured second-party data products: the retailer shares purchase signal with brands, under defined consent and use conditions. They represent the most visible domestic example of second-party data at scale.

Where people get this wrong

Assuming the partner's consent framework covers your use case.Consent is purpose-specific. A customer agreeing to share data with a retailer did not necessarily agree to have that data used by a third-party advertiser, even through a direct partnership.

Treating second-party data as equivalent to first-party data in quality.You didn't collect it, you don't know the collection environment, and signal freshness depends entirely on your partner's update cadence. It's better than third-party data, but it's not your own.

Building a partnership without a written data sharing agreement.A verbal understanding doesn't satisfy the Australian Privacy Principles. The agreement needs to specify data types, permitted uses, retention limits and how breaches are handled.

Common questions

Is second-party data the same as buying data from a partner?

Not exactly. Second-party data is shared directly between two organisations under a bilateral agreement. Buying data from a broker is third-party data, because the broker aggregated it from multiple sources. The distinction is about the directness of the relationship and the transparency of the source.

What legal obligations apply when I receive second-party data in Australia?

Under the Australian Privacy Principles, you take on obligations as soon as personal information crosses into your systems. You must only use the data for the purposes the data subject consented to, store it securely, and have a process for handling access and deletion requests. The data sharing agreement with your partner should spell all of this out before any data moves.

How does second-party data relate to retail media networks?

Retail media networks are the most common structured form of second-party data in Australia. A retailer shares purchase and intent signals with an advertiser brand under a defined consent and use framework. The advertiser gets audience insights it couldn't build alone. The retailer monetises data it already owns. Both sides benefit from the directness of the exchange.

Will second-party data become more important as third-party cookies disappear?

Yes. Cookie deprecation and browser-level tracking restrictions are shrinking the reach of third-party data. Organisations that build direct data-sharing partnerships now are building a competitive position that becomes harder to replicate as the third-party data ecosystem contracts.

Debrief

Get the next one

No spam. No fluff. Just the next article, straight to your inbox.

Keep exploring

About New Rebellion

New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.

How we think →