Hashed identifiers are customer data points like email addresses and phone numbers converted into fixed-length cryptographic strings, so ad platforms can match your audience to their users without either side sharing the raw data. Unlike a plain customer list, a hashed identifier hides the original value, though it still points to a specific person and does not make them anonymous.
For advertisers running ChatGPT Ads, Google, or Meta campaigns, hashed identifiers decide whether your first-party data can power custom audiences and conversion matching at all. Hash the data wrong, skip consent, or treat it as anonymous, and your match rates collapse or you inherit a privacy liability you cannot ignore.
A hashed identifier is the output of running a personal identifier, such as an email or phone number, through a one-way hashing function like SHA-256. The function turns any input into a fixed 64-character hexadecimal string, and the same input always produces the same output. Because the process runs in one direction, the receiving platform cannot reverse the hash to the original email, yet it can compare it against hashes built from its own user records.
Matching works only when both sides normalize the data identically before hashing: trimming spaces, lowercasing the email, and formatting the phone number the same way. A mismatch in formatting produces a different hash and a failed match. In ChatGPT Ads, advertisers upload emails and phone numbers raw or already SHA-256 hashed, and OpenAI hashes any raw values before matching.
Hashed identifiers sit alongside cookies, pixels, and device IDs in the matching toolkit, but they travel with your own first-party data instead of relying on third-party tracking. Under GDPR, a hashed email counts as pseudonymous data, because anyone holding the original can still link it to a person, keeping it within privacy law.
Hashing turns a customer identifier into a matchable token through a fixed sequence the advertiser and the platform both follow in order.
Normalize. Clean each identifier first: trim whitespace, lowercase the email, and put phone numbers in E.164 format. Both sides must apply identical rules or the hashes will never line up.
Hash. Run each normalized value through SHA-256, which outputs a fixed-length hexadecimal string. The same input always yields the same hash, so matching stays deterministic.
Upload. Send the hashed list to the ad platform, through a customer-list upload for audiences or the pixel and Conversions API for conversions.
Match. The platform hashes its own user records the same way and compares the two sets of hashes, flagging every exact string match as the same person.
Activate. Matched users form a custom audience you can target or exclude, or they tie a conversion back to its originating ad click.
The match tells you how many of your identifiers correspond to real platform users, which sets your addressable audience size. It does not reveal which individuals matched, because the platform never exposes the people behind the hashes.
Whether to lean on hashed identifiers is really a question about how much of your targeting and measurement depends on your own first-party data as third-party cookies continue to disappear.
They activate first-party audiences. Hashed identifiers let you turn your own CRM list into a custom audience inside ChatGPT Ads, Google, or Meta without handing over raw customer records, so the data you already own becomes media targeting.
Match rate caps your reach. If your formatting is inconsistent or your emails differ from the ones users registered with the platform, few identifiers match, and a thin audience either underperforms badly or fails to activate at all.
They carry compliance weight. A hashed email is still personal data under GDPR, so uploading a list without a lawful basis or clear consent exposes you to regulatory risk even though the raw values never leave your side.
Growth marketers use hashed identifiers to turn a CRM export into a ChatGPT Ads custom audience without ever sharing raw contact details.
Demand gen leads use hashed identifiers to suppress existing customers from prospecting campaigns running across Google and Meta.
SEO managers use hashed identifiers in conversion tracking to tie closed deals back to the paid clicks that originally sourced them.
One-way hashing runs an identifier through a function like SHA-256 that cannot be reversed, so a platform can compare values and confirm a match without ever recovering the original email or phone number behind them.
Data normalization is the cleanup step, trimming spaces, lowercasing text, and standardizing phone formats, that both the advertiser and the platform must apply identically before hashing, because any difference in formatting produces a completely different hash and quietly breaks the match.
Match rate is the share of your uploaded identifiers that line up with real users the platform already holds, and it is the number that decides how large, usable, and cost-effective your resulting audience actually turns out to be.
Activate your CRM lists as custom audiences in ChatGPT Ads, Google, and Meta.
Match customers without sharing raw emails or phone numbers with the platform.
Clear the 25,000 matched-user minimum that OpenAI's ChatGPT Ads documentation sets before a custom audience can be used for inclusion or bid adjustments.
Reduce privacy exposure by keeping raw identifiers inside your own systems.
Reconnect post-cookie conversions to the ad clicks that drove them.
Normalize before you hash. Trim, lowercase, and standardize every identifier first, because the platform expects the same formatting and a stray space breaks the match.
Use SHA-256 exactly as specified. Produce lowercase hexadecimal strings, since a different algorithm or encoding produces hashes that will never line up.
Confirm your lawful basis. Document consent or another legal basis before uploading, because a hashed email is still personal data under GDPR.
Clean your list first. Remove invalid, duplicate, and outdated rows, since unmatched entries do not count toward audience thresholds and waste your match potential.
Hash the field users registered with. Prioritize the email or phone a customer gave the platform, which may differ from the one they gave you, to lift your match rate.
Keep raw data in your systems. Hash on your side and upload only the hashes, so raw identifiers never leave your control.
Avoid treating hashing as anonymization. Hashed identifiers remain personal data, and teams that skip consent on that false assumption invite the exact regulatory risk they thought they had removed.
AirOps: organizes the first-party customer and content data behind your campaigns, helping teams keep the source lists clean and current before they are hashed and uploaded for matching.
OpenAI Ads Manager: uploads your SHA-256 hashed email and phone lists to build ChatGPT Ads custom audiences for targeting, exclusion, or bid adjustments.
Google Ads Customer Match: matches your hashed first-party lists against Google users to build audiences across Search, YouTube, and Display.
Audit your first-party data. Pull your CRM and pick the email and phone fields you can legally use for advertising. You can do this in an afternoon with no budget.
Check your consent and legal basis. Confirm your privacy policy and consent records cover sharing hashed data with ad platforms before any data leaves your own systems.
Normalize and hash a test list. Clean a small sample, apply SHA-256 to the normalized values, and verify you get lowercase hexadecimal strings.
Upload and read the match rate. Push the hashed list to ChatGPT Ads, Google, or Meta, then check how many identifiers matched and whether you clear the platform's audience threshold.
Activate and measure. Build a custom audience or wire up conversion matching, then compare performance against your previous cookie-based or broad targeting to see exactly what the first-party match adds in reach and efficiency.
Hashed identifiers are customer emails and phone numbers converted into irreversible SHA-256 strings for privacy-preserving ad matching.
They work by having both the advertiser and the platform normalize and hash the same data, then compare the resulting strings.
Match rate is the main constraint, since inconsistent formatting or stale contacts leave most of your list unmatched.
The main risk is legal: a hashed email is still personal data under GDPR, so consent and lawful basis still apply.
Your leverage sits in clean, well-formatted, consented first-party data, the part of the match you fully control.
Hashed identifiers are not anonymized data, even though both hide the original value. Anonymization permanently strips the link between a record and a person, so no one can re-identify the individual afterward. Hashing only disguises the identifier: the same input always produces the same hash, so anyone who already holds the original email can hash it and confirm the match. That reversibility by lookup is why regulators treat a hashed email as pseudonymous data, which still counts as personal data under GDPR and similar laws. The practical consequence is that hashing does not release you from consent or lawful-basis obligations. It reduces exposure by keeping raw values out of the platform's hands, and it does not make the data anonymous or compliance-free. If you need true anonymization, you have to aggregate or irreversibly transform the data so individuals can no longer be singled out, which also makes it useless for the one-to-one matching that advertising audiences depend on.
Enough to clear the platform's matched-user minimum, which counts matched users instead of the rows you upload. Invalid, duplicate, and unmatched identifiers are dropped before the audience is sized, so you almost always need to upload well above the floor to reach it. Match rate drives that gap: if only half your list matches real ChatGPT users, you need roughly double the minimum in clean records just to qualify, and a poorly formatted list of the same size falls short. Start by uploading your cleanest, most complete list, then read the matched-user count the platform reports back. If you fall short, the fix is rarely more rows for their own sake; it is better data hygiene, the right contact fields, and consistent normalization. Exclusion audiences have historically carried a lower bar than inclusion, so confirm the current minimum in Ads Manager before you plan a campaign around a single target size.
Match rates vary because each platform can only match a hash to users whose data it already holds, and every platform holds a different set. A customer might have registered for ChatGPT with a personal Gmail address, for your newsletter with a work address, and for a Google account with a third. You hashed one of them, so only the platforms holding that exact value can match it. Formatting adds more variance, since each platform specifies how to normalize phone numbers and emails, and a rule that fits one may not fit another. Coverage differs too, because a platform with a smaller or more regional user base simply has fewer of your customers on file to match against. None of this means your data is wrong. It means a hash matches only an identical hash, so the same list naturally produces different match rates depending on which platform you upload it to and how recently those users engaged there.
Yes, and most of the gains come from data quality instead of raw volume. Start by normalizing exactly to each platform's spec: trim whitespace, lowercase emails, and format phone numbers in E.164 before hashing, because a single inconsistency produces a non-matching hash. Next, enrich your list with more than one identifier per person where consent allows, since uploading both email and phone gives the platform two chances to match the same customer. Prioritize the contact details people actually use with that platform, which often means the personal email behind a consumer account over a corporate address. Remove duplicates and stale records that will never match and only dilute your rate. Finally, upload raw values only when you genuinely cannot hash reliably, since a formatting mistake on your side is easier to catch and fix than a malformed hash the platform silently discards. What you cannot control is whether a given person is a user of that platform at all.
A good match rate depends on your audience and the platform, so measure against your own baseline instead of a fixed percentage. As a rough guide, consumer email lists tend to match higher on large platforms, while business lists and smaller platforms match lower, because work addresses rarely line up with the personal accounts people sign up with. Instead of chasing a headline number, judge the rate by two practical tests. First, does the matched audience clear the platform's activation floor so you can actually use it? Second, does the audience perform better than your broad targeting once it is live? A smaller, highly accurate match often beats a large, loosely matched one on cost and conversion. Track your match rate over time on the same cleaned list, and treat a steady or rising rate as the real signal of health, because it shows your data hygiene, contact coverage, and consent practices are improving where you can actually influence them.