What a Hashed Email Is
A hashed email is a stand-in for an email address. You take the address, clean it up into a standard form, and run it through a hash function, almost always SHA-256. The output is a fixed string of 64 hexadecimal characters. The same address always produces the same string, and any other address produces a completely different one.
That consistency is the point. An app and an ad platform can each hash the same user's email, compare the outputs, and know they are talking about the same person, without the app ever sending the raw address.
Why Hashed Emails Matter in Mobile Measurement
For years, mobile attribution relied on device advertising IDs. App Tracking Transparency made the IDFA unavailable for most iOS users, and Android users can delete their advertising ID. Measurement shifted toward signals that come from the user's relationship with the app, and the email they sign in with is the most common.
Hashed emails help in three places. In conversion APIs, sending a hashed email with a purchase helps Meta and Google match the conversion to the ad interaction that caused it. In audiences, hashed email lists let you build customer match audiences for retargeting or exclusion. In cross-device measurement, a hashed email shared between a web sign-in and an app sign-in connects journeys that started on one device and finished on another.
Hashing an Email Correctly
Matching depends on every system producing exactly the same hash, and the hash changes completely with any difference in input. So normalise first. Remove leading and trailing whitespace. Convert the entire address to lowercase. Then apply SHA-256 and write the result as lowercase hex.
Check each platform's rules, because some differ in the details. Do not hash an already hashed value, do not hash an empty field, and do not mix normalised and raw values in one pipeline. A single mismatch in normalisation between your app, your server and your MMP is enough to cut match rates sharply without any visible error.
Privacy Considerations
Hashing is not anonymisation. Anyone holding a list of email addresses can hash them and compare against yours, and lists of common addresses are easy to come by. That is why privacy regulators generally treat hashed emails as pseudonymised personal data.
In practice, that means hashed emails need the same care as the emails themselves. Share them only with partners who need them, under a lawful basis or consent that covers the purpose, and include them in deletion and opt-out flows. Under the CCPA, sending hashed emails to an ad platform for cross-context behavioral advertising can count as sharing, which users can opt out of.
Hashed Emails in Linkrunner
Linkrunner's SDKs include an opt-in PII hashing setting, enablePIIHashing(true), which hashes name, email and phone number with SHA-256 before they are sent to Linkrunner servers. It is off by default, so decide with your privacy team whether to enable it.
For multi-touch attribution, available per project on request, Linkrunner connects cross-device journeys through your customer user ID and hashed email or phone, never IP address. See the Trust Center for how Linkrunner handles security and privacy.
Common Mistakes
The most common mistake is inconsistent normalisation, which shows up as low match rates in ad platform diagnostics. The second is sending hashes for users who did not consent, on the assumption that hashed data is exempt. The third is hashing emails that are not real, such as placeholder or relay addresses, which adds noise without improving matches. Validate the address before hashing, and track match rates per platform to catch problems early.
Measuring the Value of Hashed Emails
Ad platforms report how well they match the identifiers you send. Meta shows an event match quality score in Events Manager, and Google shows diagnostics for enhanced conversions and customer match. Watch these numbers before and after adding hashed emails, and per event type, to see whether the extra data is worth sending.
The gains are usually largest on iOS and for users who sign in on several devices, because those are the cases where device identifiers fall short. For apps where most purchases happen without a sign-in, hashed emails add less, and phone numbers may match better in markets such as India where phone sign-in is common.
Keep an eye on coverage too. A hashed email helps only for events where you have one. If sign-in happens late in the funnel, early events such as installs and registrations will carry fewer hashes than purchases. Decide which events need them most and focus your implementation there.