One hashed email can unlock a household’s income, devices, and buying behavior. That is the pitch behind email identity graphs, and it is also why regulators are watching. Hashing does not remove a person from the record. For brands that buy audiences or run creator campaigns on graph-based targeting, the consent gaps under CCPA and GDPR are now a vendor-selection problem, a contract problem, and a budget problem.
What an email identity graph actually does
An identity graph stitches scattered signals into one profile. Vendors in this category pitch near-total household coverage. The same page says it covers 1.2+ billion devices. It links IP addresses, hashed emails, UID2.0, physical addresses, and mobile IDs to demographic, financial, media, and buying data.
Look at that mix. Deterministic identifiers (an email) sit next to probabilistic ones (a device guess). Offline data sits next to online data. The person in the middle never typed a word into the vendor’s form.
For marketers the value is real: audience building, cross-channel delivery, and attribution from exposure to conversion. Influencer teams use the same logic to prove that a creator post drove a store purchase. The risk sits in how the profile was assembled, and who agreed to it.
The hashing myth
Many teams assume a hashed email is anonymous. It is not. A hash is a consistent code, so the same email always produces the same string, and that is exactly what makes it useful for matching. It is also what makes it identifying.
Under GDPR this is pseudonymization, not anonymization. Under GDPR, pseudonymized data is still personal data, because the pseudonym can be tied back to a person with additional information. Read that again. Your “privacy-safe” match key still needs a lawful basis, a purpose, and security measures.
A hashed email is a pseudonym, not a disguise. If your vendor can match it, regulators will treat it as personal data.
The same analysis flags a second shift. The draft guidelines could push toward a stricter view of when data counts as anonymous at all. If your legal case rests on “the data is anonymous in the partner’s hands,” that argument is getting weaker.
Where the consent gaps open up
Gaps rarely appear inside one company. They appear in the handoffs. Here are the four I see most often in brand and agency programs.
- Collection without a relationship. Graph vendors compile data about people who never dealt with them. Under GDPR, someone still has to own transparency and the legal basis. Under California law, this is the data broker model.
- Consent that does not travel. A user opts in on your site. Your email list is hashed and uploaded to a graph for matching. Does the original consent cover onward matching, enrichment, and use by third parties? Usually the notice never said so.
- Enrichment you cannot see. You send an email and get back income bands and purchase propensity. You now hold inferred data you never collected and cannot easily explain to the person it describes.
- Deletion that stops at your door. A customer asks you to delete. Your CRM complies. The hashed copy sitting in a partner’s graph, and in every audience built from it, does not.
California is tightening the screws on brokers
CCPA gives consumers rights to know, delete, and opt out of sale or sharing. The Delete Act adds a heavier lever for graph vendors. Under the CPPA’s guidance, beginning August 1, 2026, data brokers must access the accessible deletion mechanism at least once every 45 days and process deletion requests. One consumer request through the Delete Request and Opt-Out Platform (DROP) reaches every registered broker.
Enforcement is not theoretical. The CPPA’s own guidance says a data broker that fails to register by January 31 may be liable for administrative fines and costs.
Why should a brand care if the broker is the one on the hook? Three reasons.
- Deletion cycles will change the audience you paid for. Lookalike pools and suppression lists shrink as records disappear.
- Your own status can be murky. If you resell or share enriched data, you may be closer to the broker definition than you think.
- Regulators follow the data. A strike force that audits brokers will also read broker customer lists.
GDPR asks a different question
California is largely opt-out. GDPR is permission-first. You need a lawful basis for each purpose, and for cross-site profiling and ad targeting that usually means consent or a defensible legitimate interest assessment. Hashing helps with security and risk reduction, but it does not replace the basis.
If you target EU audiences, ask the vendor for a plain answer: what is the legal basis for each data source in the graph, and who handles access and erasure requests? A reply that leans on “privacy-compliant methods” with no documentation is a red flag. Vendors typically describe their approach as meeting industry privacy requirements, which is a claim, not an audit report. Its graph page is also framed around US households, so confirm in writing whether any EU data subjects are in scope.
A vendor vetting checklist you can use this quarter
Procurement language is where you close these gaps. A few clauses do most of the work.
- Source disclosure. Require a list of data source categories and the consent or notice mechanism behind each.
- Deletion flow-down. Contractually require propagation of your deletion and opt-out signals to derived audiences within a set number of days.
- Audit rights. Reserve the right to review processing records. Our piece on measurement vendor audit rights covers the clause language.
- Purpose limits. Prohibit the vendor from using your hashed lists to enrich its own graph unless you agree in writing.
- Broker status. Ask whether the vendor is registered as a California data broker and whether it is connected to DROP.
The same discipline applies to newer tools. Our guide to AI discovery vendor vetting shows how to question creator-data suppliers, and the TikTok data risk analysis is a useful model for tracing where platform data really lives.
What this means for influencer programs
Creator campaigns feed graphs in two ways. Brands upload customer emails to build exclusion and lookalike audiences around whitelisted creator ads. And attribution vendors match click and purchase events back to people. Both flows touch personal data, and neither is covered by the creator’s disclosure of the partnership.
Keep the ROI story honest too. A graph that reports a lift from creator content is only as defensible as the data underneath. If deletion requests quietly erode the match rate, your reporting shifts. The reasoning in dashboard claims audits applies directly: document the inputs before you quote the output.
Does this mean abandoning identity graphs? No. It means treating them as regulated data supply chains, not magic match keys. Brands that can show consent lineage will keep their targeting. Those that cannot will lose audiences one deletion batch at a time.
FAQs
Is a hashed email personal data under GDPR?
Yes, in most marketing uses. A hashed email is pseudonymized, and pseudonymized data remains personal data because it can be matched back to an individual. European data protection guidance treats pseudonymization itself as processing of personal data that falls under the GDPR.
Is a major identity graph vendor a data broker under California law?
That depends on its registration and business model, so check the California data broker registry and ask the vendor directly. The legal test is whether a business knowingly collects and sells personal information about consumers with whom it has no direct relationship, as the CPPA explains.
Does the Delete Act affect brands that only buy audiences?
Not directly if you are only a customer. Indirectly, yes. Brokers must process deletion requests on a recurring schedule starting August 1, 2026, so the records behind your purchased audiences will change. Brands that resell or share data may also fall under the broker definition themselves.
What should an identity graph contract include?
At minimum: source disclosure, deletion and opt-out flow-down, audit rights, purpose limits on your uploaded lists, and a warranty about the vendor’s broker registration and legal bases. Have counsel review these before renewal.
Can consent collected on my site cover graph matching?
Only if the notice clearly described onward sharing, matching, and enrichment for that purpose. Generic marketing consent usually falls short, particularly under GDPR. Review your notices and consent strings against how your vendors actually use the data.
Does this apply if my campaigns only run in the US?
CCPA and the Delete Act still apply to California residents wherever your company sits. GDPR matters if any EU or UK residents are in your lists, which is common in e-commerce and creator-driven traffic.
Before your next renewal, send every identity or measurement vendor the five-clause checklist above and compare the answers side by side. Drop any vendor that cannot document its sources and deletion flow-down.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →