Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
A customer data platform, or CDP, collects customer data from your website, apps and other sources, builds unified profiles, and sends that data and the audiences built from it to the tools you use for advertising, email, analytics and support. That makes a CDP powerful for personalization and measurement, and it also makes it a central point of privacy risk: if a customer’s choice is not honored in the CDP, it may not be honored anywhere downstream. This guide compares leading CDPs, explains how their architectures change the privacy picture, and gives you a scorecard to test any vendor.
Quick summary
- What a CDP does: ingests first-party events and identifiers, resolves identities into profiles, and routes data and audiences to downstream destinations.
- What to look for: consent that is enforced before data leaves the platform, per-destination controls, deletion that reaches downstream tools, regional hosting options, regulated-data deployment options, sub-processor transparency, and audit logs.
- Where Captain Compliance fits: Captain Compliance is not a CDP. It governs the layer around one: the consent choices captured on your websites, the tags and pixels that feed your CDP, the access and deletion requests that need to reach it, and the monitoring that proves it all works.
Disclosure: Captain Compliance publishes this guide. We do not sell a CDP and have no commercial relationship with the vendors below. Descriptions come from vendor documentation and public announcements as of November 1, 2026. Product names, ownership and features change often, so verify details with each vendor.
Quick answer: which privacy questions matter most when choosing a CDP?
Five questions separate a privacy-ready CDP deployment from a risky one. Does the platform enforce consent before it sends data to a destination, not just record it? Does a customer’s opt-out or deletion request reach every downstream tool? Can you keep data in the region or environment your obligations require? Do you know every destination receiving data and what each receives? And can you produce evidence, such as logs and test results, that all of this works? A vendor that cannot show these live, in a demo using your own configuration, has not yet answered the questions.
What changed in the CDP market
If your last shortlist is two years old, several names on it have changed hands or been renamed. Consolidation matters for privacy buyers because ownership shapes roadmaps, support, data processing terms and sub-processors.
- mParticle became part of Rokt in January 2025, in a deal reported at about 300 million dollars, and now trades as mParticle by Rokt.
- ActionIQ was acquired by Uniphore, announced in December 2024, and is now sold as Uniphore’s CDP Agent.
- Lytics was acquired by Contentstack in early 2025.
- Salesforce Data Cloud was renamed Salesforce Data 360 on October 14, 2025, under the Agentforce 360 umbrella.
- Treasure Data rebranded as Treasure AI in April 2026, repositioning itself as an agentic experience platform.
- Segment remains part of Twilio, which acquired it in 2020, with product focus increasingly tied to Twilio’s communications platform.
The CDPs in this comparison
These eight platforms cover event-pipeline, tag-based, warehouse-native and suite-native approaches across developer-led, mid-market and enterprise buyers.
- Twilio Segment. A customer data infrastructure platform known for its large catalog of destinations. Best for engineering-led teams that want broad integration coverage.
- RudderStack. A warehouse-first event pipeline with open-source roots and deployment flexibility. Best for teams that want more control over where data lives.
- mParticle by Rokt. A CDP with a mobile and connected-device heritage, now part of Rokt. Best for app-heavy businesses, with a close look at ownership changes.
- Tealium. Combines tag management with a real-time CDP, focused on consent and governance across collection and activation. Best for organizations that already manage tags with Tealium iQ.
- Hightouch. A composable platform that activates audiences straight from your data warehouse. Best for data teams that treat the warehouse as the source of truth.
- Salesforce Data 360. The former Data Cloud, built to unify data across Salesforce products and activate it there. Best for Salesforce-centered organizations. One industry guide lists a Starter tier at 60,000 dollars a year, but confirm current pricing with Salesforce.
- Adobe Real-Time CDP. Part of Adobe’s experience platform, aimed at enterprises already invested in Adobe’s marketing stack. Best for Adobe-centered organizations.
- Treasure AI. The former Treasure Data, positioned around AI agents acting on unified customer profiles. Best for enterprises exploring agent-driven activation.
Four CDP architectures and what each means for privacy
Event-pipeline CDPs
Platforms such as Segment, RudderStack and mParticle collect events through SDKs and route them to destinations. The privacy lever is filtering at the pipeline: sending each event only to destinations the person consented to. It works well when consent data is attached to every event and mapped correctly to each destination, and badly when events arrive without it.
Tag-based real-time CDPs
Tealium grew out of tag management, so its consent controls span the browser and the server. That is an advantage when you want one governed layer from the page to the profile, but its documentation shows that enforcement settings, audience rules and consent orchestration all need deliberate configuration.
Warehouse-native and composable CDPs
Hightouch and the composable options in other products activate audiences straight from the warehouse. Fewer client-side events can reduce browser exposure, but the privacy risk moves into your data models: a segment built in SQL can include data that was never meant for advertising, and consent has to be part of how segments are defined.
Suite-native CDPs
Salesforce Data 360 and Adobe Real-Time CDP are designed to work inside their vendors’ broader platforms. That can simplify governance inside the suite, but data sent outside it still needs the same consent and destination review.
Capability snapshot
This table sticks to what can be confirmed from vendor documentation and announcements. For consent mechanisms, we cite documented behavior only. Where we have not verified the details, the table says to confirm them, and you should ask the vendor to demonstrate it.
| Platform | Ownership and status | Architecture | Documented consent mechanism | Watch out for |
|---|---|---|---|---|
| Twilio Segment | Part of Twilio since 2020 | Event pipeline with large destination catalog | Consent enforcement sends data only to destinations a person consented to, using consent categories on each event. Most event-stream destinations are supported, with documented exceptions such as AWS S3 and Engage destinations | Consent capture comes from your CMP, and consent categories must be present and correct on events. Documented as designed for data collection consent, not communication preferences |
| RudderStack | Independent vendor with open-source roots | Warehouse-first event pipeline | Per-destination consent logic using category IDs in the event payload. Events missing the required IDs are dropped. Documented integrations with several CMPs and a custom option | Consent logic is configured per destination, so each new destination needs review. Deletion downstream depends on each connector |
| mParticle by Rokt | Acquired by Rokt in January 2025 | Event pipeline with mobile focus | Confirm current consent and data policy features in vendor documentation | Ownership change. Confirm roadmap, contract terms and sub-processors |
| Tealium | Independent vendor | Tag management plus real-time CDP | Consent register and enforcement framework that works with commercial CMPs, with server-side enforcement through consent orchestration | Automatic server-side enforcement is optional and off by default for new profiles. Audience connectors may need consent conditions added to audience rules |
| Hightouch | Independent vendor | Warehouse-native activation | Confirm how consent is represented in warehouse models and enforced at sync | Privacy depends on how segments are modeled and who can publish them |
| Salesforce Data 360 | Salesforce, renamed from Data Cloud in October 2025 | Suite-native | Confirm consent data model and enforcement for destinations outside Salesforce | Rename and packaging changes. Confirm current terms and regional options |
| Adobe Real-Time CDP | Adobe | Suite-native | Confirm governance and data usage controls in Adobe documentation | Strongest inside Adobe’s stack, so test activation outside it |
| Treasure AI | Rebranded from Treasure Data in April 2026 | Enterprise platform with AI agent positioning | Confirm consent and governance features after the rebrand | Product repositioning toward agents. Ask how consent applies to agent actions |
Privacy scorecard: what to test with every CDP vendor
We do not hand out numerical scores, because many privacy answers depend on your configuration and contract. Use this scorecard in your demos instead, and have each vendor show you the result rather than describe it.
| Privacy dimension | What good looks like | How to test it |
|---|---|---|
| Consent filtering before data leaves | Data reaches only destinations a person agreed to, enforced by the platform | Send events with consent denied and confirm no destination receives them |
| Global Privacy Control handling | Signals captured by your CMP translate into enforced restrictions in the CDP | Browse with the signal on and inspect what is sent to the CDP and its destinations |
| Opt-out across devices and identities | A choice follows the resolved person, not just one cookie | Opt out on one device, then check profile and destination status on another |
| Deletion and suppression propagation | A deletion request reaches downstream destinations with a log | Submit a test deletion and verify each destination |
| Regional and regulated hosting | Data residency and regulated-data options match your obligations in writing | Review the contract, regional documentation and sub-processor list |
| Sub-processor transparency | Current public list with change notice | Compare the list to what your DPA names |
| Sensitive data controls | Ability to block or hash sensitive attributes before they are stored or sent | Send a sensitive test attribute and confirm it is stopped |
| Destination governance | Review step before any new destination is enabled | Check who can enable a destination and whether it is logged |
| Audit trails | Logs of configuration and policy changes with usable retention | Ask for a sample log and the retention period for your plan |
How to choose for your situation
- Your warehouse is the source of truth. Look at warehouse-native options such as Hightouch and RudderStack, and put consent into your data models, tests and segment approval process.
- You need the broadest catalog of integrations. Segment is the usual starting point. More destinations mean more recipients to disclose and review, so inventory enabled destinations regularly.
- Mobile apps dominate your data. Consider mParticle by Rokt, and test what SDKs send, including advertising identifiers, before server-side filtering applies.
- You already manage tags with Tealium. Tealium’s CDP can build on that, but test your server-side consent configuration and audience rules end to end.
- You are all-in on Salesforce or Adobe. Their CDPs fit the suite, but test every activation that leaves it.
The privacy reality of customer data platforms
One mistake, many destinations
A CDP routes the same event to many tools. If a sensitive attribute is included or a consent filter is missing, every subscribed destination can receive it. California’s 2026 settlement with Disney, in which opt-outs did not apply across all devices and services tied to a customer’s account, shows why choices have to follow the person’s identity everywhere data goes.
Warehouse-first does not remove browser exposure
Moving activation to the warehouse can reduce some client-side collection, but your website still loads tags and pixels that collect data in the browser. Consent has to control those before any profile reaches the CDP.
Your impact assessments need real destination lists
Regulators and plaintiffs ask where data actually goes. Destination catalogs change as marketers enable integrations, so keep a current list of enabled destinations and the data each receives, not just vendor names.
Consent records are not legal bases
A CDP can enforce the categories you give it, but it cannot decide whether a particular use is lawful. Legal review of purposes, notices and opt-out rules still has to happen before audiences are activated, especially for sensitive data and children’s data.
A five-step test for CDP consent and privacy
- Map the flow. Document every source, the CDP, and every enabled destination, with the data each receives.
- Test denial. Reject consent on your website, trigger events, and confirm in the CDP and at each destination that nothing was sent.
- Test signals. Repeat with Global Privacy Control turned on.
- Test deletion. File a deletion request for a test profile and confirm each destination honors it.
- Repeat on a schedule. Re-run after every new destination, tag change or platform update.
Where Captain Compliance fits alongside your CDP
Captain Compliance does not host customer profiles and does not replace a CDP. We work on the layer that decides what reaches it.
- Cookie consent management that controls which tags and pixels load on your website based on a visitor’s choices, including Global Privacy Control signals, so data that should not reach your CDP never leaves the browser. Our consent platform is used on more than 8,000 websites and processes over 50 million consent choices a month.
- Continuous website monitoring and Patrol, our privacy risk monitoring tool, to detect trackers and data flows that do not match your consent settings and disclosures.
- DSAR workflows to route access, deletion and opt-out requests so they can be carried through to your CDP and its destinations.
- Dynamic privacy policies and vendor disclosures that update as you add or change CDP destinations.
Frequently asked questions
What is the difference between a CDP and reverse ETL?
A CDP typically collects events, resolves identities and activates audiences in one platform. Reverse ETL tools move data from your warehouse into other tools. Many vendors now blend the two, which is why you should compare architectures instead of labels.
Does a warehouse-native CDP remove my GDPR or CCPA obligations?
No. Obligations follow the personal data and the way you use it, not where the software runs. A warehouse-native approach changes where controls need to live, often in your data models and approval process.
How should consent work with Segment, RudderStack or Tealium?
Each one depends on a consent signal captured by your consent platform and attached to events or the data layer, which the CDP then uses to filter or block delivery. The details differ by vendor, so test denial and opt-out signals end to end instead of trusting a configuration screenshot.
When should I choose a suite CDP such as Salesforce Data 360 or Adobe Real-Time CDP?
When most of your customer touchpoints and activation already run inside that vendor’s suite. Test any activation that leaves the suite as carefully as you would with a standalone CDP.
Do I need a consent platform if my CDP has consent features?
Usually yes. Most CDPs enforce consent decisions but rely on a consent platform to capture them on your website and apps. The consent platform also controls tags that run in the browser before any data reaches the CDP.
How does a CDP affect data subject requests?
A CDP holds profiles and passes data to many tools, so access, deletion and opt-out requests must reach it and its destinations. Ask each vendor how deletions propagate and how you can verify them.
Key takeaways
- A CDP centralizes privacy risk, because a missing consent filter or an unreviewed destination can affect every downstream tool.
- Architecture matters: event-pipeline, tag-based, warehouse-native and suite-native CDPs put their privacy controls in different places.
- The market has consolidated. Several well-known names have new owners or new names, so check contracts, sub-processors and roadmaps.
- Test consent, opt-out signals and deletion live, end to end, with your own configuration before you buy and after every change.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
