A hashed email address looks wonderfully anonymous.
It is a long string of hexadecimal garbage.
That appearance can be misleading.
If two companies start with the same email address, normalize it the same way, and run the same hashing algorithm, they can produce the same hash.
Now the ugly string becomes a matching key.
Hashing hides the readable address, not necessarily the relationship
Google’s current Customer Match documentation instructs advertisers to normalize customer emails and hash them with SHA-256 before upload. Google then compares those hashed values against hashed account information to find matches. See Google Ads Data Manager’s Customer Match formatting guidance and How Google uses Customer Match data.
That is the important property.
Google does not need to reverse the hash into the original address in order to know that two records represent the same normalized email.
It only needs both sides to generate the same result.
Suppose:
leo@example.com
is normalized and hashed into:
4c...9f
An advertiser can upload 4c...9f.
A platform can independently hash its copy of leo@example.com and get 4c...9f too.
The plaintext address never has to travel in the matching file for the records to connect.
One-way does not mean anonymous
SHA-256 is a one-way cryptographic hash function. That is useful because the hash is not intended to be decrypted back into the original input.
But anonymity is a different question.
Email addresses come from a relatively structured and often guessable input space. More importantly, a party that already possesses the email address does not need to guess anything. It can simply hash its own copy and compare results.
LiveRamp’s current identity-resolution documentation explicitly accepts hashed email addresses as inputs for resolving records to persistent person- or household-level identifiers. See LiveRamp’s RampID identity-resolution documentation.
That is pseudonymization with matching utility intact.
The readable identifier is transformed.
The ability to connect records survives.
Persistent matching can outlive a cookie
Cookies can be cleared.
Browsers can partition storage.
Mobile advertising IDs can be reset or deleted.
An email address may remain stable for years.
If that email is repeatedly transformed into the same standardized hash, the hash can provide a durable bridge between customer databases, advertising systems, measurement tools, and identity-resolution services.
That does not mean every hashed email is shared broadly or used forever. Actual use depends on the service, contracts, retention rules, platform policies, and user choices.
But the technical lesson is simple.
Replacing a name with a deterministic code does not erase identity if everyone who matters knows how to produce the same code.
The Surveillance Economy frequently works by changing what an identifier looks like without changing what it can connect.