What Is a Hashed Email?
A hashed email is an email address that has been converted into a fixed-length string of characters using a one-way cryptographic algorithm, most commonly SHA-256. The original address cannot be reconstructed from the hash, making it a privacy-safe method for matching audiences across platforms without transmitting raw personally identifiable information (PII).
For example, the address [email protected] produces the SHA-256 hash b4c9a289323b21a01c3e940f150eb9b8c542587f1abfd8f0e1cc1ffc5e475514. Two platforms holding the same hash can confirm they are looking at the same user without either party revealing the underlying address.
How Hashing Works
Hashing applies a mathematical function that transforms input data into a digest of fixed length. SHA-256 always produces a 64-character hexadecimal string regardless of input size. The process is deterministic: the same email address, formatted identically, always produces the same hash.
The formula is straightforward:
Hash = SHA-256(normalize(email))
Normalization is critical before hashing. Most platforms, including Meta and Google, require the address to be lowercased and stripped of leading or trailing whitespace before the algorithm runs. Failing to normalize produces different hashes for what is functionally the same address, breaking the match entirely.
Common normalization steps:
- Convert all characters to lowercase
- Remove leading and trailing whitespace
- Some platforms also require removing dots from Gmail addresses (e.g.,
[email protected]becomes[email protected])
Why Marketers Use Hashed Emails
Hashed emails sit at the intersection of first-party data activation and privacy compliance. Regulations such as GDPR and CCPA restrict the transfer of raw personal data to third parties. Many advertising platforms, however, accept hashed identifiers as a legally safer alternative, provided the advertiser has obtained proper consent.
The primary marketing use case is audience matching: uploading a CRM list to an ad platform so ads reach known customers rather than anonymous users. Because the platform hashes its own user records and compares digests, no plaintext emails cross organizational boundaries.
Secondary use cases include:
- Frequency capping across devices for the same person
- Conversion measurement by matching purchase records back to ad exposures
- Suppression lists to exclude existing customers from acquisition campaigns
- Lookalike modeling seeded from matched first-party audiences
Platform Implementations
Meta Custom Audiences
Meta’s Custom Audiences product accepts SHA-256-hashed emails for customer list uploads. Meta reports average match rates of 40 to 60 percent for well-maintained CRM lists, though match rates vary significantly by industry and list quality. Advertisers with clean, permission-based email lists routinely see rates above 55 percent. Meta hashes uploads automatically if the advertiser sends raw addresses, but pre-hashing before upload is the recommended practice for compliance-conscious teams.
Google Customer Match
Google Customer Match uses hashed emails to match uploaded lists against signed-in Google accounts across Search, YouTube, Gmail, and Display. Google has stated that Customer Match campaigns can deliver a 10 to 15 percent lift in conversion rates compared to comparable keyword-only campaigns, based on internal studies. Match rates on Customer Match typically run between 30 and 50 percent, constrained partly by the requirement that the Google user must be signed in at ad serve time.
The Trade Desk and UID 2.0
The Trade Desk, a major demand-side platform, built its open-source Unified ID 2.0 (UID 2.0) standard on hashed and encrypted emails. Publishers and advertisers hash the email, then pass it through an additional encryption layer operated by independent parties. This creates a pseudonymous identifier that can travel across the programmatic ecosystem without exposing the raw address. As of 2024, UID 2.0 has been adopted by over 700 publishers and integrated into several major SSPs including Magnite and PubMatic.
LiveRamp RampID
LiveRamp, an identity resolution company, ingests hashed emails and translates them into its proprietary RampID, a stable pseudonymous identifier linked across devices and channels. Advertisers use RampID to enable identity resolution at scale, connecting online ad exposure to offline purchase data. LiveRamp reports that campaigns using RampID-based matching see a 20 to 30 percent improvement in audience reach compared to cookie-based targeting alone.
Match Rate Benchmarks
| Platform | Typical Match Rate | Key Variable |
|---|---|---|
| Meta Custom Audiences | 40–60% | List recency and permission quality |
| Google Customer Match | 30–50% | User sign-in rate at ad serve time |
| LinkedIn Matched Audiences | 50–70% | B2B email format prevalence |
| LiveRamp / RampID | 60–80% | Publisher network coverage |
LinkedIn’s higher match rate reflects a structural advantage: B2B professionals tend to register with consistent work addresses and stay signed in. Across all platforms, list quality is the biggest lever. A CRM file built from permission-based opt-ins will consistently outperform a purchased list, regardless of platform.
Hashed Email in Data Clean Rooms
Hashed emails serve as the primary join key inside data clean rooms. A retailer and a media company, for instance, can each bring their hashed email files into a neutral computational environment. Overlapping hashes identify shared customers without either party accessing the other’s raw data. Walmart Connect and Kroger Precision Marketing both use hashed email matching as the foundation for their retail media measurement offerings.
Limitations and Risks
Hashing reduces but does not eliminate privacy risk. Because SHA-256 is deterministic, an attacker with a list of known email addresses can hash each one and compare the results against a leaked dataset. This is called a rainbow table attack. Salting, which means appending a secret string before hashing, defends against it. Most ad platforms, however, do not require salted hashes, since salting would break cross-platform matching entirely.
Additional limitations include:
- Match rates degrade as consumers change email addresses or use multiple accounts
- Hashed emails do not resolve identity across users who share a device
- Consent requirements under GDPR apply to hashed emails, which regulators consider personal data under most interpretations
Hashed Email vs. Cookies
Unlike third-party cookies, which are tied to a browser and expire or get blocked, hashed emails are deterministic identifiers anchored to a real person. They survive browser restarts, incognito sessions, and ad blockers. This persistence makes hashed email matching significantly more reliable for cross-device attribution and lookalike audience seeding, particularly as cookie deprecation continues across major browsers.
For advertisers building durable audience infrastructure, hashed email has become a foundational component of the identity graph. It connects customer records across CRM, CDP, and media activation layers without depending on browser-based tracking.
Frequently Asked Questions
What is a hashed email used for in advertising?
Hashed emails are used primarily for audience matching, allowing advertisers to upload CRM lists to ad platforms and reach known customers without sharing raw personal data. Common applications include suppression lists, lookalike modeling, conversion measurement, and frequency capping across devices.
Is a hashed email considered personal data under GDPR?
Yes, in most EU jurisdictions. Regulators generally treat hashed emails as personal data because they are derived from a real email address and can, in principle, be reversed using a rainbow table attack. Advertisers must have valid consent before processing or uploading hashed email data to ad platforms.
What is the difference between a hashed email and a third-party cookie?
A hashed email is a deterministic identifier tied to a real person that works across devices, browsers, and apps. A third-party cookie is tied to a specific browser and fails in incognito mode, after a browser reset, or when blocked by ad-blocking software. For cross-device attribution, hashed emails are significantly more durable.
What match rate should I expect when uploading hashed emails to an ad platform?
Match rates vary by platform and list quality. Meta Custom Audiences typically matches 40 to 60 percent of uploaded records. Google Customer Match runs between 30 and 50 percent. LinkedIn Matched Audiences can reach 50 to 70 percent, partly because B2B professionals use email addresses more consistently. Lists that are recent, permission-based, and properly normalized tend to perform at the higher end of each range.
What does it mean to normalize an email before hashing?
Normalizing an email means formatting it consistently before running the hashing algorithm. At minimum, this means converting the address to lowercase and removing any leading or trailing spaces. Some platforms, including Meta, also require removing dots from Gmail addresses. Skipping normalization produces different hashes for the same underlying address, which destroys match rates entirely.