Customer data platform buyer's guide: packaged, composable or neither

A CDP earns its cost when marketing needs to build audiences from several sources, such as web and app behavior, purchases, support history and CRM fields, and push them to many channels without a data engineer in the loop each time. Typical examples are suppressing existing customers from acquisition ads, triggering lifecycle messages from product events and personalizing a site from recent behavior.

Many teams do not need one. If most customer data already lives in the CRM and the main need is reporting, a data warehouse with a BI tool answers the question. If activation is limited to one email platform fed by the CRM, the existing integration may be enough. A CDP bought for a vague single customer view tends to become another silo.

Deterministic matching joins records that share an exact identifier, such as a hashed email, a customer ID or a login. It is explainable and rarely wrong, but misses people who browse anonymously or use several addresses. Probabilistic matching infers that records belong to one person from signals such as device, location and behavior. It finds more matches, at the cost of false merges that are hard to spot and harder to undo.

Treat identity rules as governed configuration. Document which identifiers merge profiles, how conflicts are resolved and how a wrong merge is split, and keep B2B account matching separate from person matching. Ask any vendor to show the merge history for a single profile; if it cannot, you will not be able to answer a customer's access request with confidence.

Under the GDPR, personal data must be processed for specified purposes and limited to what is necessary for them, and consent, where it is the lawful basis, must be as easy to withdraw as to give.¹ A CDP therefore needs to store the purpose and basis alongside each attribute and check them at the moment of activation, not just at collection.

In California, the CCPA as amended gives consumers the right to opt out of the sale or sharing of their personal information, and the state's guidance says businesses must treat opt-out preference signals such as Global Privacy Control as valid requests.² Practical tests for any platform: does a withdrawn consent or opt-out reach every downstream audience, how quickly, and can you prove it? Retention limits and deletion requests should flow the same way.

Be specific about latency. Abandoned-cart and on-site personalization use cases need event-to-action times measured in seconds or minutes; most lifecycle and advertising audiences work fine with hourly or daily syncs. Paying for streaming everywhere is a common overspend.

Personalization models need consented, fresh, well-defined features, such as recency of key actions, product affinity and predicted value, rather than raw events. Ask whether the platform can serve model outputs back to channels and log which version produced each decision.

Total cost includes far more than the license: warehouse compute for composable setups, implementation, connector maintenance and the people who own the data models. Model at least three years, including the cost of leaving.