Glossary
Hashing
Converting a value into a fixed-length string that cannot be reversed, so two systems can check whether they hold the same value without either sending the value itself.
Also called: hashed identifiers, SHA-256 matching
You want to tell an ad platform that the person who just bought is the same person it showed an ad to, without sending them a customer list in the clear. Both sides hash the email address with the same function and compare the results. Identical inputs produce identical hashes; the hash cannot be turned back into the address.
Normalisation is the whole game, and it is where matching quietly fails. Hashing is exact: any
difference in the input produces a completely different output, with no partial credit.
Laurent@Example.com and laurent@example.com hash to unrelated strings. So both sides must agree —
before hashing — on lowercasing, trimming whitespace, and how to treat the dots and plus-addressing that
some mail providers ignore.
Get this wrong and nothing errors. The events send, the platform accepts them, and the match rate is quietly poor. It is one of the few failures in measurement with no symptom other than a number being lower than it should be, which is why it survives for months.
What hashing does not do. It is not anonymisation. A hashed email is a stable identifier for one person, so it is still personal data — anyone holding the same hash function and a list of candidate addresses can confirm a match by trying them. It protects the value in transit and in storage; it does not remove the person from the data.
Who normalises. Whichever side prepares the value owns getting it right, and both sides must use the same rules. If you pre-hash before sending, the receiving system cannot fix your normalisation — it cannot see what you started with.
Do not confuse with
Close enough to get mixed up, different enough that the mix-up costs something.
- Data clean room A controlled environment where two parties analyse their combined data without either seeing the other's raw records. Aggregate answers come out; row-level data does not.
- Match rate The share of records you sent that a platform could tie to a known person. The single number that tells you whether an identity setup is working, and the first one to check when results look thin.
- PII Personally identifiable information — data that identifies a specific person. The category is narrower than most regulation, which is why "we removed the PII" is rarely the whole answer.