Advanced matching is a Meta Pixel feature that attaches customer details, such as an email address, a phone number or a name, to the events a website reports to Meta. The details are hashed with SHA-256, a one-way cryptographic function, and Meta compares the hashes with hashed data it holds for Facebook and Instagram accounts. The feature exists because a pixel event on its own carries only cookies, an IP address and a browser signature, and those signals fail often: cookies are blocked or deleted, people switch devices, and many visitors are not logged in to Facebook on the browser they use to shop. A hashed email typed into a checkout form gives Meta a sturdier way to work out who converted, feeding attribution, optimisation and retargeting.

The term belongs to Meta, but the mechanism has spread. TikTok uses the same name, Pinterest calls its version enhanced match, and OpenAI adopted "automatic advanced matching" for ChatGPT ads in 2026.

How the data travels

Meta offers two modes. In manual advanced matching, the advertiser's developer passes customer data into the pixel's base code as a third argument of the fbq('init') call. Meta's developer documentation lists eleven keys: em (email), fn and ln (first and last name), ph (phone), external_id (any advertiser-assigned identifier), ge (gender, f or m), db (date of birth as YYYYMMDD), ct (city), st (two-letter state code), zp (postal code) and country. A comment in Meta's sample code notes that values "will be hashed automatically by the pixel using SHA-256". Advertisers who fire the pixel through an image tag rather than JavaScript must hash values themselves and append them as ud[em], ud[fn] and so on.

Automatic advanced matching needs no code. Once switched on in Events Manager, the pixel script detects form fields that look like customer information and associates their contents with events such as InitiateCheckout, Purchase and CompleteRegistration, according to Meta's July 2018 announcement. That post said the feature was "not designed to collect any sensitive information", listing passwords and financial, health and government data as examples. An API published in November 2018 exposed two settings, enable_automatic_matching and automatic_matching_fields, so agencies could turn the feature on and choose fields across many pixels at once.

Normalisation matters because a hash only matches if the input is identical. An email address must be trimmed and lowercased before hashing. A phone number needs its country code and loses symbols and leading zeros. A United States postal code is cut to five digits.

The server-side counterpart

The Conversions API, Meta's server-to-server channel, carries the same keys in a user_data object, and there the advertiser does all the hashing. Meta's customer information parameters page marks email, phone, names, date of birth, gender and location fields as "hashing required", recommends hashing external_id, and says the IP address, user agent and the fbc and fbp cookie values must never be hashed. At least one user_data parameter is mandatory. Browser and server copies of the same event are deduplicated through a shared event_id, with matches inside 48 hours counted once.

Measuring match quality

Meta scores the result with Event Match Quality (EMQ), a rating out of ten. The score reflects which customer information parameters are sent, how well they are formatted and the share of events matched to a Meta account. The Dataset Quality API, documented at Graph API version 25.0, returns a composite_score per event alongside match_key_feedback showing coverage for each key, for example the percentage of Purchase events carrying an email. EMQ covers web events only, as of October 2026. Unlike a match rate on an uploaded customer list, it grades individual events.

Origin and evolution

Facebook introduced advanced matching for its pixel in 2016. A MuteSix summary dated August 15, 2016 described the expansion of matchable fields to names, location, date of birth and gender, and relayed Facebook's claim of 10% more attributed conversions and 20% more retargeting reach. These are platform figures that have not been independently tested.

The automatic variant followed on July 20, 2018. Christine Lu, writing on Meta's developer blog, reported, without independent verification, an average increase of about 8% in matched purchases among beta advertisers and a 27% rise in attributed conversions for one meal-kit company.

Deterministic customer data grew more valuable as browsers limited third-party cookies and Apple enforced App Tracking Transparency with iOS 14.5 in April 2021. Meta's server-side channel, first called the Server-Side API, operated as the Conversions API by autumn 2020 and carried the same hashed fields. On April 15, 2026, Meta added AI-assisted enrichment of pixel events and a one-click Conversions API setup, claiming web Conversions API users saw a 17.8% lower cost per result. The platform-managed version that went live later that month mirrors whatever parameters the pixel already sends, advanced matching values included, with no option to select them.

Why it matters

For advertisers, matched events are the raw material of reporting and optimisation. An event Meta cannot attribute to an account cannot credit an ad or train delivery. Hashed email and phone numbers are deterministic signals: exact keys that either match or do not, rather than probabilistic guesses.

Other platforms copied the model. TikTok's help centre describes manual and automatic advanced matching for its pixel and Events API, with emails and phone numbers hashed with SHA-256 before reaching TikTok's servers. In January 2025, Kepler's Jonathan D'Souza-Rauto found that the TikTok pixel could process advanced matching parameters such as hashed emails and phone numbers even as the app went dark in the United States. The IAB Tech Lab's ECAPI 1.0, finalised on May 3, 2026, standardises the same normalise-then-hash approach for server-to-server conversion APIs.

Limitations and disputes

The central dispute concerns what hashing achieves. An unkeyed SHA-256 hash of a common email address can be recomputed by anyone holding the address, which is precisely how Meta matches it. The US Federal Trade Commission (FTC) said so in a July 24, 2024 blog post, warning that hashed data is not anonymous because a hash still serves as a persistent identifier. European regulators treat such values as pseudonymised, not anonymised: the European Data Protection Board's Guidelines 01/2025, adopted on January 16, 2025, hold that pseudonymised data remains personal data.

Automatic detection is a second point of friction. Form scanning cannot reliably tell a shopper's email from a field the advertiser never intended to share. On November 22, 2022, The Markup reported that TaxSlayer's pixel sent filers' names, phone numbers and dependents' names to Meta through advanced matching, and that TaxAct sent dependents' names. Reporters Simon Fondrie-Teitler, Angie Waller and Colin Lecher found the feature off by default when they created a test pixel. The resulting class action, In re Meta Pixel Tax Filing Cases (No. 22-cv-07557-PCP, Northern District of California), is still running. On August 6, 2025, Judge P. Casey Pitts let a California pen register claim proceed, noting that "if the Pixel data includes personal information like a name or email, Meta can also use that to perform a match."

Enforcement has followed similar data flows. On March 2, 2023, the FTC ordered BetterHelp to pay $7.8 million over allegations that it disclosed email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest. "BetterHelp betrayed consumers' most personal health information for profit," said Samuel Levine, then director of the FTC's Bureau of Consumer Protection. In Germany, the Dresden Higher Regional Court on February 3, 2026 awarded four users 1,500 euros each over Meta's Business Tools, a category covering the pixel and Conversions API, whose contact data is hashed using SHA-256 as Meta prescribes. Advertisers sending such data to Meta share joint controller responsibility under Article 26 of the General Data Protection Regulation (GDPR).

There is also a measurement objection. EMQ is computed by Meta, about Meta's own matching, with no external audit, so advertisers cannot verify what a higher score delivers.

Not the same as

Custom Audiences and Customer Match. These are list uploads: an advertiser hashes a customer file and sends it to Meta or Google to build a targeting audience. Advanced matching works event by event, at the moment of a page view or purchase.

Enhanced conversions. Google's equivalent, introduced in May 2021, supplements Google Ads conversion tags with hashed first-party data. The concept is close, but settings and normalisation rules differ.

Conversions API. A transport channel, not a matching method. It can carry advanced matching keys, but it also sends events with no customer data at all.

Enhanced match. Pinterest's term for adding a hashed email to its tag. Its image-tag method accepts SHA-256, SHA-1 or MD5 hashes.

Recent developments

OpenAI announced conversion tracking for ChatGPT ads in May 2026, with a pixel and a Conversions API that rely on a shared event_id for deduplication. In emails sent on July 24 and in the week of August 3, 2026, it told advertisers that automatic advanced matching would become the default on existing pixels from August 17, 2026, unless they opted out. OpenAI was meanwhile sued in May 2026 by a user alleging that ChatGPT.com passed data to Meta and Google, including a hashed email captured by Google Analytics.

On October 5, 2026, IMDEA Networks researchers reported that several AI chatbots pass hashed emails or stable identifiers to trackers, with Grok on Android sending hashed emails to TikTok. In California, Governor Gavin Newsom on September 30, 2026 signed SB 690, which removes private lawsuits under the pen register provision for website tracking from January 1, 2027, the same statute at issue in the tax filing case. Wiretap claims carrying 5,000 dollars per violation remain available.

Timeline

  • 2016 - Facebook introduces advanced matching for its pixel, extending matchable fields to names, location, date of birth and gender.
  • August 15, 2016 - MuteSix relays Facebook's claim of 10% more attributed conversions from the feature.
  • July 20, 2018 - Meta launches automatic advanced matching, citing an average 8% rise in matched purchases in beta.
  • November 12, 2018 - Meta publishes API fields to enable automatic advanced matching and select its fields programmatically.
  • 2020 - Meta's server-side channel operates as the Conversions API, carrying hashed customer parameters.
  • April 2021 - Apple enforces App Tracking Transparency with iOS 14.5; Google introduces enhanced conversions in May.
  • November 22, 2022 - The Markup reports tax filing sites sent names and phone numbers to Meta through advanced matching.
  • March 2, 2023 - The FTC orders BetterHelp to pay $7.8 million over disclosures to Facebook and other platforms.
  • July 24, 2024 - The FTC states that hashing does not make data anonymous.
  • January 16, 2025 - The EDPB adopts Guidelines 01/2025 on pseudonymisation.
  • August 6, 2025 - Judge P. Casey Pitts allows a pen register claim against Meta's pixel to proceed.
  • February 3, 2026 - Dresden Higher Regional Court awards damages over Meta's Business Tools.
  • April 15, 2026 - Meta announces AI-assisted pixel enrichment and one-click Conversions API setup.
  • May 3, 2026 - IAB Tech Lab finalises ECAPI 1.0.
  • August 17, 2026 - OpenAI makes automatic advanced matching the default on existing ChatGPT ads pixels.
  • September 30, 2026 - California signs SB 690, limiting private pen register suits from January 1, 2027.

Summary

Who. Meta built advanced matching for its pixel; advertisers and their developers or tag platforms decide whether to enable it and which fields to send. TikTok, Pinterest and OpenAI run comparable features, while the FTC, European data protection authorities and courts set the legal limits.

What. Advanced matching attaches SHA-256 hashed customer details, such as email, phone, name and location, to pixel events so the platform can link a website action to an account. It runs manually through code or automatically by detecting form fields, and Meta grades the result with an Event Match Quality score out of ten.

When. Facebook introduced the feature in 2016, added the automatic version on July 20, 2018, and has extended the same fields to its Conversions API since 2020. OpenAI made automatic advanced matching its default on August 17, 2026.

Where. It operates in the browser, within the pixel's JavaScript, on advertiser websites, with server-side equivalents in conversion APIs. Matching itself takes place on the ad platform's servers.

Why. Cookies and device identifiers fail more often than they once did, and hashed contact data gives platforms a more durable key for attribution and optimisation. The same durability is why regulators and courts treat hashed identifiers as personal data rather than anonymous signals.