Consent and Offline Data Onboarding: Matching Store Records to Online Profiles
A customer pays at a till, gives an email for a receipt, and weeks later sees ads that clearly know what they bought in store. Behind that moment sits data onboarding: a retailer uploads names, emails, or phone numbers to a platform, which matches them to online accounts and builds audiences from the match.
Offline collection feels low tech, so teams often treat it as outside the consent rules that govern their website banner. It is not. This guide explains where onboarding consent comes from, why a receipt email is not marketing consent, how hashing changes very little, and how withdrawals have to flow back into uploaded lists.
Where the data was collected decides the starting point
Data collected at a till, on a paper form, or through a loyalty sign up was collected for a stated reason at that moment: completing a sale, sending a receipt, or running the loyalty scheme. Uploading that data for advertising matching is a different purpose, and different purposes need their own justification. If the original notice never mentioned advertising matching, the upload stretches the original deal past breaking point. The cleanest fix is at the collection point: one plain sentence saying records may be matched with online platforms for advertising, paired with a way to say no that staff can actually record in the till system.
Hashing is a transfer safeguard, not a consent substitute
Onboarding tools ask retailers to hash emails and phone numbers before upload, and the hashing step is often described as if it makes the data anonymous. It does not. The platform hashes its own user records the same way and matches the two sets, which is the whole point of the service. A matched hash identifies a person just as directly as the plain email did. Hashing still matters: it reduces exposure in transit and limits what a breached file reveals. But it changes the security story, not the consent story, and privacy notices should never present it as anonymisation.
Lookalikes extend the data further than most notices admit
Once a list is matched, platforms usually offer to build lookalike audiences: people who resemble the uploaded customers. At that point the original customers data is shaping ads shown to strangers, and the seed list itself may be retained to keep the model fresh. Notices that mention matching but stay silent on lookalikes are describing half the process. A complete notice names both steps, states how long seed lists are kept, and explains that deleting the upload stops future refreshes. Retailers should also check the platform terms: some keep aggregated model value after deletion, which belongs in the internal record even if it is hard to explain at a till.
Withdrawals must travel backwards into every upload
A customer who opts out of marketing in store, or deletes their loyalty account, is withdrawing from the matching as well. That withdrawal is useless if the uploaded list from last quarter still sits in the platform being refreshed into campaigns. Build the return path before the first upload: a regular suppression export from the loyalty system, an owner for re-uploading cleaned lists, and a check that deletion requests inside the platform actually completed. Keep an onboarding log with dates, list sizes, and purposes. When a regulator or a customer asks how their till record ended up in an ad audience, that log is the difference between an explanation and a scramble.
Related reading
These earlier guides cover connected questions in more depth: Consent in Connected Cars: Driver Data, Passengers, and Second Owners, How Long to Keep Consent Records: A Practical Retention Schedule, and Consent in Connected TV Apps: Choices on the Big Screen.
Frequently asked questions
Is consent given for a digital receipt enough for ad matching?
No. A receipt address is given to complete the sale and deliver the receipt. Using it later to match the customer to an online advertising profile is a separate purpose that needs its own notice and a working opt out.
Does hashing an email list make it anonymous?
No. Hashing protects the list in transit, but the platform matches hashes against its own hashed records to identify people. Matched data is still personal data and still needs a lawful basis and an honoured opt out.
How often should uploaded lists be refreshed or deleted?
On a fixed schedule, commonly every 30 to 90 days, so withdrawals and deletions are reflected. A list uploaded once and left indefinitely will keep matching people who have since opted out.
What should a small retailer check before the first upload?
Check the collection notice given in store, confirm opt outs are recorded in the same system that builds the export, agree retention with the platform in writing, and keep a log of what was uploaded, when, and why.