Are You Giving Away Your Customers’ Identities?

Suppose you want to share some customer information with another company but do not want to hand over your customers’ email addresses. One obvious precaution is to hash them first. The readable address is replaced by a string of characters from which the original is not supposed to be recoverable.

That sounds as though the customer's identity has been removed from the transaction. But for much of what marketers want to do, the point is that it hasn't.

Customer matching works because the same underlying identifier produces the same result when it is normalised and hashed consistently. If you and a platform already possess the same email address, you can both transform it and compare the outputs. There is no need for the platform to reverse your hash and recover the address you started with. It already has its own copy. A match establishes that the person in your system is the same person in theirs.

Google describes exactly this process for Customer Match. Advertisers can provide SHA-256-hashed email addresses and phone numbers, and Google compares the resulting strings with hashed identifiers for Google accounts. Google also says the uploaded files are restricted to creating Customer Match audiences and policy compliance and are not used to build or enhance customer profiles. The point is not what Google subsequently does with the information. It is what the matching mechanism demonstrates.

Hashing can hide the identifier while preserving the connection.

That is not a failure of hashing. It is doing precisely what it is supposed to do. Protecting the identifier and making matching impossible would defeat the purpose.

I first stopped taking the word hashed at face value years ago after a conversation with a security and privacy expert. We were discussing an article that presented a hashed email address as an example of protecting identity. He looked at the hash, scoffed and told me he could identify the address behind it. Not long afterwards, he sent the address back to me. What stayed with me was how easily I, like most marketers, had allowed the word hashed to imply something stronger than it actually did.

At first I thought the important point was that a hashed email address could sometimes be matched back to the original. I now think that misses the more important issue: nobody needs to recover the readable address for identity to survive. If both parties already possess the same identifier, the hash can do exactly what it was designed to do and still preserve the connection.

We tend to assume that removing the identifier removes the identity. It doesn't.

The identifier is not the identity

By identity I do not mean somebody's name written at the top of a record. I mean the ability to recognise that two observations relate to the same person, and with enough confidence to attach further information or action to them.

An email address is exceptionally useful because it can act as an identity spine, connecting customer accounts, transaction histories, CRM records, ecommerce activity and addressable-media audiences. But continuity does not always require an email address. Identity can sometimes emerge from the information itself.

Location provides an unusually clear example. Knowing that an unidentified device was at one place at a particular time may tell you very little. Add a regular overnight location, a weekday journey and another recurring destination, and what appeared anonymous can become remarkably distinctive.

In their 2013 Scientific Reports paper, Unique in the Crowd: The privacy bounds of human mobility, Yves-Alexandre de Montjoye, César A. Hidalgo, Michel Verleysen and Vincent D. Blondel analysed 15 months of mobility data from 1.5 million people. They found that just four randomly chosen spatio-temporal points were sufficient to uniquely characterise 95 per cent of the mobility traces in that particular dataset.

That does not mean four location points will identify 95 per cent of people in every dataset; the result depends on the population, granularity and information available. What matters is the mechanism: combinations of ordinary observations can become identifying because the intersection between them is unusual.

The UK Information Commissioner’s Office makes essentially the same distinction. Its anonymisation guidance identifies both singling out and linkability as important indicators of identifiability. A person can become identifiable because records can be isolated or linked to other information, and that assessment has to consider what additional data is available to the recipient, not merely what appears in the dataset being examined.

A hashed email address begins with an existing identifier and preserves the connection to it. Other combinations can work in the opposite direction: they begin with apparently separate observations and progressively narrow the possibilities until a person can be singled out or recognised.

Identity does not always have to enter the system as an input. Sometimes it is an output.

Nor does a company need one giant file containing everything known about an individual. Transactions, site behaviour, media exposure and location can remain in separate systems. If sufficient connections exist, information can be assembled when needed, without creating a permanent master record.

A profile can therefore exist as a capability rather than a permanent dossier. Can someone be recognised as an existing customer? Did they see an advertisement before purchasing? Does their behaviour resemble that of customers who subsequently churned? Each question can bring together information for a particular purpose.

Timestamps add another dimension. Facts become sequences, revealing direction, recency and repetition. Those patterns can support inferences that individual observations could not.

None of this arrived with AI. Marketers, statisticians, credit scorers and fraud analysts have been combining observations for decades. AI changes the scale, speed and range of combinations that can be examined. A pattern that was too weak, dispersed or expensive to find yesterday may become useful tomorrow because the machinery for finding it has improved.

What can be learned from information is not fixed at the moment somebody supplies it.

What exactly did the customer give you permission for?

The first article in this series assumed a business had collected its customer data legitimately, and asked what happened next, when some of that information was deliberately shared with advertising platforms, analytics companies, measurement providers, agencies, identity services and other partners. Its conclusion was that permission is not an intrinsic property of a piece of data. Its adequacy depends on what you do with the information and on the environment into which you place it. The same field can have very different informational consequences when received by two organisations with very different independent knowledge and capabilities.

Identity sharpens that problem considerably.

You may never hand a partner someone’s readable email address. You may remove the name. You may hash the identifier. You may share only an audience membership, location, timestamp, transaction or behavioural event.

Yet the right question is not simply whether any one of those things identifies the customer in isolation.

It is whether what you provide allows identity to survive, or helps identity to emerge, when it meets everything else the recipient already knows or can legitimately access.

That is why a perfectly accurate description of the data being transferred can still leave management with an incomplete picture of what the transfer makes possible.

“We share hashed email addresses” describes the field.

“We enable another system to recognise which of its users are also our customers” describes what the field does.

“We share location and timestamp data” describes two fields.

“Those observations may be distinctive enough, particularly when combined with other information, to single out or recognise individuals” describes what the combination can do.

Those are not interchangeable descriptions.

Nor is this an argument against hashing, matching, identity resolution or customer data sharing. Modern businesses depend on recognising customers. Measurement requires continuity between events. Fraud prevention depends on connecting behaviour. Personalisation depends on knowing enough about previous interactions to make the next one more useful. There is no serious version of modern commerce in which every observation remains permanently disconnected from every other observation.

The problem therefore cannot be solved by demanding that nothing ever be joined. The more useful question is what follows from accepting that joining is fundamental to the system.

As I argued in the first article, businesses need to understand what they have authorised their partners to do, and what becomes possible when their data is combined with information held elsewhere.

That means looking beyond the fields being shared to the ability to recognise, connect and learn about the people behind them.

That leaves a CMO, data lead or whoever owns the decision with four fairly simple questions:

Are we describing the data we send, or what the recipient can actually do with it?

Can the recipient recognise the customer even though we have removed or hashed the obvious identifier?

What can become knowable about that customer when our data is combined with information the recipient already holds or can legitimately access?

Would we make the same decision if the capability we were enabling were described as plainly as the fields being transferred?

The board doesn't need to understand the technology. It needs to understand what the technology makes possible.