Run a free scan

BayLDA hashed email fine: hashing did not remove the need for consent

Bavaria’s data protection regulator reportedly fined a tech company about €3.2m for using hashed email addresses for ad targeting without consent. The details are second-hand.

BayLDA · GDPR · Fine reported for 2023

Unconfirmed: reported second-hand; finality not known

Regulator or court
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Jurisdiction
Germany
Framework
GDPR Articles 5 and 6
End of 2023 reporting year (fine date not known)

Undisclosed data exchanges · Consent before collection · International data transfers

The problem

As reported, a company used personal data for audience targeting for about two years without getting any consent. It used a US provider’s tool, so the data went regularly to a third country for analysis. The email addresses were hashed, which did not change the regulator’s view.

Case record

Regulator
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Company
Not named; described only as a "tech company"
Amount
About €3.2m, according to a BayLDA press office reply to Piltz Rechtsanwälte, as reported by dr-datenschutz
Official record
BayLDA’s 13th annual report gives about €3.8m in fines for 2023, up to seven figures against companies, but does not itemise this case
Stage
Not known. The annual report says not all 2023 decisions were final when it went to press

What was reported

Inth has not seen the fine notice or a BayLDA publication about this case. The points below come from dr-datenschutz’s account of the press office reply. Inth translated the German.

  • The company processed personal data unlawfully for audience targeting for about two years, because no consent was obtained at all.
  • An aggravating factor was the use of a US company’s tool, with data transferred regularly to a third country for analysis.
  • That the email addresses were hashed, so pseudonymised, did not change the decision.
  • Mitigating factors were a quick stop to the processing before the regulator acted, cooperation and stronger internal controls.

dr-datenschutz suggests the US provider was "probably Google" (translated). That is the commentator’s guess, not a reported fact.

Technical issue

Hashing an email address gives the same value every time, so a platform that holds the same address can match it. That is why hashed emails are used for targeting, and why the regulator treated them as pseudonymised personal data rather than anonymous data.

// Risky: upload hashed emails for every customer
upload(customers.map(c => sha256(c.email)));

// Safer: only customers with a recorded marketing consent
upload(customers
  .filter(c => c.consents.includes('ad-targeting'))
  .map(c => sha256(c.email)));

Illustrative pattern, not the company’s code. Generic consent API, not a specific c15t call.

Timeline

  1. About two years before the stopTargeting without consent, as reported; exact dates not confirmed
  2. 2023BayLDA’s reporting year, with about €3.8m in total fines
  3. LaterPress office reply to Piltz Rechtsanwälte, reported by dr-datenschutz

Outcome

A reported fine of about €3.2m. Inth could not confirm whether it is final or whether the company challenged it.

What it cost

About €3.2m, if the second-hand report is accurate. dr-datenschutz puts that at about 85% of BayLDA’s 2023 fine total.

Why it matters

Customer list uploads and similar matching features run outside the browser, so a cookie banner never sees them. If the report is right, hashing does not turn them into anonymous data, and they still need a legal basis.

How Inth catches this

  • Code audit can map reviewed data ingestion and onward-sharing routes and trace reviewed outbound data flows, which is where an upload job like this would show up.
  • Evidence: consent records show each visitor’s choice, country and policy, which an upload job could filter on.

The consent banner does not control server-side uploads, and a browser observation cannot see them. Filtering by consent must be built into your own code.

Checks for your own systems

In the repository

  • Search for jobs that hash emails or phone numbers and send them to ad platforms.
  • Check that each one filters on a recorded consent.

In the browser and network

  • Check whether tags send hashed form data, such as enhanced matching, before consent.

With the people responsible

  • Ask marketing which customer lists are uploaded, where and how often.

Sources and limits

Source review: 20 October 2026. This page relies on a secondary report of a regulator’s press office reply. Inth has not seen the fine notice, cannot confirm the amount, the company or the dates, and does not know whether the fine is final. Inth translated the German quotes and wrote the technical checks; they cannot decide which laws apply or prove compliance.