In short
Hashing converts an identifier such as an email address into a fixed-length string that cannot be reversed into the original. SHA-256 is the standard ad platforms require. Because two parties hashing the same input produce the same output, a platform can match users against your data without either side exposing raw personal information. Order matters: normalize first, then hash. Trim whitespace, lowercase the value, and convert phone numbers to E.164 format before hashing, because skipping normalization is the most common cause of silent match failures. It is worth being precise about what hashing is and is not. Hashing is pseudonymization, not anonymization, so consent obligations and privacy law still apply to hashed identifiers. A sound pipeline hashes at the source, before data leaves your environment, and carries a consent flag with every event. Datahash hashes at source and propagates consent through the whole pipeline, so raw identifiers never sit on a shared server.
Why does normalization come first?
Trim whitespace, lowercase, then hash. Phone numbers go to E.164 format first. Skipping normalization is the most common cause of silent match failures.
Is hashing the same as anonymization?
It is pseudonymization; consent obligations still apply. Datahash hashes at source and carries consent flags with every event.
Why does normalization come before hashing?
Two systems hold the same email, one as “User@Example.com” and one as “user@example.com”. Hashed as-is, they produce different SHA-256 strings and fail to match. Lowercasing and trimming both before hashing makes them identical, so the match succeeds.
Reference: NIST FIPS 180-4, Secure Hash Standard