Privacy-Safe Data Onboarding in Europe: A Practical Guide for Hashed Emails

Hashed emails (HEMs) are the most stable identifier in digital advertising. They survive cookie churn, work across devices, and connect CRM data to the open web. In Europe they also carry the most regulatory risk. Many teams have a database of European HEMs sitting idle because nobody is sure what they're allowed to do with it.

If that sounds familiar, you're not alone. Here's a practical way to think about onboarding HEMs safely.

Why hashing alone doesn't make data anonymous

A common misconception is that a hashed email is anonymous. Under GDPR, it isn't. A hash is pseudonymous data: it can still be linked back to a person, so it's still personal data. Hashing is good security hygiene, but it doesn't remove your obligations. You still need a lawful basis and valid consent for each use.

The three questions every onboarding project must answer

What rules apply? Both you and your onboarding partner are typically data controllers, and controllers must be able to show that consent is valid under GDPR Article 5. The UK ICO has also signalled that joining a dataset you process with one you control can make you a controller of the combined data. Matching counts as a join.

How does the match happen? Matching should happen without either side exposing its raw file. In practice, that means tokenised HEMs compared in a controlled environment, such as your own cloud or a data clean room. Only the matches leave it.

How is the output delivered? The resulting IDs (cookies, MAIDs, CTV IDs) need to travel with their consent signals attached, so that every downstream platform can check them.

Consent has to trace back to the source

This is where many onboarding partners fall short. It's not enough to say "our data is consented". You need to know how, where and with what wording each user gave consent, and which purposes it covers.

The IAB Europe Transparency & Consent Framework (TCF) is the shared language for this. One limitation is often missed, though. TCF covers matching an email to an online ID, but not the original collection of the email address, which national laws often regulate more strictly. A compliant onboarding partner checks both.

What a privacy-safe match test looks like

With ROQAD LINK, a typical EU match test runs like this:

1. 1ROQAD uploads tokenised HEMs and their consent records.
2. 2You retrieve them and upload your own HEMs to your cloud.
3. 3You compare the two sets and return only the tokens that match your customers.
4. 4ROQAD translates the tokens, checks the link to online IDs and reports match rates by ID type.
5. 5ROQAD delivers the matched IDs, with their TCF consent strings, to your environment.

Your raw customer list never leaves your control. Ongoing delivery uses the same matching process, plus a regular delivery path.

The rules are still moving

The EU's Digital Omnibus, proposed in November 2025, could change how cookie consent and browser-level privacy signals work. In October 2026, EU member states agreed the Council's negotiating position. It would widen the cookie uses that don't need consent, such as audience measurement and device security, but keeps the existing definition of personal data. Talks with the European Parliament can only start once it agrees its own position, so the final rules are still some way off. Whatever the final text says, advertising use cases are expected to keep requiring consent. That makes a consent trail you can audit the safest foundation for any onboarding programme.

A short checklist for choosing a partner

• Can they show the consent source and wording for every HEM?
• Do they support matching without you sharing your raw file?
• Do they pass TCF consent strings with every delivered ID?
• Can they report match rates by country and ID type before you commit?
• Can they deliver quickly? ROQAD delivers onboarding results in 1–3 weeks.