When you send personal identifiers to Google Ads or Meta for better conversion matching, they don't go in readable form — they're hashed first. Here's what that means and why it works.
What hashing is
Hashing is a one-way mathematical function (in tracking typically SHA-256) that turns any text into a fixed-length fingerprint. It's one-way: you can't get the original email back from the fingerprint. But the same input always produces the same fingerprint.
Why it enables matching without revealing data
That "same input → same fingerprint" property is the key. You hash the customer's email and send only the fingerprint. The platform hashes its own user data the same way and compares fingerprints. When they match, it knows it's the same person — without receiving a readable email from you. This is the basis of Enhanced Conversions and user_data in Meta CAPI.
Why normalization is required
Because even a tiny difference in input produces a completely different fingerprint, data must be normalized before hashing — typically lowercased, with whitespace removed, and phone numbers in a consistent format. Without normalization, [email protected] and [email protected] would hash differently and no match would be found. This is one of the most common causes of a low match rate.
What to watch out for
- Always hash after normalizing, or you'll lose matches.
- Hashing isn't consent — even hashed personal data is sent only with consent.
- More quality hashed identifiers = better matching; see low Event Match Quality and what fbp and fbc are.
Summary
Hashing lets ad platforms match conversions to users without receiving readable personal data. But it only works when you normalize the data correctly before hashing — otherwise matches are lost.