Does my setup send hashed customer data to Google Ads?
By the HonestTag team ยท Published October 27, 2026
Hashed customer data is the buyer's own email or phone, turned into a hash and sent with the conversion. Google can use it to tie an order to a Google account that was signed in when that person engaged with an ad, which helps when the click id is missing. It only works if the email or phone from that order is sent with the order. A snippet that cannot read the checkout sends none. A server path that has the order's email can send it with every order that has one. A throwaway guest email matches nothing. More matches make Google's number bigger, so check it against your own order count.
Install HonestTag free and run the Mirror plan beside your current tracking. It sends no purchases or conversions to your ad platforms, so it cannot double-count a sale or change your current setup, and it shows which platform claims hold up against the new customers in your real orders. Free at any store size.
What it is
When a buyer checks out, they type an email address, and often a phone number. Sending that email or phone with the purchase, in hashed form, lets Google look for the same person among Google accounts that were signed in when that person engaged with an ad. That helps when the order has no click id, for example because the cookie that held it was cleared or the link lost it.
A hash is a fixed-length string computed from the text: the same text always gives the same hash, and changing one character gives a completely different one. SHA-256, the hash used here, is one-way, so there is no way to compute the email back from the hash; the platform can only check whether it equals the hash of an email it already holds.
Google's Data Manager API, a server interface for sending conversions to Google Ads, calls this "user-provided data," described as "User-provided data such as an email address or phone number" (Format user data). Its reference describes the email field as a "Hashed email address using SHA-256 hash function after normalization" (UserData). Where this fits in a Google Ads setup, and the consent Google asks for before it is used, is in Google Ads conversion tracking.
Why the exact format matters
Because one changed character changes the whole hash, the email has to be written exactly the way Google writes it before hashing. Google's rules are: trim leading, trailing and intermediate whitespace and lowercase the address; for a gmail.com or googlemail.com address, remove the dots before the @ and remove a plus sign and everything after it; leave dots and plus signs alone on every other domain. Trim the phone number and write it in E.164, with the plus sign, the country code and only digits after the plus. Then hash with SHA-256 and encode the hash as hex or Base64 (Format user data). An email sent with a capital letter, or a phone number without its country code, produces a hash that will not equal the one Google computes.
A month of Google clicks, in counts
The numbers below are made up to show the arithmetic. They are not from a real store and not an estimate of what any store will see.
- A store takes 100 orders in a month from buyers who had clicked one of its Google ads.
- 70 of those orders still carry the click id. Google can tie them to the click without any email.
- 30 have no click id: the cookie was cleared, the buyer came back on another device, or the link lost it.
- Of those 30, 12 buyers typed an email that is on a Google account they were signed in to when they engaged with the ad.
- 9 typed an email that is not on any Google account, or used another address there.
- 9 checked out as guests with a throwaway address.
A hashed email can give Google at most 12 more matches in this example, for the 12 buyers whose email is on a signed-in account. The other 18 (9 + 9) match nothing, no matter how the email is sent. The 70 orders with a click id already had something to match on. In this made-up month, the most Google could tie to an ad is 82 (70 + 12) out of 100, and that only if the 70 reach Google with their click id and the 12 reach Google with their hashed email.
Match orders without a checkout script. On the Starter plan and up, HonestTag sends Google the click ID when the order has one and, where available, the buyer's hashed email and phone from the order.
Why a setup sends none, or sends it on every order
A merchant on the Shopify Community forum reports a Google Ads message, "user-provided data is no longer present" (October 2024). Whatever the message says, the underlying conditions are these:
- It has to travel with the conversion. The email or phone has to be sent with that purchase. Data captured on one page and lost before the purchase is sent does not help.
- A snippet that cannot read the checkout sends nothing. Shopify loads custom pixels in a "Lax sandbox," and says features "that rely on scraping the DOM for information" will not work there (About web pixels, Custom pixels). A tag-manager setup that read the email out of checkout form fields gets nothing that way. Shopify's
checkout_completedevent carries the email and phone as data instead, and each needs its own access scope (checkout_completed). - A server path that has the order sends it on every order that has one. The order itself carries the email the buyer gave, so a server that sends the purchase from the order can send the hashed email with every order that has one, whatever happened in the browser. Server-side tracking covers what else that changes, and what it does not.
- A throwaway email matches nothing. A guest who typed an address that is not on a Google account gives Google nothing to match, even when the hash is perfect.
The trade-offs
- It only helps when Google knows the email. A hashed email adds a match only when it equals an email on a Google account that was signed in when that person engaged with the ad. For everyone else it adds nothing.
- Raw email is a different thing. A setup that sends the plain email anywhere, in a URL, to another tag or to another tool, is not doing hashed matching, whatever it is called. Google's Data Manager format asks for the SHA-256 hash of the normalized address.
- A hash is not a secret. Anyone who already has an email can hash it and compare. That is how matching works, and it is also why a hash only helps a platform that already knows the person.
- More matches mean a bigger platform number. Each extra match is one more of your orders that Google can credit to an ad, so the purchase count in Google Ads can go up. It cannot add orders your store did not take. Check Google's purchase count against your own order count for the same days.
What HonestTag sends
- On the Starter plan and up, on every Google delivery. Each delivery to Google carries the click id when the order has one and, where available, the buyer's email and phone, hashed with SHA-256 in memory before they leave HonestTag. The email and phone come from the Shopify order itself, so they do not depend on a script reading the checkout page.
- Written Google's way first. The email is trimmed and lowercased, and on gmail.com and googlemail.com addresses the dots and any plus suffix are removed, as Google's rules say. An address with a space still inside it is left out. The phone is written in E.164 with its country code, using the buyer's country from the order. A phone number that cannot be placed in a country is left out rather than guessed.
- Never in the clear. Raw email addresses and phone numbers are not placed in attribution keys or delivery queues, and are never sent to Google in the clear by this delivery path.
- Other ad platforms. Meta, Microsoft Advertising, TikTok, Pinterest, Reddit and ChatGPT Ads also get the email and phone hashed with SHA-256 before they leave, each written to that platform's own rule. The rule that removes dots and a plus suffix only on gmail.com and googlemail.com, and leaves them on every other domain, is Google's and is used only on the Google path. How Meta scores these details is in Meta Conversions API.
- The Mirror plan sends none. The free Mirror plan sends no purchases to any ad platform, so it sends no hashed customer data with them either.
The server-side delivery docs list everything that reaches Google, including the consent signals sent with each order. If another tool also sends purchases to Google Ads, read duplicate purchase events first.
Frequently asked questions
Can Google read my customers' emails from the hash?
No. SHA-256 is one-way: there is no way to compute the email back from the hash. Google can only check whether the hash equals the hash of an email it already holds.
Why does a tag manager on my checkout send no customer data?
The email has to be sent with the conversion. Shopify loads custom pixels in a sandbox where code that scrapes the page does not work, so a snippet that reads checkout form fields gets nothing. The email is in Shopify's checkout event data instead.
Will sending hashed emails make Google report more sales?
It can credit more of the orders you send to ads, so the number in Google Ads can go up. It cannot add orders your store did not take. Check Google's purchase count against your own order count.
Does a hashed email help with a guest checkout?
Only if the email the guest typed is one Google knows on a Google account that was signed in when they engaged with the ad. A throwaway address matches nothing.
Match orders without a checkout script
On the Starter plan and up, HonestTag sends Google the click ID when the order has one and, where available, the buyer's hashed email and phone from the order.
- No risk to your setup. The Mirror plan sends no purchases or conversions to your ad platforms, so it cannot double-count a sale or change your current setup.
- Claims against real orders. It shows what Google Ads, Meta, Microsoft Advertising and TikTok claim beside the new customers whose first recorded ad click or ad-tagged link was that platform, counted from your own orders.
- Free at any store size. The Mirror plan stays free whatever your sales.