Customer data & privacy

Passing customer details with conversion events dramatically improves ad-platform match rates (Meta's Event Match Quality). Prism is built so that raw customer data never leaves the visitor's browser.

Recognized fields

Pass these as properties on any prism('track', ...) call:

window.prism('track', 'Lead', {
  email: 'jane@example.com',
  phone: '(555) 123-4567',
  first_name: 'Jane',
  last_name: 'Doe',
  city: 'Austin',
  state: 'TX',
  zip: '78701',
  country: 'US',
  date_of_birth: '1990-04-12',
});

Field	Normalization before hashing
email	trimmed, lowercased
phone	digits only
first_name, last_name	letters only, lowercased
city	letters only, lowercased
state	2-letter code, lowercased
zip	first segment, whitespace stripped
country	2-letter ISO code, lowercased
date_of_birth	digits only (YYYYMMDD)

Each field is normalized to the ad platforms' matching rules and SHA-256 hashed in the browser before the event is sent. The raw values are removed from the payload — Prism's servers only ever see the hashes, which is exactly the format Meta CAPI accepts.

fb_login_id (the numeric Facebook user ID, for sites with Facebook Login) is also recognized and passed through un-hashed, per Meta's spec.

Identity and cookies

Prism sets a small set of first-party cookies: the adsidian_id visitor identity (1 year, HTTP-only), _prism_* click-ID cookies (90 days), and _fbp (90 days, only when ad consent is not denied). On Shopify the checkout pixel also sets _prism_aid, reuses the storefront's _fbp when one exists, and mints its own _fbp otherwise (same consent rule). The full table with lifetimes and conditions is in Privacy & consent → Cookies and storage.

Browsers can shorten these lifetimes. Safari's detected CNAME/IP cloaking protections can cap HTTP cookies at seven days (see WebKit's tracking prevention documentation). Actual retention and attribution depend on browser protections, consent, user deletion, and the ad platform's attribution window.

If the site has no Meta pixel, Prism generates a spec-compliant _fbp value so CAPI events still match, unless the visitor has denied ad consent.

Consent

Prism enforces consent server-side: an explicit denial always suppresses ad-platform delivery, IAB TCF CMPs are auto-detected, and a documented window.prismConsent object lets any consent manager drive the gate. See Consent integration for setup and per-client configuration (consent_required / consent_default).

Your privacy notice

Deploying Prism makes you the controller of the data it collects — your site's privacy policy must disclose the cookies, the hashed identifiers, and the sharing with ad platforms (Meta, Google, LinkedIn, Reddit, ChatGPT/OpenAI Ads, whichever you enable). Template language: Required disclosures and Suggested privacy-policy wording.