Hashing / SHA-256

Data & Tracking

Also: SHA-256 · Hashed Data · Secure Hash Algorithm

What it doesTurns personal data into a fixed code

SHA-256 meansSecure Hash Algorithm, 256-bit output

One-way streetCan't be reversed back to the original

Used forMatching customers without sharing raw data

Quick definition

SHA-256 stands for Secure Hash Algorithm 256-bit. It's a mathematical process that turns any piece of data, like an email address, into a fixed-length string of characters called a hash. The same input always produces the same hash, but the hash cannot be reversed back into the original data.

How it varies across Australia

Adoption of hashed matching has climbed sharply across Australian advertisers as platforms push Enhanced Conversions and server-side integrations. Businesses still passing raw personally identifiable information (PII) into ad platforms are increasingly the exception, not the norm, particularly since Privacy Act reforms raised the stakes.

See data and tracking maturity across Australian industries →

What it actually means

Think of SHA-256 as a blender for data. Feed it an email address, and it spits out a fixed-length code that looks like random gibberish. Feed it the exact same email address again, tomorrow or in ten years, and you get the exact same gibberish back. But you can never run the blender backwards. There's no un-blending an email from its hash.

That one-way property is what makes hashing useful in marketing. Platforms like Meta and Google need to match your customer list against their own user data to power things like Enhanced Conversions or Customer Match. Sending raw email addresses would mean handing over personally identifiable information (PII) directly. Sending hashed emails means both sides can compare codes and confirm a match without either party seeing the underlying data in transit.

Hashing is not encryption. Encryption is reversible with the right key. Hashing is deliberately irreversible, which is exactly why it plays well with consent frameworks, server-side tracking and first-party data strategies. It's the handshake, not the vault.

Hashing doesn't make your data private. It makes your data usable without being exposed. Those are different problems solved by the same trick.

How it shows up

Hashing shows up wherever customer data needs to leave your system to reach an ad platform. Meta's Conversions API (CAPI), Google's Enhanced Conversions, and most server-side tracking setups all expect hashed identifiers, usually SHA-256 versions of a lowercased, trimmed email address or phone number. It also shows up in data clean rooms, where two businesses want to compare customer overlap without either seeing the other's raw list. And it shows up quietly in your consent mode setup, where hashed data is often the difference between a conversion that's modelled and one that's directly matched.

The Australian context

The Privacy Act 1988 and its recent amendments have pushed Australian businesses to think harder about what raw data leaves their systems and lands with third parties. The Office of the Australian Information Commissioner (OAIC) treats hashed data more favourably than raw PII, but hashing alone doesn't satisfy every consent obligation. Businesses still need a lawful basis and clear disclosure for collecting the underlying data in the first place. Hashing reduces exposure risk. It doesn't replace consent.

Where people get this wrong

Assuming hashed data is automatically anonymous.A hash of a common, guessable value (a well-known email, a short phone number) can sometimes be reverse-matched by brute-forcing likely inputs. Hashing reduces risk, it doesn't guarantee anonymity.

Skipping normalisation before hashing.If one system hashes 'Name@Email.com' and another hashes 'name@email.com', the hashes won't match even though it's the same email. Lowercasing and trimming whitespace first is essential, and most match-rate problems trace back to this step.

Treating hashing as a substitute for consent.Hashing protects data in transit and reduces exposure. It does nothing to establish whether you had the right to collect and use that data in the first place. Consent and hashing solve separate problems.

Hashing / SHA-256 vs Encryption

	Hashing / SHA-256	Encryption
Reversible?	No, one-way only	Yes, with the correct key
Main purpose	Matching data without exposing it	Protecting data so only authorised parties can read it
Same input, same output?	Always identical	Varies depending on the key used
Common marketing use	Customer matching for ad platforms	Securing data in storage or transit

Common questions

Is hashed data the same as anonymised data?

Not exactly. Hashed data can't be reversed directly, but if the original value is common or guessable, someone could still match it by hashing likely candidates and comparing results. Genuine anonymisation usually requires additional steps beyond hashing alone.

Why do ad platforms want hashed emails instead of plain ones?

Hashing lets platforms like Meta and Google confirm a customer match without either party exposing raw personally identifiable information (PII) in the process. It reduces privacy risk while still allowing audience matching and Enhanced Conversions to work.

Does hashing affect my match rate?

Yes, significantly. If your hashing process doesn't normalise data first, such as lowercasing emails and trimming spaces, hashes that should match won't. This is the most common cause of unexpectedly low match rates in Enhanced Conversions and Conversions API (CAPI) setups.

Do I need customer consent to hash their data?

Hashing doesn't remove the need for consent. You still need a lawful basis to collect and use the underlying personal data before hashing it. Hashing reduces exposure risk during transfer, it doesn't replace your disclosure or consent obligations under the Privacy Act.

Debrief

Get the next one

No spam. No fluff. Just the next article, straight to your inbox.

Keep exploring

About New Rebellion

New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.

How we think →