Hash the email. Do not hash the IP. Both mistakes still return 200.
A Purchase reaches the Meta Conversions API with a 64-character hex string in every user_data field. Test Events shows the event. Match quality on the live dataset stays poor, and nobody can see which field missed. The helper hashed the email, which Meta requires. It also hashed the IP address and the click cookie, which Meta requires you to leave alone. Both mistakes return HTTP 200. Vendors…
The Meta Conversions API requires 64-character hex strings in certain user_data fields. Test Events show events are created despite poor match quality. The helper program hashed the email as required by Meta, but also hashed the IP address and click cookie, which is not permitted. Both mistakes result in a 200 HTTP response. Vendors hash the SHA-256 normalization of specific data.
The 64-character hex value is the payload, and the algorithm is not a choice. Fields like em, ph, fn, ln, ge, db, ct, st, zp, country, and external_id are hashed with SHA-256. The helper should not hash PII (personal identifying information) fields or request metadata like client_ip_address and client_user_agent. Raw email in hashed slots causes matching issues and log leaks.
Click ids, cookies, and request metadata must remain plaintext. Double hashing is not recommended as it leads to non-matchable events. The pixel should hash only the raw value, not a pre-existing digest. Deduplication uses event_id, not a second hash. Test with known values and the vendor's example digest before implementing the helper.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
