Syllabus Lesson 24 of 156 · Pixels, beacons, apps and the invisible web
Pixels, beacons, apps and the invisible web

Logged-in and hashed-email tracking

Why it matters As browsers make cookie tracking harder, the industry relies more on something you hand over willingly: your email address. Understanding why that works shows you simple habits, such as email aliases, that take the power back.

The membership card

A cookie is a ticket each shop gives you, different at every shop. Your email address is more like a national membership card: you show the same one at every shop. If shops compare notes, the card links everything you did.

Why sites want you logged in

  • It works on every device. Your phone, laptop and tablet each have different cookies, but you log in with the same account everywhere.
  • It survives cookie clearing. Log in again and your history reconnects.
  • It carries real details: name, address, purchases.

Logging in is often genuinely useful. The point is to choose when, not to never do it.

Hashed emails

Hash: a recipe that turns any text into a fixed-length code. The same text always gives the same code, but you cannot easily run the recipe backwards. Think of it as a fingerprint of the text.

Companies often say they share only a "hashed" email, never the email itself. Here is a hash (made with a common recipe called SHA-256) of a made-up address:

ana@mail.example  ->  7f0d4910592408724f1860bc3faf02f793ec9704e13802e246203501f10d3b99

That code looks anonymous. But every company that knows Ana's email can compute exactly the same code. So when shopa.example and adco.example both send the code, they can tell it is the same person, without ever exchanging the address. The hash is not hiding Ana; it is giving her a shared ID.

Hashed-email ID: an advertising ID built from a hash of your email address (or phone number), often after tidying it, for example making it lower case. Some industry ID systems, such as UID2, work this way and offer an opt-out page.

Tidying matters: Ana@Mail.example with capitals and a space would give a completely different code, so companies normalise addresses first to make sure the codes match.

Payment and account linking

The same idea works with other details you repeat. Paying with the same card online and in a shop, using a loyalty card, or signing in with one big account on many sites all give companies a shared key to join records together.

What you can do

  • Email aliases: use a different address per site. Many mail providers and password managers can create aliases that forward to your real inbox. Different address, different hash, nothing to match.
  • Guest checkout when you do not need an account.
  • Log out of big accounts in the browser you use for casual browsing, or use a separate browser profile.

A common misconception

"Hashed means anonymous." A hash hides the address from people who do not already know it. To anyone who does, it is as good as the address itself. This is called pseudonymous: a stand-in name, not no name.

Recap

  • Logins give a stable ID across devices that survives cookie clearing.
  • A hash of your email is the same everywhere, so it works as a shared ID.
  • Hashed is pseudonymous, not anonymous.
  • Email aliases and guest checkout break the link.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back