The data you collect yourself is now the thing that decides whether your ads can find anybody.

Where it actually shows up

• Conversion matching. A purchase event carrying hashed email and phone gets attributed. One carrying only an IP address frequently does not, which means the delivery system never learns from that sale.
• Audience building. Customer lists uploaded for matching are now among the most reliable audiences available, precisely because they are not inferred.
• Suppression. Excluding recent purchasers from acquisition campaigns requires knowing who they are.
• Lifecycle. Every retention channel runs on contact data you hold, and their cost does not rise when ad auctions do.
• Measurement. Reconciling channel-reported performance against real orders needs a customer identity that exists on both sides.

What to collect, in order of usefulness

1. Email. The strongest matching signal available and the foundation of every retention channel.
2. Phone number. In markets where messaging is the primary channel, at least as valuable as email — and you already collect it at checkout.
3. Name, city, state, postal code, country. Individually weak, collectively they raise match quality noticeably.
4. Your own customer identifier, hashed. Useful for tying activity together across systems.
5. Declared preferences — what they are shopping for, for whom, how often they buy. Volunteered rather than observed, and the most useful of all because it cannot be inferred.

Notice that most of this is already in your checkout. The common failure is not collecting it — it is not passing it through to the events and audiences where it would do work.

Capturing more of it without damaging the experience

• Ask for email early but exchange something real for it. A discount trains discount behavior; genuinely useful content, early access, or a back-in-stock alert does not.
• Do not force account creation before checkout. It is among the most cited causes of cart abandonment, and guest checkout still yields the email.
• Use post-purchase moments to ask preference questions. Attention is high and the transaction is complete, so a question costs you nothing.
• Ask one question at a time across the relationship rather than a long form once.
• Make the value of consent explicit. People opt in more readily when told what they will receive and how often.

The obligations that come with it

Holding customer data is a responsibility, and the operational rules are not complicated.

• Collect consent explicitly, record it, and honor its scope. A purchase is consent to order updates, not automatically to marketing.
• Keep consent state attached to the customer everywhere it travels, including to server-side events.
• Honor withdrawal promptly and completely, across every channel rather than the one where it was requested.
• Retain only what you use, and for as long as you have a reason to.
• Never pass customer data to a platform in a form that was not hashed as that platform requires.
• Know where the data lives and who can access it, because you will be asked.

Why compliance and performance point the same way here

A clean, consented, deduplicated customer list with accurate contact fields is simultaneously the compliant position and the one that matches best. The brands that treat consent as an obstacle end up with lists full of unengaged and unreachable records, which is both a legal exposure and a worse audience. There is no trade-off to manage.