Blog/Advertising
Advertising · 22 Jul 2026 · 7 min

Your customer list is still the best ad audience. It is just harder to upload now.

Consent Mode v2, hashed matching and server-side events, explained for people who have to run the campaign rather than argue about it.

The targeting moved server-side; the consent question moved to the front

Customer-list audiences — uploading hashed emails to build a lookalike or an exclusion — remain the highest-leverage advertising tool a shop has, because they are built on your own first-party data rather than on tracking strangers around the web. What changed is the paperwork and the plumbing around them.

Consent Mode v2, briefly

Since March 2024, advertisers using Google's audience and measurement features for users in the EEA and the UK must pass consent signals to Google. The mechanism is two additional parameters — one covering ad user data, one covering ad personalisation — sent alongside the existing analytics and advertising storage signals. Without them, remarketing and customer-match features are restricted for those users.

  • Basic implementation: tags only fire after consent. Simple, and you lose modelled conversions from non-consenting users.
  • Advanced implementation: tags load and send cookieless pings that carry the consent state. More data, more implementation work, and more to explain in your privacy notice.

Either way, the consent banner stopped being a legal checkbox and became part of the measurement stack. A banner that does not correctly block and unblock these signals produces campaigns that underperform for reasons nobody can see in the ads interface.

Hashing is not anonymisation

When you upload a customer list, the addresses are hashed with SHA-256 before they leave your systems. It is worth being precise about what that does and does not achieve: hashing protects the data in transit and at rest, but a hash of an email address is still personal data, because it identifies one specific person and can be matched back. The EDPB and national regulators have been consistent on this.

So the question you have to answer before uploading a list is not technical. It is: what is your lawful basis for sharing these customers with an advertising platform, and did you tell them? For most shops the honest answer is consent, collected in a way that mentions advertising — not a line buried in a privacy policy.

Hashing changes how the data travels. It does not change whether you were allowed to send it.
Every platform wants the same list. Each one needs its own answer about why it may have it
Every platform wants the same list. Each one needs its own answer about why it may have it · Photo by Adem AY on Unsplash

Server-side events, and why they exist

Browser-based pixels lose events to ad blockers, tracking prevention in Safari and Firefox, and consent rejections. Server-side conversion APIs — Meta's Conversions API, Google's equivalents — send the event from your server instead, usually deduplicated against the browser event by a shared event ID.

Two honest observations about this:

  1. It recovers real signal. Match rates and attributed conversions typically improve, sometimes substantially, because the events genuinely happened and were simply not being reported.
  2. It does not launder consent. Sending an event from a server rather than a browser changes the transport, not the legality. If the user refused advertising cookies, the server-side event for advertising purposes is subject to the same refusal.

Implementations that quietly ignore the second point are the ones that turn into a regulatory problem two years later.

What a small team should actually do

  1. Fix the banner first. Reject must genuinely block advertising signals, and the choice must be as easy to reverse as to give. Everything downstream depends on this being correct.
  2. Upload exclusions before lookalikes. Excluding existing customers from acquisition campaigns is the cheapest performance win available and is rarely done.
  3. Build lookalikes from your best customers, not all of them. Seed from repeat buyers or the top decile by revenue. A seed list of everyone teaches the platform to find people like your worst customers too.
  4. Refresh lists on a schedule. A customer list uploaded once decays; match rates fall as addresses change.
  5. Implement server-side events with deduplication, and verify in the platform's own diagnostics that you are not double-counting.
  6. Keep a record of which list went to which platform, when, and under what consent. This is the document you will be asked for.

What to expect

Reported conversions will not match your shop's order count, and chasing that match is a trap. Platform attribution is modelled, window-based and self-serving by design. Use it to compare campaigns against each other, and use your own order data to decide whether advertising as a whole is working.

Sources and further reading (6)
  1. Google Ads Help — About consent mode
  2. Google — EU user consent policy
  3. Google Ads Help — About Customer Match
  4. Meta for Developers — Conversions API
  5. EDPB — Guidelines 01/2025 on pseudonymisation
  6. Directive 2002/58/EC (ePrivacy), Article 5(3) — storage and access on terminal equipment

Checked on 21 September 2026. Provider prices, mailbox rules and legal guidance change — verify anything you plan to act on.

One audience, several destinations

Build the audience once, use it where it belongs

Auralata builds ad audiences from the same WooCommerce data as your campaigns — repeat buyers, lapsed customers, top decile by revenue — and keeps the consent state attached, so a contact who refused advertising never ends up in an upload.

Start now See how it works
Audience · repeat buyers1,827 profiles
Consented to advertising use1,284
Excluded — no consent543
Exported asSHA-256
Export log keeps the list, the destination and the date.
More from the blog

Everything else we have written down.

Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Migration · 11 min Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Profiles, consent, suppressions, lists, segments and events come across through the API. Flows do not, and neither does your sending reputation. The honest inventory, endpoint by endpoint. Ecommerce SEO: the four things that compound, and the rest that does not SEO · 8 min Ecommerce SEO: the four things that compound, and the rest that does not Product data, structured markup, one canonical page per product and copy a person would actually read. Everything else is a rounding error on a catalogue of a thousand items. Gmail clips your email at about 102 kB. Here is what it costs you. Deliverability · 7 min Gmail clips your email at about 102 kB. Here is what it costs you. The unsubscribe link, the tracking pixel and half your products end up behind a “View entire message” link. The fix is boring and takes ten minutes. An email opt-in is not an SMS opt-in, and it is definitely not a WhatsApp opt-in Compliance · 8 min An email opt-in is not an SMS opt-in, and it is definitely not a WhatsApp opt-in Four channels, four legal bases, one checkout form. What you can reuse, what you have to ask for again, and what auditors look at first. The bulk sender rules are not new any more. Most shops still fail one of them. Deliverability · 8 min The bulk sender rules are not new any more. Most shops still fail one of them. SPF, DKIM, DMARC, one-click unsubscribe and a complaint rate under 0.3 %. A checklist you can finish this afternoon, and the one item that quietly breaks later. The abandoned cart flow that does not sound desperate Flows · 7 min The abandoned cart flow that does not sound desperate Three messages, one discount at most, and a condition that checks whether they already bought. Plus the legal detail most shops get wrong about cart reminders. The open rate has been broken since 2021. Here is what to report instead. Measurement · 7 min The open rate has been broken since 2021. Here is what to report instead. Apple's Mail Privacy Protection pre-loads your tracking pixel whether or not anyone read the message. Four metrics that survived, and one that got more important. WhatsApp now charges per message, not per conversation. Budget accordingly. Channels · 7 min WhatsApp now charges per message, not per conversation. Budget accordingly. The 24-hour conversation window stopped being the billing unit in July 2025. What changed, what is still free, and when a WhatsApp campaign beats an email. AI product images: generate the scene, never the product Content · 8 min AI product images: generate the scene, never the product Generated backgrounds are fine and legal. Generated labels, generated fabric and generated features are a returns problem and, since August 2026, a disclosure problem. Segments that survive contact with a real catalogue Audiences · 7 min Segments that survive contact with a real catalogue Six definitions that still work when the shop has 1,200 products, half of them seasonal, and someone renames a category on a Tuesday. Never send marketing and receipts from the same subdomain Infrastructure · 6 min Never send marketing and receipts from the same subdomain One bad campaign should not stop order confirmations from arriving. Separating the two takes an afternoon and is the cheapest insurance in email. The welcome series is the only flow that pays for itself in week one Flows · 7 min The welcome series is the only flow that pays for itself in week one Three emails to people who have just decided they are interested in you. What goes in each, why the first one should not sell, and the two mistakes that waste the best audience you will ever have. Browse abandonment is not cart abandonment, and sending the same email costs you both Flows · 7 min Browse abandonment is not cart abandonment, and sending the same email costs you both A cart is an interrupted decision; a browse is an open question. The email that recovers one reads as surveillance when you send it for the other. Timing, wording and the threshold worth having. The second order is the one that matters. A post-purchase flow that earns it. Flows · 8 min The second order is the one that matters. A post-purchase flow that earns it. Most shops say nothing for a fortnight after an order, then ask for a review on day two. What to send between delivery and the second purchase, and why the timing comes from your own data. Win-back flows: what to send at 90 days, 180 days and never Flows · 7 min Win-back flows: what to send at 90 days, 180 days and never A lapsed customer is not a prospect. Three tiers by how long they have been gone, why the discount belongs last rather than first, and the point at which stopping beats escalating. Replenishment reminders: the right day is already in your order table Flows · 7 min Replenishment reminders: the right day is already in your order table If you sell anything that runs out, the best automation you own is a reminder timed to when it runs out. How to compute the interval per product from real repeat orders, and what to do when it is bimodal. RFM segmentation for ecommerce: how to build it without a spreadsheet Audiences · 7 min RFM segmentation for ecommerce: how to build it without a spreadsheet RFM needs three fields you already have. How to score customers, why four groups beat 125 cells, and the message each group should get — without exporting anything to a spreadsheet. Sending from a new domain: how to get the first thousand emails delivered Deliverability · 7 min Sending from a new domain: how to get the first thousand emails delivered A new sending domain has no reputation, and mailbox providers treat that closer to bad than good. Authentication, the first audience, volume ramp, and the three signals that decide the next hundred thousand. Double opt-in in the EU: when it is required and how to implement it Compliance · 8 min Double opt-in in the EU: when it is required and how to implement it The GDPR never says "double opt-in", but several national regulators effectively require it. Where it is expected, where single opt-in holds up, and how to build a record that survives a complaint. SMS marketing in Europe: what it costs and how to launch it properly Channels · 7 min SMS marketing in Europe: what it costs and how to launch it properly Sender IDs are registered per country, opt-out handling is mandatory, and the price per message varies more than tenfold across the EU. The practical checklist before your first campaign. Product photography for AI: how to shoot images a model can work from Content · 7 min Product photography for AI: how to shoot images a model can work from The source photo decides almost everything about a generated lifestyle image. What to shoot, how to light it, and the four mistakes that make a product impossible to place convincingly. Revenue per recipient: how to calculate it and why it beats open rate Measurement · 7 min Revenue per recipient: how to calculate it and why it beats open rate One number that compares a campaign to a flow to a channel. What to include, what to exclude, the attribution window it depends on, and the two variants worth reporting beside it. Customer match after consent mode: how to keep uploading audiences lawfully Advertising · 7 min Customer match after consent mode: how to keep uploading audiences lawfully Your customer list is still the strongest ad audience you own. What consent mode changed, why hashing is not anonymisation, and how to keep uploads lawful without shrinking the audience to nothing. Lost webhooks: how to catch the drift with a nightly reconcile Infrastructure · 7 min Lost webhooks: how to catch the drift with a nightly reconcile WordPress will drop a hook eventually, and nothing errors when it does. Why webhooks alone are never enough, how to build a nightly checksum reconcile, and the three bugs that make it lie to you. Migrate from Mailchimp: what it takes and how to do it Migration · 8 min Migrate from Mailchimp: what it takes and how to do it Contacts and tags export cleanly; consent history, automations and sending reputation do not. What actually moves, what has to be rebuilt, the order to do it in, and how to avoid a deliverability cliff. Product page SEO: how to earn a second visit from search SEO · 7 min Product page SEO: how to earn a second visit from search Most product pages are a photo, a price and the manufacturer's paragraph — the same page a hundred other shops have. What to add so it is worth ranking, in the order that pays back. Engagement gating: how to set it up and why it belongs at send time Audiences · 7 min Engagement gating: how to set it up and why it belongs at send time Filtering dormant addresses is the cheapest deliverability work available. Why the gate has to run at send time rather than at list build, what window to use, and how to exempt transactional mail correctly. SPF, DKIM and DMARC: how to set all three up and what each one stops Deliverability · 8 min SPF, DKIM and DMARC: how to set all three up and what each one stops Three DNS records explained by what breaks without each one. The ten-lookup limit that silently kills SPF, why DKIM needs a selector per service, and how to move DMARC to reject without losing mail. Data processing agreements: what has to be in one and how to get it signed Compliance · 7 min Data processing agreements: what has to be in one and how to get it signed Article 28 requires a contract with specific contents before a supplier touches customer data. What must be in it, which of your tools need one, and the three clauses worth actually reading. The WhatsApp 24-hour window: how it works and how to plan around it Channels · 7 min The WhatsApp 24-hour window: how it works and how to plan around it One clock, started by the customer, decides whether you may write freely or must use a pre-approved template. How the window works, what template approval involves, and how pricing follows from both. One photo into six formats: how to write a brief that holds Content · 7 min One photo into six formats: how to write a brief that holds Six surfaces, six framing problems, one source photo. How to write a format brief that produces all of them consistently — and the safe areas that decide whether the crop survives. Attribution windows: how to choose one and stick to it Measurement · 7 min Attribution windows: how to choose one and stick to it Seven days or thirty, click or view, last touch or first. Every answer is defensible; changing answers mid-year is not. How to pick a window, write it down, and read platform numbers against it. Product feeds for Google and Meta: how to keep price and stock honest Advertising · 7 min Product feeds for Google and Meta: how to keep price and stock honest A feed is a continuous promise that a product exists at that price and can be bought today. How often to refresh, which fields decide whether you rank, and the mismatches that get an account suspended. Idempotency for shop integrations: how to build it and why it is the whole contract Infrastructure · 7 min Idempotency for shop integrations: how to build it and why it is the whole contract Any system that retries will deliver the same event twice. How to choose an idempotency key, why a duplicate must answer success rather than 500, and the three places double-counting actually shows up. Move your sending domain: how to migrate without losing reputation Migration · 7 min Move your sending domain: how to migrate without losing reputation Reputation attaches to the domain and the IP, and neither transfers. Why to change one thing at a time, how to split traffic during the move, and the DNS record that must be removed afterwards. Product structured data: how to implement it so it matches the page SEO · 7 min Product structured data: how to implement it so it matches the page Markup tells search engines what a page means. Which properties matter, why price and availability must match the visible page, and the review markup that earns a manual action. Segment size and revenue: how to find the smaller list that earns more Audiences · 7 min Segment size and revenue: how to find the smaller list that earns more The instinct before a big campaign is to widen the audience. How to test the opposite on your own data, why revenue per recipient falls as the list grows, and where the real ceiling sits. Spam traps: how they get onto a clean list and how to get them off Deliverability · 7 min Spam traps: how they get onto a clean list and how to get them off A spam trap is an address that could not possibly have consented. The three kinds, how each arrives on an otherwise clean list, and why deleting them is not how you fix the problem. One-click unsubscribe: how to implement RFC 8058 and stay compliant Compliance · 7 min One-click unsubscribe: how to implement RFC 8058 and stay compliant Two headers and an endpoint, required by Google and Yahoo for bulk senders. What to send, what the endpoint must do, the two-day rule, and why the footer link still has to exist. Viber or WhatsApp: how to choose for a European shop Channels · 7 min Viber or WhatsApp: how to choose for a European shop The answer is mostly geography and partly pricing. How to find out which app your customers actually use, what each costs, and why running both is usually worse than running one well. Email subject lines: how to write ones that survive the preview pane Content · 7 min Email subject lines: how to write ones that survive the preview pane A subject is read in about forty characters beside a preheader you probably did not write. What survives the preview pane, how to use the preheader properly, and why most A/B tests prove nothing. Holdout groups: how to run one and what it will tell you Measurement · 7 min Holdout groups: how to run one and what it will tell you Attribution tells you which message a buyer saw last; a holdout tells you whether it changed anything. How to size one, where to run it permanently, and how to read a result that comes back at zero. Retargeting with a shrinking pool: how to keep it working Advertising · 7 min Retargeting with a shrinking pool: how to keep it working Consent banners and browser restrictions have cut retargetable audiences to a fraction of site traffic. What still works, why first-party segments outperform pixel pools, and when to stop spending on it. Storing prices with tax and currency: how to get totals right for every shop Infrastructure · 8 min Storing prices with tax and currency: how to get totals right for every shop A number in a price column means nothing alone. Why currency, tax inclusion, rate and shipping must each be stored, and the four calculations that go wrong when any of them is assumed. Rebuilding flows after a migration: how to recreate what will not export Migration · 7 min Rebuilding flows after a migration: how to recreate what will not export Automations have no useful export format. What to document before you lose access, the order to rebuild in, and why exit conditions matter more than the copy you are worried about. Faceted navigation and crawl budget: how to stop wasting it SEO · 7 min Faceted navigation and crawl budget: how to stop wasting it Three filters with four values each produce more URLs than most shops have products. How to decide which facets deserve indexing, and the four controls that stop the rest eating your crawl budget. Lookalike audiences: how to pick a seed that actually works Audiences · 7 min Lookalike audiences: how to pick a seed that actually works The platform's model is rarely the problem; the seed is. How to choose one, why a smaller high-value seed beats your whole customer list, and how often to refresh it. Domain warm-up: how to ramp sending volume week by week Deliverability · 7 min Domain warm-up: how to ramp sending volume week by week A concrete four-week ramp, what to check before each increase, and the hold rule that matters more than the schedule itself. Plus why consistency beats volume for a new sender. Proof of consent: how to record it so it holds up with a regulator Compliance · 7 min Proof of consent: how to record it so it holds up with a regulator Article 7 puts the burden on you to demonstrate consent was given. What a defensible record contains, how to version the wording, how long to keep it, and what to do about consents you inherited. Push notifications for ecommerce: when to use them and how to write them Channels · 7 min Push notifications for ecommerce: when to use them and how to write them Web push is cheap, instant, and the fastest permission to lose for ever. What it is actually good for, how to ask for the permission, and the frequency that quietly destroys the channel. Alt text for email and ecommerce: how to write it and why it is read first Content · 7 min Alt text for email and ecommerce: how to write it and why it is read first Many inboxes block images by default, making alt text the first thing read. How to write it for products, decorative images and image-only emails, and the mistakes that make it useless. Ecommerce analytics: how to count people instead of clicks Measurement · 7 min Ecommerce analytics: how to count people instead of clicks A visitor who refreshes ten times is one visitor. Why session-based metrics mislead, the four numbers worth reporting, and how to handle the traffic that consent rules make invisible. Conversions API: what it fixes, what it does not, and how to set it up Advertising · 7 min Conversions API: what it fixes, what it does not, and how to set it up Server-side events recover measurement that ad blockers and browser limits removed. What they genuinely fix, why deduplication matters, and why this is not a route around a visitor's refusal. Sync lag: how to find out your data is an hour behind, and fix it Infrastructure · 7 min Sync lag: how to find out your data is an hour behind, and fix it Stale data does not announce itself — everything renders and every number looks plausible. How to measure real end-to-end lag, the three causes worth checking first, and what to put on screen. Running two marketing tools at once: how to plan the overlap Migration · 7 min Running two marketing tools at once: how to plan the overlap The fortnight where both platforms are live is cheap insurance and an easy way to send everything twice. What to switch when, the three rules that prevent duplicates, and how to compare fairly. Category page SEO: how to make them the pages that rank SEO · 7 min Category page SEO: how to make them the pages that rank People search for the category and buy from the product. Why category pages carry the ranking, what copy belongs on them, and how to handle pagination, sorting and thin categories. Profile merging across devices: how identity resolution actually works Audiences · 7 min Profile merging across devices: how identity resolution actually works A phone and a laptop are two records until something connects them. What the identifiers are, what should happen at the moment of a merge, and why creating the profile early is the whole point. Bounce handling: how to tell a soft bounce that should be treated as hard Deliverability · 7 min Bounce handling: how to tell a soft bounce that should be treated as hard A hard bounce is permanent and a soft bounce is temporary — until you meet the ones that repeat for ever. How to classify by code and by repetition, and the retry schedule that stops the damage. Data retention for ecommerce: how long to keep customer data and how to delete it Compliance · 7 min Data retention for ecommerce: how long to keep customer data and how to delete it There is no single retention period, because different data has different clocks. How to set one per category, why deletion means anonymisation for orders, and what a deletion request actually requires. Choosing a channel per message: a framework that holds up Channels · 7 min Choosing a channel per message: a framework that holds up Email, SMS, WhatsApp and push have different costs, permissions and tolerances for interruption. Three questions that decide where a message belongs, and a table of the common cases. AI product images: when to use them and when not to Content · 7 min AI product images: when to use them and when not to Generating a background is ordinary image editing at scale. Generating the product, or a claim about it, is not. Where the line sits, what EU rules require, and the four checks before publishing. Reconciling ad platform numbers: why they never match and what to trust Measurement · 7 min Reconciling ad platform numbers: why they never match and what to trust Meta says 340, Google says 210, your shop recorded 402 orders total. Five structural reasons they disagree, which number to plan with, and the ratio worth tracking instead. Splitting ad budget without reliable attribution: how to decide Advertising · 7 min Splitting ad budget without reliable attribution: how to decide Attribution got worse and is not coming back. How to allocate budget using holdouts, marginal tests and a stable baseline rather than waiting for a number you will never have. Time zones in reporting: how to stop them breaking one report a quarter Infrastructure · 7 min Time zones in reporting: how to stop them breaking one report a quarter A day is not a fixed thing. Where to store times, where to convert them, why scheduled sends need the shop's clock, and the daylight-saving cases that break a report twice a year. After a migration: what to check on day one Migration · 7 min After a migration: what to check on day one Most migration problems that become expensive were visible on day one. A checklist in priority order, the two numbers to watch for a fortnight, and what to keep before cancelling anything. Ecommerce blog strategy: which posts to write and which to skip SEO · 7 min Ecommerce blog strategy: which posts to write and which to skip Most shop blogs are company news and seasonal filler. The four kinds of post that earn traffic which converts, the three that never do, and how to link them to the products. Back-in-stock alerts: how to build the flow and what it is worth Flows · 12 min Back-in-stock alerts: how to build the flow and what it is worth A back-in-stock request is the clearest purchase intent a shop ever receives. How to capture it, how fast the alert has to be, how to handle variants and thin restocks, how to write it, and the demand signal it hands your buyer. Review requests: how to ask so people actually answer Flows · 12 min Review requests: how to ask so people actually answer Reviews are the cheapest high-converting content a shop can produce. When to ask, why one specific question beats a star widget, what to do with bad reviews, what EU law now requires, and how to get the value back out. VIP customers: how to identify them and what to actually do for them Flows · 12 min VIP customers: how to identify them and what to actually do for them Most shops define VIPs by lifetime spend and reward them with the discount everyone gets. How to define the group so it stays current, why recognition outperforms discounting, the entry message, and how to handle people falling out.