In this guide · 7 sections
Short answer
Only upload customers who gave express consent to marketing that covers ad targeting, with a privacy policy that says you share data with ad platforms. Hashing is not anonymisation: the platform's purpose is to match the data back to a person. Remove anyone who opts out and refresh the audience.
What happens when you upload a customer list
Both platforms match the contact details you upload against their own users. Meta's Customer List Custom Audiences Terms (effective 3 December 2025) say contact information such as names, emails and phone numbers is hashed before it is passed to Meta, Meta uses it to create the audience, does not share it with other advertisers, and deletes the customer list data after matching. Google's equivalent is Customer Match.
Common uses for a small business:
- Showing a promotion to past customers who have not bought in six months.
- Excluding existing customers from campaigns aimed at new ones.
- Building a lookalike or similar audience from your best customers.
Each of these uses your customers' personal data for marketing, and the upload is a disclosure to a third party. That is why the PDPA, and the platforms' own terms, apply.
What Meta and Google make you promise
Neither platform checks your consent records, but both put the responsibility on you in writing.
| Requirement | Meta Custom Audiences terms | Google Customer Match policy |
|---|---|---|
| Lawful basis | You warrant you have all necessary rights, permissions and a lawful basis to use the data | Comply with applicable laws; obtain consent where required by law or Google policy |
| Source of data | Meta identifiers must come from Meta or the person directly | Only first-party data customers shared directly with you |
| Privacy policy | Not specified in the terms | Must disclose that you share customer data with third parties to perform services for you |
| Sensitive data | No audiences based on children under 13, sensitive, health or financial information | No under-13s; no ads implying knowledge of sensitive information |
| Opt-outs | Do not upload people who opted out; remove them if they opt out later | Lists must be refreshed; memberships expire after 540 days |
Google also limits who can use Customer Match for targeting: its policy says the Targeting setting needs 90 days of account history and more than US$50,000 lifetime spend, while all policy-compliant accounts can use lists for Observation and Exclusions.
Hashing is not anonymisation
Hashing turns an email address into a fixed-length code. The same email always produces the same code, which is exactly how the platform matches it to an account. That is the point of the upload, so the hashed list still relates to identifiable people.
The PDPC's Guide to Basic Anonymisation explains that de-identification, which may include assigning pseudonyms, is only the first step of anonymisation, and that de-identified data can often be re-identified when combined with other data. Only properly anonymised data falls outside the PDPA. A hashed customer list, built to be matched back to individuals, does not meet that bar.
Consent and notification under the PDPA
The PDPA's consent, purpose and notification obligations apply to using customers' contact details for ad targeting. The PDPC's Advisory Guidelines on Key Concepts say the Personal Data Protection Regulations 2021 exclude direct marketing from deemed consent by notification, and that the legitimate interests exception cannot be used for marketing. The safest reading for a small business is to rely on express, opt-in consent that covers advertising.
Ask for marketing consent separately
Use an unticked checkbox at sign-up or checkout, separate from the terms. Our PDPA consent wording guide has examples.
Name ad targeting in the purpose
For example: "to send you offers by email and to show you relevant ads on platforms such as Facebook, Instagram and Google, by securely matching your email or phone number".
Update the privacy policy
Say that you share contact details, in hashed form, with advertising platforms to show ads and measure results. Google's policy requires this disclosure. See our privacy policy and cookie consent guide.
Record consent per customer
Store a marketing consent flag and date in your CRM or shop, and export only consented customers.
Upload through the official tools only
Use Ads Manager, Google Ads or Data Manager, not third-party list sellers. Google's policy only allows its approved interfaces.
Older customer lists collected without marketing consent should not be uploaded just because they are hashed. Ask those customers to opt in first, through a channel where you are allowed to contact them.
Handling opt-outs and list hygiene
Meta's terms say you must not upload people who have exercised an opt-out you committed to honour, and must remove them from the audience if they opt out later. The PDPC treats at least 10 business days as reasonable notice for a consent withdrawal, per its key concepts guidelines.
Customer list hygiene
If you also message customers on WhatsApp, the consent and DNC rules there are separate; our WhatsApp marketing rules guide covers them.
Do it yourself or get help?
If your shop or CRM already records marketing consent, building a consented export and uploading it takes an afternoon. Get help if consent was never recorded, your privacy policy does not mention ad platforms, or audiences were built by someone who has left.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Ad Account Audit (S$290) reviews up to 2 ad accounts, including audiences, tracking and wasted spend, with a prioritised fix list. Our PDPA Compliance Pack (S$690) prepares your privacy policy, data inventory and staff data protection policy. We are not a law firm and this is not legal advice.
Frequently asked questions
In Singapore, the safest approach is express marketing consent that covers advertising. Meta's terms make you warrant you have the rights, permissions and lawful basis to use the data, and the PDPC's guidelines say direct marketing cannot rely on deemed consent by notification or the legitimate interests exception. This is general information, not legal advice.
In this context, yes. Hashing is designed so the platform can match the same email or phone number to a person, so it is a form of de-identification, not anonymisation. The PDPC's Guide to Basic Anonymisation says de-identification is only the first step, and only properly anonymised data falls outside the PDPA.
Google's Customer Match policy requires first-party data that customers shared directly with you, a privacy policy disclosing that you share customer data with third parties to perform services for you, consent where required by law, uploads only through Google's approved interfaces, and compliance with applicable laws. Targeting use also needs 90 days of history and over US$50,000 lifetime spend.
Stop using their details for marketing, including ad audiences. Meta's terms say you must remove people from an audience if they opt out after you uploaded them. Sync unsubscribes to the list you upload and refresh audiences regularly. The PDPC treats at least 10 business days as reasonable notice for a withdrawal to take effect.
Say that you may share customers' contact details, in hashed form, with advertising platforms such as Meta and Google to show relevant ads, exclude existing customers and measure results, and explain how to opt out. Google's Customer Match policy specifically requires disclosure that you share customer data with third parties performing services for you.