These days, collecting customer data through loyalty programs can be a bit of a challenge: Customers are more skeptical and cautious than ever, and they think carefully about what personal information they share and where. But the less information you have about your customers, the less personalized your approach to them can be. This increases the likelihood that they’ll switch to a competitor. You won’t be aware of their dissatisfaction and will send them irrelevant offers that are more likely to deter them than to motivate them to buy.
Customers will only share their data if they can be sure that it won’t be misused and will be stored securely, and that there is a clear benefit for them in sharing this information with you. Transparency and honesty are therefore the most important factors for collecting so-called zero-party data—data that your customers provide of their own accord—and optimizing their shopping experience using a digital customer loyalty solution.
But even if your customers voluntarily provide you with their data, there are a few things to keep in mind—such as the GDPR regulations, which govern what information you’re actually allowed to collect. In this article, you’ll learn exactly what you need to consider regarding this topic, how you can easily obtain relevant zero-party data from your customers , and how you should handle it.
What is zero-party data?
Zero-party data is information that a person consciously and voluntarily shares with you. The term originates from marketing practice and is therefore not a legal term. Examples include preferences, intentions, life circumstances, or the preferred channel. Unlike first-party data, you do not obtain it through observation, but rather through a direct response provided by the person in question (customer), for example via a registration form or a survey. Typical sources include registration, a preference center, a quick survey, a product finder, or a wish list.
Why "zero-party data" is not a legal term
An important detail that many articles overlook: The GDPR does not use the terms “zero-party,” “first-party,” or “third-party” data at all. Instead, the law makes a strict distinction based on purpose, legal basis, and the type of data collected.
For you, this means: „Voluntarily provided“ is not a free pass. This information also constitutes personal data. Therefore, you still need a valid legal basis, a clear purpose, and a binding deletion policy.
To learn how to establish this legal foundation, check out our article on Data Protection in Loyalty Apps. In this post, however, we’ll focus entirely on the GDPR issues that are particularly important when collecting data provided voluntarily.
A Comparison of Zero-, First-, Second-, and Third-Party Data
These four terms are often confused. But it’s not that hard to tell them apart if you ask yourself one simple question: Who originally created the information, and into whose hands did it first fall?
The following two tables break this down for you in detail and provide the clarity you need.
| Data Type | Where she's from | Example | Who owns them |
|---|---|---|---|
| Zero-party data | The person actively provides this information to you, usually through a question or a form | „I usually buy gluten-free“ as a profile detail | You—directly and without an intermediary |
| First-Party Data | Your own system monitors behavior on your channels | Purchase history, in-app clicks, messages opened | "You," but as an observation rather than a statement |
| Second-party data | A partner company shares its first-party data with you | Joint initiative with a regional partner company | Partner, you use them under the terms of an agreement |
| Third-Party Data | Compiled by data providers without their own customer relationships | Purchased target audience lists for ad delivery | The provider—you buy or rent access |
Which data is the most reliable?
| Data Type | reliability | Typical weakness |
|---|---|---|
| Zero-party data | Very high, as long as the information is current | People sometimes respond in a way that sounds good |
| First-Party Data | High, because it was actually measured | Behavior must be interpreted and never explains the "why" |
| Second-party data | Amount, depending on the partner's quality | You must verify the contract, consent status, and whether the information is up to date |
| Third-Party Data | Low to unclear | Origin is difficult to trace; legal situation is often delicate |
Zero-party data is not behavioral data
Behavioral data is extremely effective at identifying patterns. It reliably shows you when, how often, and in which category someone makes a purchase. But just when things get really interesting, the data falls silent. For example, a completed purchase never reveals whether the product was intended for the buyer or as a gift. And an abandoned shopping cart doesn’t tell you whether the item was too expensive, the size didn’t fit, or the delivery time was too long.
You can't glean insights like these from any click behavior in the world. If you want them, you have to ask your customers directly. For example:
- Personal preferences: e.g., a vegan or vegetarian diet.
- Reasons for purchase: whether an item is intended as a gift, for personal use, or as a replacement for a broken item.
- Channel Preferences: Would you prefer a quick push notification on your phone or a detailed email newsletter?
- Life events: an upcoming move, a new pet, or a new baby.
- Local preferences: the specific store you actually want to visit, which may be located somewhere completely different from your home address.
- Reasons for abandonment: the real reason why the shopping cart was abandoned at the last minute.
The formula behind it is as simple as it is effective: Behavioral data tells you what happened. Zero-party data reveals the why. Only when we cleverly combine the two do we create a customer profile that you can use to target your efforts with true precision in practice.
Where Zero-Party Data Reaches Its Limits
In the world of marketing, voluntarily shared data is often hailed as an infallible goldmine. But that’s only half the story. Even zero-party data has its weaknesses. Only by recognizing these blind spots can we create queries that actually work in practice. Here are five pitfalls you should be aware of:
- Social desirability: People often check the box that reflects how they’d like to see themselves. In reality, checking the box next to „I usually buy local“ is often more of a good intention than a daily practice.
- The expiration date: Information can quickly become outdated. While a channel preference (email instead of push notifications) often lasts for years, a child’s shoe size is already a thing of the past after just a few months.
- The "Ask-and-Abandon" Trap: Every additional input field mercilessly lowers your conversion rate. This is especially true on smartphones, where no one wants to spend forever typing.
- Preference does not equal purchase intent: Just because someone clicks „Yes“ on “I’m interested in wine” doesn’t mean they’ll buy a bottle next week. Interest does not guarantee sales.
- Self-selection: Who actually takes the time to answer your questions? Mostly the customers who are already loyal and engaged. As a result, your overall picture quickly becomes a bit rosier than it actually is.
Dealing with these hurdles is, fortunately, quite straightforward: Regularly compare stated preferences with actual purchasing behavior. Adopt a simple rule of thumb: When what people say and what they do don’t match, behavior always wins out in the end.
11 Ways to Collect Zero-Party Data
Most loyalty programs make the same mistake when it comes to zero-party data: they try to collect all the data at once in the sign-up form. However, this is by far the worst possible time. At this point, the person doesn’t even know you or the value you offer yet. Who wants to reveal half their life right away?
The principle of progressive profiling is much better and more effective: Instead, spread your questions out in small, appropriate chunks throughout the entire customer journey.
To help you move beyond just the registration form, we've compiled eleven ways to find out where and how you can access valuable data. Important note: The information on response rates in the following overview is not based on fixed metrics, but rather empirical data from our practical experience.
| Way | When interacting with customers | Fields | Responsiveness (Rule of Thumb) | What the data is good for |
|---|---|---|---|---|
| Registration in the app | Upon joining | 2 to 3 | High, as long as it's short | Basic Profile and Preferred Channel |
| Welcome Course | Days 1 through 14 after joining | 1 to 2 per message | Medium to high | Interests and Favorite Category |
| Preference Center Profile | Anytime, at your own pace | Anything goes; everything is voluntary | Low, but very reliable | Channel, Frequency, and Topics |
| Post-Purchase Quick Survey | A few hours later | 1 through 3 | Medium | Satisfaction and Reason for Purchase |
| Quiz or Product Finder | Before purchasing, as a guide | 3 to 6 | High, because it has an immediate benefit | Requirements, Type, and Size |
| Wheel of Fortune with a question section | At the point of sale or in the app | 1 | Very high | A single preference |
| Wish List | While browsing | None; the list is being compiled as a side project | High | Specific product requests |
| Birthday Survey | During registration or later | 1 | Medium to high | Occasion-Based News |
| Preferred Date | When booking a service | 2 to 3 | High | Service, Time Slot, Preferred Contact Person |
| Feedback After a Visit | 1 to 2 days later | 1 through 3 | Medium | Store Quality and Reason for Visiting |
| Choosing a Branch or Location | During registration | 1 | Very high | Regional Offers and Hours of Operation |
For help with designing survey content, we have a separate article featuring ten questions for your loyalty program. There you’ll find the complete list of questions; this article focuses more on the broader context.
Progressive Profiling: Which Question Do You Ask and When?
Progressive profiling means that you build a profile step by step instead of requesting all the information at once. With each new interaction, you ask for a small piece of additional information, but never more than is necessary. It sounds almost too simple, but it’s the most effective way to ensure good data quality.
The golden rule here is: Limit yourself to two to three fields per contact and collect no more than five new pieces of information in the first 30 days. The following plan shows you how to implement this strategy in practice and can be flexibly adapted to almost any industry.
| Date and Time | What you're asking | Fields | Why Now, of All Times? |
|---|---|---|---|
| Registration | Email address or phone number, main branch | 2 | Each additional field will cost you sign-ups |
| Immediately after registration | Preferred channel: push notification, email, or both | 1 | Attention is at its peak right now |
| After the first purchase | A question about interests or categories | 1 | There is finally a concrete reference |
| After four weeks | Birthday and a Favorite Thing | 2 | Trust is there; the purpose can be explained |
| After the third purchase | Household size or intended use | 1 to 2 | The profile already has recommendations |
| After three months | Satisfaction and a free-form text field | 2 | A Good Time for Honest Feedback |
| Once a year | Have existing information verified | No new ones | Maintenance is more important than new data collection |
The Quid Pro Quo: What You Give When You Ask
Keep one thing in mind: Every request for data is a favor. Without a fair exchange , users will only do this once at most. Anyone who shares something with you expects a clear benefit in return. When customers invest their time to answer your questions, they expect an immediate reward or a benefit they can quickly recognize.
| What you're asking | What you pay for it |
|---|---|
| Preferred Channel | Fewer messages, but delivered the way the person likes |
| Favorite Product or Category | A gift certificate for it, immediately visible in your account |
| Flagship Store | Local offers, accurate opening hours, relevant promotions |
| Birthday | A little surprise on the day itself |
| Intolerance or Diet | Recommendations that really fit, and no more follow-up questions |
| Size or Fit | Fewer impulse purchases and fewer returns |
| Areas of Interest | A newsletter without the topics that bore you |
| Feedback After the Visit | Points added to the account, plus a visible reaction to that |
It's important that the value of providing this information is immediately apparent. If someone specifies a preference and then continues to receive the same default messages, they won't respond the next time.
How to Ask Questions the Right Way
No matter how attractive your reward may be—in the end, it’s often the wording alone that determines your response rate. So avoid convoluted phrasing and opt instead for casual, everyday language.
| Instead of like this | That's better | Why |
|---|---|---|
| „Please select your product category preference.“ | „What are you most looking forward to here with us?“ | Using everyday language instead of technical jargon lowers the barrier to entry |
| „What do you expect from us?“ as an open-ended field | „What should we offer more often?“ with four options | Closed-ended questions are answered more frequently and can be analyzed |
| „Gender“ as a required field | „What do you usually shop for?“ including „No response“ | You'll get the information you actually need |
To keep your forms from becoming a dead end, these five guidelines will help you with every new query:
- Closed before open: Go for quick clicks. Open text fields mean extra work for users and should be placed—if at all—as an optional extra at the very end.
- A maximum of five options: Our brains love simple decisions. If you offer more than that, the choice becomes overwhelming—and people are likely to give up.
- Don't be afraid to leave fields blank: Don't use required fields unless it's absolutely necessary. Always ask yourself: Do I really need this information right now to take the next step?
- The Fair Way Out: Always offer a „No answer“ option, even for completely harmless questions. This shows respect and prevents users from clicking just anything out of frustration.
- Focus on the Screen: Always ask only one question per screen. Especially on a smartphone, a clean, uncluttered layout works wonders against the dreaded "form fatigue.".
Zero-Party Data and the GDPR
This is where things get serious—and unfortunately, many guidebooks take the easy way out at this point. The dangerous misconception is: „The person typed that in voluntarily, so I’m in the clear.“ Wrong! Simply entering something does not, by any means, constitute a legal basis under the law.
For consent under the GDPR to be truly watertight, voluntary consent alone is not sufficient. It must also be given based on comprehensive information, for a very specific purpose, and must be revocable at any time.
For your forms, this means: A single checkbox at the bottom of the page is meaningless. It only has legal effect if it is clearly explained right next to it exactly what you will use this personal information for.
Prohibition on Linking, Purpose Limitation, Data Minimization
In addition to obtaining explicit consent, there are three other GDPR rules you must follow when collecting zero-party data:
- Consistent data minimization: Collect only what you actually use. A form field for which you currently have no specific use case should be deleted. Hoarding data just in case is a no-no.
- Prohibition on Tying: You must never make participation in your program contingent on information that you do not actually need to provide the service itself. For example: A loyalty program works perfectly well without knowing the exact household size. Therefore, you may not make this information a condition for enrollment.
- Strict Purpose Limitation: You must keep your promises. If you collect data explicitly for „tailored product recommendations,“ you may not later secretly use it for entirely different purposes.
Access, Correction, and Deletion in Practice
The GDPR guarantees your customers the right to view and correct their data at any time. For your day-to-day work, this means that a well-designed preference center in the customer profile isn't just a nice feature—it also saves a lot of time.
If your customers can adjust their preferences themselves with just two clicks, your support staff won’t be inundated with emails. Also, don’t forget to set a reasonable retention period for each field that’s appropriate for the type of information it contains.
Special Categories of Data
There’s one area where, legally speaking, you can find yourself on thin ice faster than you’d like. The GDPR provides very strict protection for certain types of data, particularly health data and information regarding religion or belief. The tricky part is that you can slip into this territory without even realizing it. If you ask about lactose intolerance or a nut allergy, you’re suddenly collecting sensitive health data.
If you want to know whether someone prefers halal or kosher food, you’re directly touching on their religious affiliation. Standard consent isn’t sufficient for this kind of information. You’d need explicit consent obtained separately and with a clear purpose.
However, there’s a brilliant and pragmatic way out of this dilemma: Ask about the need, not the reason. A statement like „I’m lactose intolerant“ is a strictly protected health claim. Clicking „I’d like to see lactose-free recommendations,” on the other hand, is simply a preference. The end result for your marketing is exactly the same, but legally, there’s a world of difference between the two.
Data Maintenance: Why Fields Need an Expiration Date
A data field that remains untouched indefinitely eventually becomes a ticking time bomb. It gives your system the false impression that it has valuable information, but in practice leads to completely incorrect recommendations. In the end, this is often worse than having no information at all, because you blindly rely on this supposed truth.
The solution? Assign each field an implied shelf life—essentially an internal best-by date. While a general request for a specific channel remains relevant for years, a child’s shoe size becomes outdated after just a few months. Information about a specific project (e.g., a renovation) can even become useless after just a few weeks. Therefore, be sure to record when each piece of information was last confirmed.
Also, avoid stiff phrasing like „Please update your profile information.“ A casual check-in with two simple buttons works much better: Is everything still the same for you? [Yes, it’s all good!] / [I need to make a quick change]. Anyone who clicks will immediately earn a few points. It takes your customers just three seconds and keeps your database spotless.
Key Metrics: How to Measure Success
Without proper tracking, you won't know whether your queries are actually working or if they're just annoying your customers in the end.
That doesn't mean, however, that you have to get lost in complex dashboards. Five to six key performance indicators (KPIs) are more than enough to get a handle on the current state of your data collection. It’s important to always calculate your selected metrics in exactly the same way and to reliably compare their trends over time.
| Key figure | Calculation Method | What She Tells You |
|---|---|---|
| Profile Completeness | Fields filled in ÷ defined fields × 100 | How much you actually know about a member |
| Response rate per question | Responses ÷ Number of people who saw the question × 100 | Which questions work and which ones you can skip |
| Dropout Rate in the Form | Abortions ÷ forms started × 100 | At which field do people get off? |
| Preferred Share | Members with at least one preference ÷ total number of members × 100 | Just how far does your personalization actually go? |
| Comparison of Open Rates | Open rate of personalized messages minus open rate of general messages | Whether Data Collection Pays Off in Communication |
| Timeliness Rate | Profiles updated in the last 12 months ÷ total number of profiles × 100 | How Up-to-Date Is Your Database, Really? |
Common Mistakes When Collecting Zero-Party Data
If you try to learn everything at once, you’ll end up learning less. To help you avoid falling into the same traps as so many others before you, we’ve compiled a list of the seven most common patterns we encounter time and again in our work.
| Error | How to Spot Him | What you do instead |
|---|---|---|
| Too many fields at once | High dropout rate right at the registration stage | Two fields at the start; everything else will follow later |
| Collecting data without using it | Profile fields that do not appear in any campaign | Each field is assigned a specific use case in advance |
| No visible effect | Response rates are declining over the months | Play something appropriate immediately after the prompt |
| Required fields without a reason | A striking number of birthdays on January 1 | Ask voluntarily and offer the option to “decline to answer” |
| No option to make changes | Requests for corrections should be sent via email rather than through the profile | Set Up a Self-Service Preference Center |
| Never update data | The recommendations clearly no longer fit | Be sure to schedule an annual refresher course |
| Casually Asking for Sensitive Information | Allergy field without a specific note in the form | Express consent with a clearly stated purpose |
How Zero-Party Data Fits Into Your Data Strategy
Finally, it’s worth taking a look at the big picture. Zero-party data does not replace your other data sources. It sits at the top of a pyramid: very reliable, but limited in volume. Below that lies your first-party data, which provides more volume but needs to be interpreted.
The trick is to connect these two levels. A stated preference only becomes valuable when it’s incorporated into an actual campaign. Our article on personalization in loyalty programs—complete with ready-to-use triggers—shows exactly how this works. If you’re interested in the data landscape in the DACH region, you can find the survey in the DACH Loyalty Report 2026.
1. Develop a survey plan
Specify which field is queried at each touchpoint. Two to three fields per touchpoint are sufficient.
2. Define the equivalent value
Every question needs a reward that works right away. Points, a gift certificate, or simply fewer messages.
3. Set up a preference center
A section of the profile where each person can update their own information. This saves time and effort and upholds the rights of data subjects.
4. Using Data in Campaigns
A field without a use case is just dead weight. Link each piece of information to at least one specific trigger.
5. Maintenance and Measurement
Annual update, checking profile completeness, comparing response rates by question.
Conclusion: The „why“ makes all the difference
Behavioral data shows you what your customers do. Zero-party data, on the other hand, tells you why they do it. It is precisely this piece of the puzzle that is the key to truly strong customer loyalty today. But you don’t get this knowledge for free.
If you want honest answers, you need to do away with intrusive, never-ending forms and instead offer clever exchange deals. Ask questions in small doses, offer immediate tangible added value , and treat the data entrusted to you with the respect it deserves.
If you also regularly clean up your database and remove outdated information, you’ll gain more than just a complete database. You’ll build trust and turn anonymous shoppers into loyal customers.
Frequently Asked Questions About Zero-Party Data
What is zero-party data, explained simply?
Zero-party data consists of information that a person consciously and voluntarily shares with you. This includes preferences, the preferred communication channel, the main branch, or a specific plan. It always comes from a response, never from an observation. That’s why you don’t need to interpret it: The statement stands exactly as the person intended it.
What is the difference between zero-party and first-party data?
Zero-party data is information that someone actively shares with you; first-party data is derived from observed behavior on your own channels. A purchase history is first-party data, while the response „I mainly buy gluten-free products“ is zero-party data. First-party data provides more volume and shows what’s actually happening. Zero-party data is less common but explains the “why” behind it. In practice, you need both and should cross-reference them.
Is zero-party data automatically GDPR-compliant?
No, that’s a common misconception. The fact that someone voluntarily provides information does not constitute valid consent. Consent must be informed, specific to a particular purpose, and revocable at any time, and the person must be able to view and modify their data. This becomes particularly sensitive when it comes to health information or references to religion, such as food intolerances or dietary preferences. In such cases, explicit consent with a clearly stated purpose is required.
How many questions can I ask at once?
As a rule of thumb, aim for two to three fields per touchpoint and no more than five new pieces of information in the first 30 days. Every additional field noticeably lowers the conversion rate—even more so on a smartphone than on a computer. Progressive profiling is a better approach: You build the profile piece by piece over the course of several weeks. Track the form abandonment rate as you do this, and you’ll see exactly which field causes people to drop off.
How can I get people to respond at all?
About value that’s immediately apparent. According to the DACH Loyalty Report 2026, 80 % of respondents in Germany and 87 % in Austria expect rewards that can be redeemed right away. Applied to data requests, this means: points, a relevant coupon, or an instantly improved recommendation are more effective than a promise for later. Equally important is using everyday language rather than technical jargon. And the impact must be noticeable afterward; otherwise, no one will respond a second time.
How often should I update information I've voluntarily provided?
Once a year is a good frequency for most fields. Some information becomes outdated more quickly—such as children’s sizes or current projects—while other information remains valid for years, like preferred channel. Save the date of the last confirmation for each field, so you can follow up specifically. Keep the follow-up brief and friendly: A message with „Still correct“ and „Quick edit“ buttons works better than a request to update master data.
