Transmissions of Hashed Personally Identifiable Information to Third Parties Across Websites

Many websites share users’ personal information with third-party trackers in hashed form, often claiming that hash functions provide privacy protection. Previous literature has shown this to be false by successfully re-identifying hashes of common personally identifiable information (PII). Despite this, websites continue to share hashed PII while making claims that understate the privacy risks for users. To investigate the prevalence of this practice, we present Hem and Haw, a browser extension that detects and logs transmissions of hashed PII. Employing this tool, we conduct a field study with over 100 participants and observe widespread sharing of hashed PII—including email addresses, phone numbers, and demographic information—from hundreds of websites to third-party domains. Our results show that hashed PII is frequently shared with trackers across the Internet. We present case studies where email hashes are exposed publicly in profile pictures and where PII is associated with sensitive browsing history. Moreover, we find previously undocumented evidence that Meta collects PII encoding formats alongside hashes, facilitating re-identification of users’ PII. We further analyze privacy policies of websites found in our results and develop a taxonomy to classify claims about hashing. Our analysis reveals that many policies mentioning hash functions contain misleading statements, including claims of anonymization or de-identification. Even though hashing PII does not offer any security or privacy, websites and companies continue to reinforce a “noble lie” by presenting it as a safeguard for user data.

Name thesis:degree_name

Master of Science (MSc)

Discipline thesis:degree_discipline

Computer Science

Grantor

Science

Year dc:date.issued

2026

Author dc:creator

• Le, Nguyen Huu Tin

Advisor dc:contributor.advisor

• Reardon, Joel

Committee members dc:contributor.committeemember

• Reardon, Joel
• Mazmudar, Miti
• Hagen, Gregory

• Privacy
• Hash Functions
• Personally Identifiable Information
• Web Tracking

Statement dc:rights

• Unless otherwise indicated, this material is protected by copyright and has been made available with authorization from the copyright owner. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission.

Language dc:language.iso

en

DOI

https://dx.doi.org/10.11575/PRISM/51400

OAI identifier oai:identifier

oai:ucalgary.scholaris.ca:1880/124826