A first-party data strategy is the plan for how a business collects, connects, protects and uses the information customers give it directly: orders, app activity, enquiries, loyalty sign-ups and WhatsApp conversations. For larger Nepali brands, banks and fintechs, telcos and retailers, it is the part of marketing measurement you control, and it matters more than the “cookies are dying” headlines suggest, because so much of Nepal’s buying happens on WhatsApp, phone calls, cash on delivery and branch counters, where ad platforms see nothing on their own.

This guide covers the definitions, the real status of third-party cookies in 2026, consent under Nepal’s law, where data comes from, how to structure it, how to activate it in Google and Meta, how to measure it and a 90-day roadmap.

Zero-, first-, second- and third-party data

Type What it is Nepal example
Zero-party Information a customer deliberately tells you Preferred branch, product interests chosen in an app or quiz
First-party Information you collect from your own channels and operations Orders, app logins, loan enquiries, WhatsApp chats, POS receipts
Second-party Another company’s first-party data, shared under an agreement A co-branded card or campaign partner sharing a consented list
Third-party Data assembled by a party with no direct customer relationship Bought lists, cross-site cookie audiences from data brokers

Third-party lists are the weakest option in Nepal on every count: they are often stale, the consent trail is unclear, and using them can conflict with the consent duties described below. Zero- and first-party data are the foundation; second-party data is worth it only with a written agreement that covers consent.

The real status of third-party cookies in 2026

Much of the “post-cookie” advice written in 2023 and 2024 assumed Chrome would block third-party cookies. That did not happen. Here is what the official sources say:

Smartphone displaying customer data charts next to a notebook
  • Chrome keeps third-party cookies and user choice. In April 2025 Google said it had decided “to maintain our current approach to offering users third-party cookie choice in Chrome” and would not roll out a new standalone prompt (Privacy Sandbox blog). Users can still block them in settings, and Incognito mode blocks them by default.
  • Most Privacy Sandbox APIs are being retired. In October 2025 Google announced it would retire the Attribution Reporting API, IP Protection, Protected Audience, Topics, Related Website Sets, Private Aggregation and several others, while continuing CHIPS, FedCM and Private State Tokens and working on an interoperable attribution standard at the W3C (Privacy Sandbox update).
  • Safari blocks third-party cookies by default. WebKit’s Intelligent Tracking Prevention “by default blocks all third-party cookies” and deletes script-written storage, including cookies set by JavaScript, after seven days of Safari use without interaction with the site (WebKit tracking prevention).
  • Firefox isolates cookies by default. Total Cookie Protection gives every site its own cookie jar and is on by default in Firefox’s standard Enhanced Tracking Protection mode (Mozilla).
  • iOS apps need permission to track. Since iOS 14.5, apps must ask through App Tracking Transparency before linking app data with other companies’ apps and websites for advertising or measurement; without permission the advertising identifier is all zeros (Apple Developer).

So the practical picture for a Nepali advertiser is mixed rather than “cookieless”: Chrome on Android still passes most browser signals, but iPhone users, Safari and Firefox users, ad-blocker users and anyone who declines consent do not. Add the sales that close offline and the gap is large enough that pixel-only measurement undercounts. Cookieless tracking is a useful term, but the real goal is accurate, consented data you own.

The Individual Privacy Act, 2075 (2018) defines personal information to include a person’s address, telephone number and email address. The sections most relevant to marketers:

  • Section 12(2): consent must be obtained when collecting a person’s personal or family data.
  • Section 12(3): data collected by a public body or body corporate with consent may be used only for the purpose it was collected for.
  • Section 12(4): certain data, including details of property and income, business or transactions, health examinations and biometrics, must not be provided to anyone else or published without consent.
  • Section 26(1): personal information held by a public body or body corporate must not be used or given to anyone without consent, apart from listed exceptions such as court orders and criminal investigations.

In practice, that means a consent line that names the purpose (“to reply to your enquiry and send offers by WhatsApp and SMS”), a record of when and where each person agreed, and no reuse of a list for purposes the customer was not told about. Uploading a customer list to an ad platform is a use and a disclosure, so your notice should cover it. This guide is not legal advice; regulated firms should have counsel review their notices.

On websites, a consent banner plus Consent Mode v2 lets Google tags respect each visitor’s choice.

Banks, fintechs and telcos

Regulated sectors have extra rules on top of the Privacy Act:

  • Banks. Nepal Rastra Bank’s IT Guidelines (2012) require a data security policy that covers, among other things, data disposal, portable storage and encryption of customers’ critical information when it is transmitted or delivered to other locations. Exporting customer files to marketing tools should go through that policy, not around it.
  • AI and personalisation in licensed institutions. NRB’s AI Guidelines require compliance with the Privacy Act, data minimisation, explicit consent before customer data is used in AI systems, and a clear opt-out. Propensity models and AI-driven offers fall in scope.
  • Payment service providers. NRB’s payment-system unified directives include provisions on customer data privacy, confidentiality and grievance handling, so wallets and payment apps should involve compliance before sharing data with ad platforms.
  • Telecom operators are licensed by the Nepal Telecommunications Authority; check licence conditions on subscriber data before any audience upload.

For a wider view of marketing in the sector, see bank marketing in Nepal.

Where first-party data comes from in Nepal

Collection point What to record Watch-outs
Website and landing-page forms Name, mobile, email, interest, UTM source, consent timestamp Ask only for fields you will use
Mobile app (banking, wallet, retail) Login ID, events, push opt-in, ATT status on iOS App analytics consent is separate from marketing consent
WhatsApp and Messenger Mobile, enquiry, the ad or campaign that started the chat Leads stuck in staff phones are invisible to the business
POS and branch counters Mobile on receipt, items, value, outlet Staff need a reason and a script to ask for the number
Loyalty programmes Member ID, tier, purchase history, preferences The best source of zero-party data if members see the benefit
Call centre and IVR Caller number, reason, outcome Tag outcomes consistently or the data cannot be used
COD and delivery records Mobile, address district, delivered or returned Returned COD orders must not count as sales

The WhatsApp marketing playbook covers opt-in and templates for the channel where most Nepali customer conversations happen. Use the same UTM naming across ads, links and chat greetings so every record carries its source.

CRM and CDP architecture options

There is no single right stack. Pick the smallest one that matches how many systems hold customer data.

Stage Typical setup Fits
1. Clean sheet One shared sheet with Contacts, Enquiries and Orders tabs Single outlet or early-stage brand
2. CRM A CRM with pipelines, WhatsApp integration and consent fields Sales teams, clinics, education, real estate
3. Warehouse + CRM Orders, app and POS data in a warehouse (for example BigQuery), CRM for sales Retail chains, e-commerce with an app
4. CDP A customer data platform that unifies profiles and pushes audiences to channels Banks, telcos and large retailers with many systems

Two points apply at every stage. First, nominate one system as the record of truth for consent; other tools read from it. Second, plan for data residency and access control before signing a vendor: banks in particular need the security team’s sign-off on where data is stored and processed. The CRM comparison for Nepal lists options at the CRM stage.

Identity resolution and data quality

Identity resolution means recognising that the app user, the WhatsApp contact and the branch customer are the same person. Nepal has one big advantage: the mobile number is close to a universal key, more reliable than email for most audiences.

  • Store numbers in one format. Save the full international form (+977 and the 10-digit mobile) in your database; strip spaces, dashes and leading zeros. When platforms ask for hashed phone numbers, they typically want digits only with the country code, so build that conversion once.
  • Lowercase and trim emails before storing or hashing them.
  • Use deterministic matching first. Match on mobile number, email or customer ID. Avoid probabilistic matching on names: Nepali names repeat, and romanised spellings vary.
  • Keep a stable internal customer ID and pass it as the external ID in server-side events, so platforms and your warehouse agree on who is who.
  • Deduplicate monthly. One customer recorded three ways counts as three leads and breaks every report.
  • Keep status fields fixed (New, Contacted, Qualified, Won, Lost, Returned) so offline outcomes can be sent back to ad platforms.

Activation: putting the data to work

In advertising

  1. Google Customer Match. Upload consented customer lists to exclude existing customers, observe how they behave, or target them. All policy-compliant accounts can use Customer Match for exclusions and in observation mode; the targeting setting needs 90 days of account history and more than USD 50,000 in lifetime spend (Google Ads policy). Many Nepali accounts therefore start with exclusions.
  2. Meta custom audiences. Upload consented lists as a custom audience for retention, exclusions, or as a seed for a lookalike audience. Small lists match poorly; use a few hundred records for exclusions first.
  3. Enhanced conversions. Pass hashed email or phone with Google conversion tags to improve matching. See the enhanced conversions guide.
  4. Meta Conversions API. Send purchases, leads and offline outcomes server-side with hashed customer details and deduplicate them against the pixel. See the Conversions API setup guide.
  5. Server-side tagging. A server container gives you one place to apply consent, enrich events and forward them to GA4, Google Ads and Meta. See GA4 server-side tracking in Nepal.
  6. Offline conversion imports. Send qualified leads and paid or delivered orders back to Google Ads so bidding optimises for buyers, not chat starts.

In owned channels

  • WhatsApp: order updates, reorder reminders and festival offers to opted-in customers.
  • SMS: short alerts and offers for customers who prefer it; see SMS marketing in Nepal.
  • Email: receipts, statements and newsletters, stronger for B2B and banking audiences.
  • Personalisation: app home screens, website banners and product recommendations driven by purchase history, within the consent the customer gave.

Customer retention for Nepali e-commerce has more retention ideas. Respect opt-outs in every channel immediately.

Measuring whether it works

First-party data is an investment; measure it like one.

  • Match rates: the share of uploaded records that platforms can match, tracked per list.
  • Signal coverage: the share of conversions that carry a hashed email or phone, an external ID or a click ID.
  • Reconciliation: platform-reported purchases against your order system, reviewed monthly.
  • Incrementality: holdout tests that withhold a campaign from a random part of a customer list, so you see the lift rather than assuming it.
  • Retention economics: repeat purchase rate and customer lifetime value by acquisition source.

For the full measurement layer, see the conversion tracking mastery guide.

Governance

  • Name a data owner for the customer record and for consent.
  • Limit who can export full lists; log exports.
  • Use two-factor authentication on the CRM, Google account and Meta business portfolio.
  • Remove access when staff or agencies leave.
  • Write a retention rule: how long you keep enquiries that never converted, and when you delete them.
  • Never sell or swap lists with partners.

A leaked customer list does more damage to trust than any campaign can repair, and in banking it is also a regulatory matter.

A 90-day roadmap

Days Focus Deliverables
1–30 Audit and consent Map every collection point; rewrite consent lines and the privacy notice; set up Consent Mode; pick the record-of-truth system; agree phone and email formats
31–60 Connect and clean Move WhatsApp and branch leads into the CRM; deduplicate; add a stable customer ID; set up server-side events with deduplication; start offline conversion imports
61–90 Activate and measure Upload consented lists for exclusions and retention; launch one WhatsApp or SMS retention flow; run one holdout test; build a monthly reconciliation report

Large organisations should add a compliance review at the end of the first month, before any list leaves the building.

Common mistakes

  • Treating “post-cookie” as a Chrome deadline instead of a measurement gap that already exists.
  • Collecting numbers without saying how they will be used, then uploading them to ad platforms.
  • Keeping leads in personal WhatsApp chats where the business cannot see them.
  • Mixing phone formats (+977, 977, 0, with spaces) so matching fails.
  • Buying a CDP before the CRM data is clean.
  • Counting returned COD orders as sales in the data you send to platforms.

Key takeaways

  • Third-party cookies still work in Chrome in 2026, but Safari, Firefox, iOS apps, ad blockers and offline sales leave a large blind spot.
  • Nepal’s Individual Privacy Act requires consent at collection and limits use to the stated purpose; banks and fintechs have NRB rules on top.
  • The mobile number is Nepal’s best identity key; store it in one format.
  • Start with a clean CRM; add a warehouse or CDP when systems multiply.
  • Activate through Customer Match, Meta custom audiences, enhanced conversions, the Conversions API and owned channels, and measure with reconciliation and holdouts.

How this fits the stack

First-party data sits under every channel in the digital marketing stack. The service is described on First-Party Data Nepal, with the analytics side on the marketing analytics expert page and tracking on conversion tracking in Nepal. Published results from tracked accounts are on case studies.

Next step

If customer data lives in staff phones and separate spreadsheets, start with the first 30 days of the roadmap. For a structured audit, scope work through hire packages or contact Arjan KC.