TikTok Events API user parameters are one of the highest-leverage inputs to Event Match Quality (EMQ). When a browser event cannot be linked through cookies alone, correctly normalized and SHA-256 hashed email, phone_number, and external_id values give TikTok deterministic, privacy-safe signals for matching a conversion to an ad interaction (if you are troubleshooting your broader setup first, see our full guide on how to improve TikTok Event Match Quality).
The important distinction is that hashing is not data cleaning. SHA-256 produces a different value for every input variation. Hashing Jane@Example.com , jane@example.com, and jane@example.com creates three completely different digests—even though they represent the exact same customer. Normalize first, then hash exactly once.
What the TikTok Events API `user` Object Needs
Send user identifiers in the event’s user object, associated with the same event_id used for browser/server deduplication. A safe server-side payload pattern is:
```json
{
"event": "CompletePayment",
"event_id": "order_10482",
"user": {
"email": "8c87b489ce35cf2e5d712d073c56f4a74db97e5a2716c8e9c8c1c4f4e1b5fa2c",
"phone_number": "0d5f3f9ef2e6ec02b0c8243a06f664d0be6f8918792f3e6d8b4e66c5db248dc6",
"external_id": "<sha256-stable-customer-id>"
}
}
```
Each hashed value must be a 64-character lowercase hexadecimal SHA-256 digest. Do not Base64-encode the digest, add a sha256: prefix, or send a PHP binary hash result. In PHP, use hash(‘sha256’, $normalizedValue)—its default output is lowercase hexadecimal. Keep external_id stable across sessions and orders (such as a canonical PrestaShop customer ID or CRM ID) rather than substituting a changing order reference for a customer-level external ID.
Normalize Before You Hash
Apply these rules at collection time, before an API payload is built:
- Email: trim leading/trailing whitespace and lowercase the full RFC 5322 email address. Jane.Doe@Example.COM becomes jane.doe@example.com before hashing. Do not remove valid characters such as +, ., or @.
- Phone number: convert to E.164 international form (+15551234567). Remove spaces, parentheses, dashes, and local trunk prefixes only after resolving the customer’s country. A UK local value such as 020 7123 4567 cannot be safely hashed until it is resolved to +442071234567.
- External ID: use a non-empty, durable customer identifier with a consistent string representation. Avoid IDs that vary by shop, checkout, or integration unless that variation is intentional.
A practical normalization pipeline is: validate input, trim, lowercase emails, parse phones using billing-country context, serialize to canonical E.164, then SHA-256 hash. Do not hash missing values, placeholders (N/A), or malformed phone numbers; omit the field instead.
Four Errors That Quietly Reduce Match Rates
- Hashing raw casing or whitespace: CUSTOMER@DOMAIN.COM and customer@domain.com are different SHA-256 inputs.
- Sending plaintext: a visible email address or +15551234567 in an endpoint payload is not a valid hashed user parameter and creates a privacy/compliance problem.
- Using local phone formatting: 555-123-4567 lacks country context and will not match the canonical international number.
- Double hashing: never hash a digest already stored by another system. A valid digest is exactly 64 lowercase hex characters; preserve it or standardize ownership of the hashing step.
Reliable PrestaShop Collection Points
On PrestaShop 1.7 through 8.2, customer data should be captured where it is authoritative rather than reconstructed from JavaScript. Use actionCustomerAccountAdd to establish a stable customer profile, login-related hooks to refresh known identity, and actionValidateOrder to assemble the final order, customer, and billing-address context for CompletePayment. Validate the active Customer and Address records, resolve the billing country for phone parsing, and queue the server event only after the order is confirmed.
Pixel Track TikTok automates this pipeline natively for PrestaShop: it reads eligible customer attributes on checkout and login flows, trims and lowercases emails, converts phones to E.164 with country-code context, SHA-256 hashes eligible values, and sends them with external_id and event_id. This reduces custom-hook drift while keeping browser and Events API events aligned. Hash quality still cannot compensate for lost click context, so audit TikTok click ID (ttclid) tracking alongside user matching.
Verification Checklist
Inspect a non-production payload before release. Confirm every populated identifier is 64 lowercase hex characters, the phone source was internationalized to E.164 before hashing, event_id is identical between pixel and server events, and no plaintext identifier reaches logs, browser tools, or TikTok payloads. Apply consent rules before collecting or transmitting identifiers; hashing is pseudonymization, not a substitute for lawful consent.
