Who owns your enriched data? The CRM backlash and the case for area-level enrichment

In early July 2026, one of the largest CRM platforms in the world updated its customer terms to enrol users by default in a shared, pooled data-enrichment programme. Records that customers had painstakingly built inside their own systems would be added to a broader commercial dataset and used to supplement other companies' contacts. Within four days the plan was dead, withdrawn after a wave of public objection from the very customers it was meant to serve. The episode was short, but it exposed a question that sits under every enrichment decision a business makes: when a third party enriches your customer data, who actually owns the result, and who carries the consent and compliance risk when it goes wrong? That question has a cleaner answer than most teams assume, and it starts with the difference between enriching a person and enriching a place.

What the pooled-enrichment revolt was really about

The backlash was not about enrichment being useless. It was about the mechanics of how individual-level enrichment tends to work. To append richer attributes to a named contact, a vendor generally needs to pool records across many customers, match individuals against a shared identity graph, and feed everyone's data back into a common commercial asset. That model creates three anxieties at once, and all three surfaced in the reaction:

• Ownership. Customers felt that data they had collected and maintained was being treated as the platform's to redistribute, blurring the line between a processor holding data on their behalf and a controller building its own product from it.
• Consent. An opt-out default meant enrichment could switch on without an explicit, affirmative choice, which sits uneasily with how consent is supposed to work for personal data.
• Competitive exposure. If your hard-won contacts improve a shared pool, they can improve a competitor's targeting too, turning your first-party asset into everyone's.

None of these worries are unique to one vendor. They are structural features of enriching data at the level of the named individual. The moment enrichment attaches new attributes to a real person, questions of ownership, lawful basis, and redistribution follow automatically.

Individual-level enrichment concentrates the risk that regulation is tightening

This is happening as the regulatory ground shifts, not settles. Marketers already report that first-party data is far more important than it was two years ago, and a large majority now say third-party signals should supplement rather than drive targeting. Browser-level blocking of third-party cookies is widespread, and every new privacy regime adds compliance overhead to identity-based approaches. In that environment, an enrichment method whose whole premise is matching and enriching named individuals is the method most exposed to consent challenges, data-subject requests, and the reputational risk of a policy change that customers read as an overreach. The pooled-enrichment reversal was a market signal: buyers will walk away from enrichment that puts their customer relationships and their compliance posture at risk, even when the underlying feature is genuinely useful.

Area-level enrichment answers the ownership question by design

Area-level enrichment works differently, and the difference is not cosmetic. Instead of appending attributes to a named person, it appends the demographic character of a neighbourhood to a postcode. A postcode does not tell you a specific customer's age, income, or identity. It tells you what the area around that customer looks like, and that context is predictive of how households in the area tend to respond. Because the data describes a place rather than a person, it is GDPR-safe: there is no individual to consent, no identity graph to pool, and no shared contact record to leak into a competitor's targeting. Cogstrata's classification sorts every UK neighbourhood into 24 groups and 8 supergroups, backed by more than 5,000 derived attributes, and it is refreshed continuously rather than on the slow annual or biennial cycles that legacy providers run. You keep your first-party data as yours; the enrichment layer adds context without ever claiming ownership of a person, because there is no person in it to own.

A practical enrichment strategy after the backlash

The lesson is not to abandon enrichment. It is to be deliberate about which layer carries which job. First-party data remains the foundation for the relationships you actually hold, and area-level data is the always-on context that surrounds it without inheriting its risks. A resilient approach tends to look like this:

• Treat first-party data as the private core: your transactions, consents, and directly observed behaviour, kept under your own control and never handed to a shared pool.
• Use area-level geodemographics for context, segmentation, and modelling, so you can enrich every record at onboarding or checkout without collecting anything new from the customer.
• Prefer enrichment that is defensible under audit: data whose lawful basis is simple because it describes neighbourhoods, not named people.
• Favour continuously refreshed inputs over static classifications, so segments reflect the country as it is now rather than as it was several years ago.

For related reading on why the privacy-safe approach holds up over time, and how portable data is reshaping the landscape, see Postcode-Level Intelligence: Why the Privacy-Safe Approach Wins in the Long Run and The UK's Smart Data Strategy and the Future of Customer Data Enrichment.

The bottom line

The pooled-enrichment episode was a four-day story with a longer moral. Enrichment that attaches to the named individual will keep running into the same wall of ownership disputes, consent friction, and competitive unease, because those problems are baked into the method. Enrichment that attaches to the area sidesteps the wall entirely: it is privacy-safe, it leaves your first-party data firmly yours, and it stays current instead of ageing quietly in the background. When the next enrichment controversy arrives, the businesses that built their context layer on neighbourhoods rather than names will not have to explain themselves.