Hash email. Leave the IP in the clear.
A raw email is a privacy incident. A hashed IP is an unmatchable event. Click ids die at hosted checkout. These pages are which field, which format, and which cookie actually joins.
Validate a pixel or CAPI All docs
Hashing PII for CAPI
Email, phone, name, and external_id on Meta, TikTok, Snap, and Pinterest conversion APIs are SHA-256 hex digests of a normalized string. Hash those identifiers. Leave IP, user-agent, and click cookies in the clear.
Do not hash IP or user-agent on conversion APIs
Conversion APIs want client_ip_address and client_user_agent in the clear. A SHA-256 digest in those fields cannot match a browser. Hash email and phone instead. Pixellint flags the digest as hashed_plaintext_field.
Email normalization before SHA-256
Trim whitespace, lowercase the address, then SHA-256. Hashing Buyer@Example.com does not match buyer@example.com. Google Ads enhanced conversions add Gmail-specific rules. Meta, TikTok, Snap, and Pinterest hash the string you send after trim and lowercase.
Phone numbers for CAPI
Normalize the phone to digits with a country code (E.164 without spaces or a plus), then SHA-256. Hashing (650) 555-1212 never matches 16505551212. Local formats are a miss. Country code is required.
Click ids
Paid platforms join conversions on click ids: gclid, fbclid, ttclid, msclkid, li_fat_id, twclid. UTMs do not replace them. Capture on the landing URL and send them again on the conversion.
The _fbc cookie
The _fbc cookie is Meta's click cookie, built from fbclid as fb.1.timestamp.fbclid. _fbp is the browser id cookie. Send both on conversion API events as user_data.fbc and user_data.fbp. Do not paste the raw fbclid into fbc. Do not mint a fake _fbp.
client_id vs external_id vs Firebase app instance
GA4 client_id is the analytics browser id. Meta external_id is your customer key, hashed. Firebase app_instance_id is the app stream id. They are not aliases. Do not paste one into the other field.
distinct_id
PostHog requires distinct_id on every capture, including each batch row. Mixpanel joins on properties.distinct_id. Segment uses userId or anonymousId, which destinations often map to distinct_id.
IP and user-agent matching on conversion APIs
CAPI matching wants the browser IP and User-Agent, not the NAT on your VPC and not your HTTP client's UA string. Hashing those fields, or sending the load balancer address, poisons match quality.
Identity graphs vs your CDP
Meta, Google, and the CDPs each keep a graph you do not own. You send hashed PII, click ids, and cookies. You do not download their device graph. Matching is a payload problem, not a warehouse join you can copy.
Intelligent Tracking Prevention
Safari Intelligent Tracking Prevention blocks third-party cookies and caps first-party cookies that look like trackers. _fbp and _ga will expire sooner than your tag's max-age. Design for click ids and server events. CNAME cloaking is classified.
Cross-domain tracking
Checkout on another host drops first-party cookies and often the click id. Shop.example.com does not see _fbp from www.example.com unless Domain=.example.com. Forward gclid, fbclid, and the cookies you need, or fire CAPI from the order. GA4 linker uses _gl.