Is a hashed email address anonymous? Regulators say no, and that single answer undermines a lot of identity resolution data sharing built around creator audiences. When a brand matches a creator’s followers to its own CRM, it takes on consent obligations it may not know exist. Here is where those obligations sit under CCPA and GDPR, and how to close the gaps before an audit does it for you.
Why creator audiences are a different consent problem
Your CRM holds people who dealt with your brand. A creator’s audience holds people who chose to follow a person. Those are different relationships, and consent given in one does not travel to the other.
Identity resolution tools join the two. A creator shares a list of giveaway entrants, a link-in-bio signup file, or pixel data from a landing page. A vendor hashes the emails, matches them to a graph, and returns a segment you can target or measure. Each step is a disclosure of personal information, and each one needs a legal basis.
The usual defense is “we only touched hashed data.” That defense is weak. The core logic is simple: pseudonymisation is a safeguard, not an exit from GDPR. If anyone can re-link the data to a person, using additional information, the data is still personal data. A hash that can be matched against another party’s email list is exactly that kind of link. We covered the commercial side of this in our piece on hashed consent gaps.
Hashing is a security measure, not a consent mechanism. If the match works, the data is still personal data, and someone had to have the right to share it.
CCPA: the “sharing” trap
California’s framework is built around two terms that marketers often blur: “sale” and “sharing.” Sharing means disclosing personal information for cross-context behavioral advertising, whether or not money changes hands. Identity resolution for retargeting or lookalike building usually fits that definition.
That triggers several duties. The California Privacy Protection Agency’s CCPA regulations include sections on opt-out preference signals and on requests to opt out of sale and sharing. In practice:
- You need a clear notice of the right to opt out where data is collected.
- You must honor browser-level opt-out preference signals, such as Global Privacy Control, as valid opt-out requests.
- Opt-outs must reach downstream recipients. If a user opts out on the creator’s landing page, your vendor cannot keep matching them.
The regulations also use the term “frictionless manner” for processing an opt-out signal. The point is that consumers should not have to click through extra steps once their browser has spoken.
Who is the “business” when a creator collects the data?
This is the follow-up question every legal team asks. If a creator runs a signup form on their own domain, the creator is typically the party collecting. When that creator passes the file to you, you are receiving personal information, and the notice the consumer saw has to cover that disclosure. If it did not mention brand partners, you have a gap. Fix it in the contract, and verify it by reviewing the actual form.
GDPR: consent has to be specific, and provable
GDPR is stricter on the front end. You need a lawful basis for each purpose, and for cross-party audience matching, regulators and courts have been skeptical of “legitimate interests.” That pushes most brand programs toward consent. Valid consent must be freely given, specific, informed, and unambiguous, and the controller must be able to demonstrate it.
Consider a creator who collects emails for a newsletter. The consent covers a newsletter. It does not cover uploading those emails to an identity graph so a sportswear brand can target the same people. The purpose changed, and so must the permission.
Penalties are why this lands on the CFO’s desk. Article 83 explainers note the upper tier reaches 20 million euros or 4% of worldwide annual turnover, and that tier covers the core rules on lawful basis and consent. The same explainer puts the lower tier at 10 million euros or 2% of worldwide turnover. For a global brand, a percentage-of-turnover fine can dwarf any influencer budget.
Joint controllers and the contract you probably lack
When a brand and a creator jointly decide why and how audience data is used, GDPR can treat them as joint controllers. That requires a transparent arrangement allocating responsibilities. Most creator agreements say nothing on the subject. They cover deliverables, usage rights, and payment, then stop.
Add a data schedule. It should answer five questions:
- What audience data will the creator share, and in what form?
- What notice and consent language did the creator use at collection?
- Who holds the consent records, and how fast can they be produced?
- How are opt-outs and deletion requests passed between parties?
- What happens to the data when the contract ends?
Creators are rarely privacy professionals. Give them template language instead of expecting them to draft it. The same logic applies to talent licensing, which we examined in creator platform vendor terms.
Vetting the identity vendor
Your vendor is a processor, a service provider, or, if it uses data for its own purposes, something closer to a third party. The label drives your liability. Ask hard questions before signing.
- Source of the graph: Can the vendor show how its identifiers were collected and under what consent?
- Match method: Deterministic matches (a shared email) carry a different risk profile than probabilistic inference. Our analysis of probabilistic matching goes deeper on this.
- Retention and reuse: Does the vendor keep your uploaded hashes to enrich its own graph? If yes, you may be “selling” or “sharing” without meaning to.
- Opt-out propagation: How quickly do suppression requests flow through the system?
A related checklist for discovery tools sits in our guide to AI vendor privacy vetting. Most of it applies here.
A practical workflow that holds up
Start at collection. Put brand-partner disclosure and a separate, unticked consent box on any creator-run form that feeds a brand campaign. Store the timestamp, the exact wording, and the form version.
Next, gate the transfer. Before a list moves, filter out anyone who opted out and anyone from the EU or UK without recorded consent. Apply the same suppression to the vendor’s matched output.
Then keep it narrow. Use the matched data for the purpose stated. If a campaign ends, delete or re-permission. And log everything, because a regulator’s first request is almost always for records.
Does this slow campaigns? A little, at launch. After that, it is a template. The cost of a clean setup is small next to a forced shutdown of a segment mid-flight.
FAQs
Is hashed email data considered personal data under GDPR?
Generally yes. Pseudonymised data remains personal data if it can be attributed to a person using additional information. A hashed email that can be matched against another party’s email list meets that test, so you still need a lawful basis.
Does CCPA require opt-in consent for identity resolution?
Generally no, for adults. CCPA is mainly an opt-out regime, so you must give notice and honor opt-out requests and opt-out preference signals. Sensitive personal information and minors’ data carry stricter rules, so check your audience mix.
Who is responsible if a creator collected the data badly?
Both parties can be. If you receive and use data with no valid notice or consent behind it, regulators can look to you as well as the creator. Contractual warranties help you recover costs, but they do not remove your own exposure.
Can I rely on legitimate interests under GDPR for audience matching?
It is risky. Cross-party matching for advertising is intrusive and often unexpected by the individual, so most compliance teams default to consent. Take legal advice before relying on any other basis.
What should a creator contract say about audience data?
It should specify what data is shared, the notice and consent language used, who keeps the records, how opt-outs and deletions are passed along, and what happens to the data at termination.
What are the penalties for getting this wrong?
Under GDPR, the upper fine tier is the one that covers lawful basis and consent failures, and it is calculated against worldwide annual turnover as well as a fixed cap. CCPA enforcement comes through the California Privacy Protection Agency and the state Attorney General, with per-violation penalties.
This week, pull the last audience file a creator sent you and trace it. Find the original consent wording, confirm it names brand partners, and check your vendor’s opt-out sync. If any link is missing, pause matching until it is fixed.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →