A customer data platform (CDP) is software that gathers data about your customers from every system that holds it, works out which records belong to the same person, and keeps one profile for each of them that your other tools can use. Where a CRM is mainly a record of sales conversations, a CDP exists to feed marketing: email, advertising audiences, on-site personalisation and reporting.
How a CDP works
Most CDPs do four jobs, in this order.
- Collect. Data arrives from your website and app (through a tracking script or a server-to-server feed), your online shop, your CRM, your email platform, till systems and customer service software, usually through ready-made integrations.
- Resolve identity. The platform works out that the person who browsed on a phone last Tuesday, the newsletter subscriber and the customer who rang the shop are one individual, normally by matching an email address, a login or a customer number.
- Segment. You build audiences from the joined-up profiles: people who bought twice but not in the last six months, trial users who never finished setting up, subscribers in Greater Manchester who opened the last three emails.
- Activate. Those audiences are sent to the tools that act on them, such as an email platform, Google Ads Customer Match or a Meta custom audience, and kept in sync as people move in and out of them.
Some businesses now use a composable set-up instead. The customer data already sits in a data warehouse such as BigQuery or Snowflake, and a separate tool pushes segments from it to the marketing platforms. The four jobs are the same; the data simply lives somewhere you already control.
Why it matters
Safari and Firefox block third-party cookies by default, and Safari also shortens the life of many cookies set by scripts, so the information a business collects itself, with permission, is becoming the most dependable data it has. A CDP is one way to put that first-party data to work: fewer promotional emails to people who bought yesterday, ad budgets kept away from existing customers, and offers that reflect what someone has actually done rather than a guess.
For a UK business the bigger point is legal. Under UK GDPR every use of personal data needs a lawful basis, and a CDP makes it very easy to use data for something the customer was never told about. The consent signals and lawful basis recorded when data was collected have to travel with each profile, so that someone who declined marketing emails or rejected advertising cookies is not quietly added to a Meta audience. When a customer makes a subject access request or asks you to erase their data, the CDP is where you find what you hold, and the deletion has to reach the tools it feeds as well.
Common mistakes
- Buying one to fix messy basics. If the CRM is full of duplicates and nobody owns the email list, a CDP will join up the mess rather than tidy it.
- Storing everything just in case. UK GDPR’s data minimisation principle means holding only what you need for a stated purpose. A profile with hundreds of attributes nobody uses is a liability, not an asset.
- Losing consent at the integration. Data from a visitor who rejected marketing cookies arrives in the CDP and is then synced to an ad platform as if they had agreed.
- Expecting perfect matching. Identity resolution depends on people logging in or giving an email address. Anonymous browsing on a second device usually stays separate.
- No owner. Segments go stale and syncs fail quietly unless someone checks them each month and retires audiences that are no longer used.
How to act on it
Start with a question rather than a product: which decisions would be better if you could see a customer’s whole history in one place? For many small and medium-sized UK businesses the honest answer is that a well-kept CRM connected to an email platform already covers it, and a CDP would add cost without changing what anyone does.
If your customer data really is spread across a shop, an app, physical stores and a support desk, and you can name the segments you would use, list every data source and write down the lawful basis and consent status for each. Then check how far your current tools go: at the time of writing (October 2026), several email and CRM platforms, such as Klaviyo and HubSpot, include unified customer profiles that may be enough.
Bring whoever handles data protection in before a contract is signed. The CDP vendor will act as your processor, so you need a contract that meets UK GDPR and a clear answer on where the data is stored and whether it leaves the UK. Whether a CDP belongs in the plan at all is a question for a digital marketing strategy, alongside which channels its audiences would feed and who will run it.