Hashing

You want to tell an ad platform that the person who just bought is the same person it showed an ad to, without sending them a customer list in the clear. Both sides hash the email address with the same function and compare the results. Identical inputs produce identical hashes; the hash cannot be turned back into the address.

Normalisation is the whole game, and it is where matching quietly fails. Hashing is exact: any difference in the input produces a completely different output, with no partial credit. Laurent@Example.com and laurent@example.com hash to unrelated strings. So both sides must agree — before hashing — on lowercasing, trimming whitespace, and how to treat the dots and plus-addressing that some mail providers ignore.

Get this wrong and nothing errors. The events send, the platform accepts them, and the match rate is quietly poor. It is one of the few failures in measurement with no symptom other than a number being lower than it should be, which is why it survives for months.

What hashing does not do. It is not anonymisation. A hashed email is a stable identifier for one person, so it is still personal data — anyone holding the same hash function and a list of candidate addresses can confirm a match by trying them. It protects the value in transit and in storage; it does not remove the person from the data.

Who normalises. Whichever side prepares the value owns getting it right, and both sides must use the same rules. If you pre-hash before sending, the receiving system cannot fix your normalisation — it cannot see what you started with.