Hashed email

A hashed email is an email address that has been normalised and passed through a one-way hash function, usually SHA-256, so that two parties can match the same person without exchanging the address itself.

Hashing turns any input into a fixed-length string. The same input always gives the same output, and the output cannot practically be reversed. That makes hashed emails the common key for matching logged-in users across publishers, retailers, clean rooms and identity frameworks such as UID2, EUID and RampID.

Normalisation comes first, and getting it wrong breaks matches. The UID2 documentation requires lowercase letters, removal of dots and plus-suffixes in Gmail addresses, and UTF-8 encoding before hashing. The hash is SHA-256, and UID2 expects the raw hash bytes encoded in Base64 (UID2 documentation, updated 5 November 2026).

A hash is not anonymous. Anyone holding the same email can compute the same hash, so a hashed email still points to a person for anyone with a matching list. Under the GDPR it is pseudonymised data, and Recital 26 says such data remain information about an identifiable person when they can be attributed with extra information (GDPR, EUR-Lex). Frameworks such as UID2 add salts, rotating tokens and opt-out portals on top.

Example: UID2's documentation works through USER@example.com. Normalised, it becomes user@example.com. Its SHA-256 hash in hex is b4c9a289323b21a01c3e940f150eb9b8c542587f1abfd8f0e1cc1ffc5e475514, and the Base64 value sent to the UID2 operator is tMmiiTI7IaAcPpQPFQ65uMVCWH8av9jw4cwf/F5HVRQ=. We recomputed the hex hash for this page on 9 November 2026.

Related terms: UID2, EUID, RampID, clean room, user matching.

Authoritative source: UID2 documentation, "Normalization, hashing, and encoding" (last updated 5 November 2026).