OpenAI Ads Kullanıcı Veri Alanları: Ne Hash'lenmeli, Ne Ham Gönderilmeli ve Ne Gönderilmemeli

Event Match Quality is the silent lever that makes or breaks paid campaigns on OpenAI Ads.

When a shopper clicks an ad in ChatGPT, browses your site, and buys, OpenAI needs to match that transaction back to the exact user who clicked. If you only pass a click ID, attribution is fragile. If the user switched devices or cleared cookies, the match fails completely.

To achieve 90%+ match rates, you have to feed customer identity signals (email addresses, phone numbers, zip codes) to OpenAI. But you cannot send raw customer data across the wire. Every identifier must be normalized and hashed using SHA-256 before transmission.

Get the normalization wrong by a single trailing space or uppercase character, and the SHA-256 hash output changes entirely. Match failed.

Here is the exact technical blueprint for normalizing and hashing every supported user data field for both the browser pixel and the Conversions API.

---

1. Field-by-Field Reference Table

Below is the definitive reference for every supported parameter within the user_data block:

---

2. Normalization Rules: Why Exact Pre-Processing Matters

A cryptographic hash function like SHA-256 produces completely different output if even a single byte differs:

• sha256("alex@company.com") = 5885e35f79901981437bd82f3c73e9f45618f1a4e698ef75c7dd88b8e0bb8f32
• sha256("Alex@company.com ") = 127d422a578ba25624775d71a9420b91e70d42194918e7e174b5a2bf28a8d119

If your system hashes the email with an accidental space or uppercase character, OpenAI's attribution system will never match it against the user's registered account.

Email Normalization (em)

1. Remove all leading and trailing whitespace.
2. Convert all characters to lowercase.
3. For Gmail addresses, you may optionally remove internal dots, but standard lowercase trimming is the universal baseline.

Phone Number Normalization (ph)

1. Remove all spaces, dashes, parentheses, and brackets.
2. Remove any leading + sign.
3. Ensure the country code is included (e.g., US number +1 (555) 019-2834 becomes 15550192834).
4. Generate the SHA-256 digest on the clean digit string.

---

3. Production Code Implementation (Node.js & Python)

Node.js / TypeScript Utility Function

import * as crypto from 'crypto';

export interface RawUserData {
  email?: string;
  phone?: string;
  firstName?: string;
  lastName?: string;
  clientIp?: string;
  userAgent?: string;
  country?: string;
}

export function formatOpenAiUserData(data: RawUserData) {
  const hash = (val: string | undefined): string | undefined => {
    if (!val) return undefined;
    const clean = val.trim().toLowerCase();
    if (!clean) return undefined;
    return crypto.createHash('sha256').update(clean).digest('hex');
  };

  const hashPhone = (phone: string | undefined): string | undefined => {
    if (!phone) return undefined;
    // Strip everything except numbers
    const digits = phone.replace(/\D/g, '');
    if (!digits) return undefined;
    return crypto.createHash('sha256').update(digits).digest('hex');
  };

  return {
    em: hash(data.email),
    ph: hashPhone(data.phone),
    fn: hash(data.firstName),
    ln: hash(data.lastName),
    country: data.country ? data.country.trim().toLowerCase().slice(0, 2) : undefined,
    client_ip_address: data.clientIp,
    client_user_agent: data.userAgent
  };
}

Python Utility Function

import hashlib
import re

def hash_sha256(val: str) -> str:
    if not val:
        return None
    cleaned = val.strip().lower()
    return hashlib.sha256(cleaned.encode('utf-8')).hexdigest()

def hash_phone(phone: str) -> str:
    if not phone:
        return None
    digits = re.sub(r'\D', '', phone)
    return hashlib.sha256(digits.encode('utf-8')).hexdigest()

---

4. What Happens if You Send Raw PII?

Submitting unhashed personal data (such as raw email addresses) violates the API contract. OpenAI Ads CAPI responds with a schema validation rejection:

{
  "error": {
    "code": "invalid_payload",
    "message": "Field 'user_data.em' must be a valid 64-character SHA-256 hex string.",
    "param": "events[0].user_data.em"
  }
}

Beyond technical rejection, sending unhashed personal data across third-party networks creates compliance liabilities under GDPR and CCPA. For guidance on legal and privacy safeguards, read our analysis on OpenAI Ads privacy and measurement.

---

5. Summary: Best Practices for High Match Quality

1. Hash at the Source: Perform SHA-256 hashing inside your secure backend worker before building the CAPI JSON body.
2. Combine Multiple Identifiers: Providing both hashed email (em) and hashed phone (ph) increases match rates significantly compared to single-identifier payloads.
3. Always Include Network Signals: Whenever sending server conversions for web interactions, include client_ip_address and client_user_agent alongside hashed PII.
4. Never Guess or Fabricate: If a customer does not provide a phone number, omit ph entirely. Never submit a dummy hash or placeholder string like sha256("null").

To have your full conversion stack configured with automated client/server hashing and verified event deduplication, explore our Pixel + CAPI Complete Setup service.