The Customer Information Parameters That Matter Most for CAPI

Why Customer Information Parameters Matter

The Facebook Conversions API relies on customer information parameters to match server-side events to Meta user accounts. Without them, Meta cannot attribute your CAPI events to specific users — the events exist in the system but they cannot be used for conversion attribution or ad optimisation. More customer information parameters → higher Event Match Quality → better ad performance.

Parameters That Must Be Hashed (SHA256)

Most customer information parameters must be SHA256-hashed before sending to Meta. Do not send plaintext PII.

Email (em) — Highest Priority

// Python
import hashlib
em = hashlib.sha256("user@example.com".lower().strip().encode()).hexdigest()

// PHP
$em = hash('sha256', strtolower(trim($email)));

// JavaScript (for client-side, though CAPI is server-side)
const em = CryptoJS.SHA256(email.toLowerCase().trim()).toString();

Normalisation before hashing: lowercase, strip whitespace. Do not hash the @-address with dots removed — send the actual email address, normalised and hashed.

Phone (ph)

// Normalise: remove all non-numeric characters, include country code
// +44 7911 123456 → 447911123456
$ph = hash('sha256', preg_replace('/[^0-9]/', '', $phone));

First Name (fn) and Last Name (ln)

// Lowercase, remove whitespace
$fn = hash('sha256', strtolower(trim($first_name)));
$ln = hash('sha256', strtolower(trim($last_name)));

Date of Birth (db)

// Format: YYYYMMDD, then hash
$db = hash('sha256', '19900315'); // March 15, 1990

City (ct), State (st), Postal Code (zp)

// Lowercase, remove whitespace
$ct = hash('sha256', strtolower(trim($city)));
$zp = hash('sha256', preg_replace('/\s/', '', $postcode)); // Remove spaces from postcode

Country (country)

// 2-letter ISO code, lowercase
$country = hash('sha256', 'gb'); // United Kingdom

Gender (ge)

// 'm' for male, 'f' for female
$ge = hash('sha256', 'm');

Parameters That Are NOT Hashed

FBP and FBC Cookies

// Read directly from browser cookies — do not hash
"fbp": "_fb_cookie_value",  // _fbp cookie value
"fbc": "_fb_click_id"       // _fbc cookie value (only set when user comes via Meta ad)

Client IP Address and User Agent

"client_ip_address": "203.0.113.45",  // User's IP from request headers
"client_user_agent": "Mozilla/5.0..."  // User-Agent header from browser request

External ID

// Your internal customer ID — hash recommended but not required
"external_id": hash('sha256', 'CUSTOMER-42')

Priority Order for Implementation

1. em (email) — implement first
2. ph (phone) — implement second
3. fbp and fbc cookies — capture in browser, pass to server
4. fn, ln (name) — from order/lead data
5. ct, zp, country (address) — from shipping address
6. client_ip, client_user_agent — always available from HTTP request
7. external_id — if authenticated users

Summary

Email and phone are the highest-impact customer information parameters for Facebook CAPI event matching. All PII must be SHA256-hashed with correct normalisation before sending. The fbp and fbc cookies must be passed as-is (not hashed). Implementing all available parameters for ecommerce purchase events (email, phone, name, address, fbp, fbc, IP, user-agent) typically achieves an EMQ of 8-10.

See our Facebook CAPI Setup service for implementation.

Need CAPI with complete customer information? Contact Adslytics.