Marketers hear that ad platforms want your customers' emails and immediately picture handing over a raw contact list, which is exactly what hashing is designed to prevent. Hashed user data is how matching happens without the platform ever seeing the real thing. Here is what it is.

What hashing actually is

Hashing runs a value, like an email, through a one-way mathematical function, commonly SHA-256, that turns it into a fixed, scrambled string. The same input always produces the same hash, but you cannot reverse the hash back into the original email. So two systems can check whether they hold the same email by comparing hashes, without either revealing the address itself.

Why ad platforms use it

Platforms like Meta and Google match your conversions to their users to attribute and optimize campaigns, and they need an identifier to do it. Hashing lets that matching happen privately: you hash your customer's email, the platform hashes the email on the account it knows, and if the hashes match, it is the same person. The raw email never travels, which is what makes the exchange privacy-safe.

Formatting matters more than people expect

Because identical inputs must produce identical hashes, both sides have to normalize the value the same way first, or the match silently fails:

  • Email is lowercased and trimmed of spaces before hashing.
  • Phone numbers are reduced to digits in a standard international (E.164) format.
  • A tiny inconsistency, like a stray capital letter, produces a completely different hash and no match.

What stays unhashed

Not everything is hashed. Identifiers that are not personal in the same way, like the Meta click ID (fbc), browser cookie (fbp), IP address, and user agent, are typically sent as-is, because they are matching signals rather than direct personal data. Knowing which fields to hash and which to leave raw is a common source of setup errors.

Where it shows up in your setup

You rarely hash by hand; the tools usually do it for you, which is why it helps to know where it is happening. Google's tag and Meta's pixel can hash user-provided data in the browser before sending, server-side GTM and the Conversions APIs hash on the server, and a CRM or Data Manager upload hashes before transmission. Your job is less to compute the hash than to feed each of these clean, correctly normalized inputs, since the tool can only hash what you give it and cannot fix a badly formatted email. Knowing which part of your stack does the hashing also tells you where to look when a match rate is unexpectedly low.

Hashed user data is how ad platforms match your customers without ever receiving the raw email or phone, by comparing one-way SHA-256 fingerprints instead of the values themselves. It only works when both sides normalize and format the data identically, and only PII gets hashed while cookies and IPs stay raw. Understand that, and sending customer data for matching stops feeling like handing over your list and becomes the privacy-preserving mechanism it was built to be.

Want a stronger data analyst role or a raise? Grab the FREE Product Analyst Playbook and get the exact roadmap to your next offer.