What Is Hashing?

Hashing, in a privacy context, is a one-way transformation applied to data, such as an email address, before it's transmitted, converting it into a fixed-length string that can't easily be reversed back to the original value. Hashing obscures data, but under both GDPR and CCPA, hashed personal data is still legally classified as PII.

Hashing gets misunderstood as anonymization, and that creates real compliance risk. A hashed email can still be matched against other hashed values: that’s the entire point of features like Advanced Matching and Enhanced Conversions, which use hashing so platforms can match a visitor without transmitting a plain-text email. The most common hashing algorithm for tag data is SHA-256, which is deterministic by design, so the same input always produces the same hash. Because the value is still deterministically tied to one individual, regulators treat it the same as unhashed PII: hashing changes how the data looks, not what it legally is.