Phone numbers, as well as e-mails, are one of the biggest sources of identity information. In order to maximize our identification capabilities, we decided to accept them as well as an user identifier, as in some regions (APAC or US, for example) they are very representative and easier to share than e-mail addresses or other identifiers.

To improve our compatibility with already established standards in the industry, we have decided to enable phone number collection through Criteo's OneTag. Some of the upsides of sharing phone numbers are:

HPN (hashed phone number) is the best representation of a single user and it persists over time: In general, people have a single persistent phone number whereas they may have several emails, mobile ids or cookies.
HPN improves our 360 vision of the user: a user has a single phone number, available for each of his devices. It helps us improve our bidding, our recommendation and thus the performance for our clients.
HPN interoperates with several identifiers including HEM and some alternative ids. We can:
- Collect HPN <> alternative ids links and bid directly on the alternative ids.
- Collect HEM <> HPN and bid directly with the HEM.

How it works

We collect the data through a small snippet of code that allows you to pass the phone numbers of visitors to your website. Event though they can be collected in plain or hashed formats, all phone numbers will be hashed, using a SHA-256 algorithm, before being stored on Criteo's servers. Criteo will then use the hash value to match users across each of their devices.

To ensure we protect your customers’ privacy, Criteo will only store the hashed phone numbers of your customers on our servers. In order to be secure enough, we are adding a second hash stored in a secret vault to avoid any reidentification of the users.

Do I need to update my website's privacy policy?

You need to ensure your Website Privacy Policy clearly informs your website visitors that phone numbers may be collected and shared with third-parties that you collaborate with to optimize campaign performance and that this information is hashed using the latest and most secure SHA256 hashing technology.

Additionally, you should inform your visitors that you respect their privacy, and should they prefer not to share such information, they can do so by selecting their preferred options in your website user cookie compliance banner (CMP).

Please refer to Criteo's Privacy Policy for more information, and you may also include the provided link within your website's Privacy Policy section. 

Should your legal team have any concerns relating to privacy, they may reach out to your Criteo business contact who will connect them with our legal team as needed.

How to implement

To provide the most flexibility to you, Criteo accepts users' phone numbers in these formats:

SHA256 hashed (in line with industry standards for addressable advertising).
Plain text (we will, immediately before logging the data, use SHA256 encryption on the phone numbers).

SHA256 Hashing Function using JavaScript