12 guides · Identity and matching
Hash email. Leave the IP in the clear.
A raw email is a privacy incident. A hashed IP is an unmatchable event. Click ids die at hosted checkout. These pages are which field, which format, and which cookie actually joins.
Validate a pixel or CAPI All docs
Hash email and phone. Leave the algorithm as SHA-256.
Email, phone, name, and external_id on Meta, TikTok, Snap, and Pinterest conversion APIs are SHA-256 hex digests of a normalized string. Hash those identifiers. Leave IP, user-agent, and click cookies in the clear.
IP and user-agent are sent in the clear
Conversion APIs want client_ip_address and client_user_agent in the clear. A SHA-256 digest in those fields cannot match a browser. Hash email and phone instead. Pixellint flags the digest as hashed_plaintext_field.
Lowercase, trim, then hash
Trim whitespace, lowercase the address, then SHA-256. Hashing Buyer@Example.com does not match buyer@example.com. Google Ads enhanced conversions add Gmail-specific rules. Meta, TikTok, Snap, and Pinterest hash the string you send after trim and lowercase.
E.164, then SHA-256, not a local format
Normalize the phone to digits with a country code (E.164 without spaces or a plus), then SHA-256. Hashing (650) 555-1212 never matches 16505551212. Local formats are a miss. Country code is required.
gclid, fbclid, ttclid, msclkid, li_fat_id
Paid platforms join conversions on click ids: gclid, fbclid, ttclid, msclkid, li_fat_id, twclid. UTMs do not replace them. Capture on the landing URL and send them again on the conversion.
The _fbc cookie is the click, not the raw fbclid
The _fbc cookie is Meta's click cookie, built from fbclid as fb.1.timestamp.fbclid. _fbp is the browser id cookie. Send both on conversion API events as user_data.fbc and user_data.fbp. Do not paste the raw fbclid into fbc. Do not mint a fake _fbp.
client_id is analytics. external_id is yours.
GA4 client_id is the analytics browser id. Meta external_id is your customer key, hashed. Firebase app_instance_id is the app stream id. They are not aliases. Do not paste one into the other field.
distinct_id is who PostHog and Mixpanel join on
PostHog requires distinct_id on every capture, including each batch row. Mixpanel joins on properties.distinct_id. Segment uses userId or anonymousId, which destinations often map to distinct_id.
Send the client IP, not the VPC NAT
CAPI matching wants the browser IP and User-Agent, not the NAT on your VPC and not your HTTP client's UA string. Hashing those fields, or sending the load balancer address, poisons match quality.
The platform's graph is not your CDP
Meta, Google, and the CDPs each keep a graph you do not own. You send hashed PII, click ids, and cookies. You do not download their device graph. Matching is a payload problem, not a warehouse join you can copy.
Safari will expire that cookie
Safari Intelligent Tracking Prevention blocks third-party cookies and caps first-party cookies that look like trackers. _fbp and _ga will expire sooner than your tag's max-age. Design for click ids and server events. CNAME cloaking is classified.
Checkout on another host drops the click id
Checkout on another host drops first-party cookies and often the click id. Shop.example.com does not see _fbp from www.example.com unless Domain=.example.com. Forward gclid, fbclid, and the cookies you need, or fire CAPI from the order. GA4 linker uses _gl.