Customer match after consent mode: how to keep uploading audiences lawfully

A list of people who have actually bought from you outperforms any interest-based targeting a platform can build. That has not changed. What changed is that uploading it now requires you to be able to say, per person, why you were allowed to.

Consent mode, the ePrivacy rules and the platforms' own terms have converged on the same demand: a lawful basis for each record, and the ability to show it.

What actually changed

Two separate things get conflated. Consent mode is about tags on your site and whether they may write cookies and send measurement data. Customer match is about uploading a list you already hold. They are different processing, with different legal bases, and consent mode does not authorise the upload.

The platforms now require you to confirm you have the rights to share the data and that you have given notice and obtained consent where required. That statement is yours to stand behind, not theirs.

Hashing is not anonymisation

Every platform asks you to normalise and hash before upload, and that is good practice — it limits what is transmitted. It does not take the data out of scope. If hashing removed the GDPR, matching would be impossible, because matching is identification.

Treat a customer match upload as a disclosure of personal data to a third party, because it is one. That means a legal basis, a record, and a line in your privacy notice that actually mentions it.

Getting the basis right

1. Consent is the safest and the most common answer. It must be specific — "we may share your details with advertising platforms to show you ads" — not buried in a general marketing tick.
2. Legitimate interest is argued by some advertisers for existing customers. It requires a balancing test you have written down, and several supervisory authorities are sceptical of it for ad targeting. If you rely on it, document it properly.
3. Either way, honour the objection. Somebody who opts out of marketing must come out of the uploads, and that has to happen on the next sync, not the next quarter.

Making it work without shrinking to nothing

• Ask once, clearly, at the right moment. A separate consent line at checkout or in the preference centre, worded in plain language, converts better than a wall of legal text.
• Upload your best segments, not everything. Past buyers and high-value customers match at far higher rates and cost less to reach than a bulk list. A smaller, cleaner audience usually performs better anyway.
• Refresh, do not accumulate. Re-upload the current state of the segment on a schedule so removals actually take effect. An audience uploaded once and never refreshed contains people who left you two years ago.
• Use suppression as well as targeting. Uploading recent buyers to exclude them is usually the highest-return thing on this list, and nobody does it.

When the audience is too small

Below a platform's minimum match threshold an audience simply will not run, and consented subsets often fall under it for smaller shops. Two honest options: build lookalikes from the consented seed rather than the whole list, or accept that this channel is not available to you at your current list size and spend the budget where it can be measured.

What is not an option is uploading the unconsented remainder and hoping. The platforms have shifted that liability to advertisers deliberately.