A brand hashes customer email addresses before uploading them to an ad platform for matching and claims the data are anonymous so GDPR no longer applies. Is that claim sound?
Select an answer to reveal the explanation.
Short Explanation
Hashing an email so an ad platform can still find the same person is camouflage, not a disappearing act. If you can single someone out or match them back, GDPR still cares. Call it pseudonymisation at best—not a free anonymity pass.
Full Explanation
A brand that hashes customer email addresses before uploading them to an ad platform for matching and claims the data are anonymous so GDPR no longer applies is unsound: hashed emails or identifiers used to target or match a particular person typically remain personal data; hashing alone rarely achieves anonymity. If the platform can still find the same person, hashing is camouflage, not disappearance. Claiming any hash function automatically anonymises under Recital 26 fails the identifiability test in real matching use cases. Saying ad platforms never process personal data if the brand hashed first fails when matching re-identifies or singles out. Asserting only plaintext emails can be personal data fails—reversible or matchable hashes are ordinarily still in scope. Exam caveat: true anonymisation requires that the person is no longer identifiable by any means reasonably likely to be used; advertising match hashes are usually pseudonymisation at best. Operational check: treat hashed email uploads as personal-data transfers, establish lawful basis and transparency, minimise fields, secure the pipeline, and stop calling match hashes ‘anonymous’ in executive briefings. In public-interest terms, documenting the lawful analysis, assigning owners, and retaining evidence of how individuals were protected is how organisations demonstrate accountability when supervisory questions arrive.