use cases

A Newsletter Form Sent the Hash of an Email Nobody Submitted, Through the Meta Pixel's Automatic Matching

Some pixels don’t wait for a site to hand them an email address. They read it off the page. Meta’s automatic advanced matching watches form fields, and when a visitor types into one that looks like an email field, the pixel hashes what it finds and sends it with its next event. The visitor hasn’t pressed “Sign up”. They might never press it.

This is hard to see from the site’s side. Nothing in the site’s own code mentions the email field. The behaviour comes with the pixel, switched on with a checkbox in an ads dashboard.

A PXTA finding on the newsletter page: the Meta Pixel sent a SHA-256 hash of the email address pxta-probe@example.com before the consent banner was answered, with the hashed email field highlighted in the evidence.

How PXTA Catches It

On every page, PXTA types a marker address, pxta-probe@example.com, into each email field it finds, fires the events a real keyboard would, and moves on without submitting anything. It also knows that address’s SHA-256 and MD5 hashes. If a tag reads the field and sends the hash, PXTA finds the hash in the request and reports the address it came from.

In the Harbor & Pine sample report the newsletter page has a plain signup form and no banner logic tying the pixel to consent. The finding reads:

On /newsletter, the Meta Pixel sent a SHA-256 hash of the email address pxta-probe@example.com before the consent banner was answered.

The evidence shows the request to facebook.com/tr with the hashed email field highlighted.

Why a Hash Still Counts

A SHA-256 hash can’t be reversed, but it doesn’t need to be. The company receiving it hashes the email addresses of its own users the same way and looks for a match. That’s the purpose of the feature. A hash of a real visitor’s address identifies them to the ad network as well as the address would.

The Tidewater Bakery report has a gentler version of the same thing. Its tags wait for consent, as they should, but after the visitor accepts, the Meta Pixel still reads the cake-order form’s email field. PXTA lists that as a low-severity finding: allowed by the consent the visitor gave, but worth knowing, because “accept cookies” isn’t how most people expect to share an address they haven’t submitted.

To switch the marker off, for a site where typing into forms isn’t wanted, run with --no-fill.