{"id":824,"date":"2026-02-11T23:12:15","date_gmt":"2026-02-11T21:12:15","guid":{"rendered":"https:\/\/www.sabatka.net\/en\/?p=824"},"modified":"2026-02-11T23:12:16","modified_gmt":"2026-02-11T21:12:16","slug":"who-reads-forms-on-your-website-and-do-you-know-about-it","status":"publish","type":"post","link":"https:\/\/www.sabatka.net\/en\/who-reads-forms-on-your-website-and-do-you-know-about-it\/","title":{"rendered":"Who reads the forms on your website? (And do you know about it?)"},"content":{"rendered":"\n

Imagine the following situation. A visitor comes to your website, fills out an order form\u2014name, email, phone number\u2014and submits it. The data goes to your CRM or database.<\/p>\n\n\n\n

But it’s quite possible that the same data \u2014 hashed, but still identifiable \u2014 is also being sent to the servers of Google, Meta, TikTok, Pinterest, and other platforms at that very moment. Automatically. Without a single line of code from you.<\/p>\n\n\n\n

It is called automatic advanced matching (Meta), user-provided data capabilities (Google), automatic advanced matching (TikTok, Pinterest), and other names on other platforms. The principle is the same everywhere: an advertising pixel on the page automatically searches form fields, hashes the personal data found using the SHA-256 algorithm, and sends it to the platform. The platform then matches it with its user database.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
Contact me<\/a><\/div>\n\n\n\n
Share on LinkedIN<\/a><\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

How it works technically<\/h2>\n\n\n\n

The advertising pixel script scans HTML pages and searches for form fields that look like email, phone, name, address, or zip code. It detects this based on attributes such as type=\"email\"<\/code>, type=\"tel\"<\/code>, or field names and placeholders (e.g., name=\"phone\"<\/code>, placeholder=\"Your email\"<\/code>).<\/p>\n\n\n\n

Once the user submits the form (or in some cases just leaves the page), the pixel hashes the values from these fields using SHA-256 and sends them to the platform’s server. The platform then compares the hash with its database \u2014 if it finds a match, it knows that user X filled out the form on your website.<\/p>\n\n\n\n

TikTok goes even further \u2014 its Automatic Advanced Matching<\/a> not only scans form fields, but also static text on the page (such as the logged-in user’s displayed email) and selected JavaScript variables such as window.dataLayer<\/code>.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Which platforms are affected?<\/h2>\n\n\n\n

This is not a marginal issue. In some form, it is a standard feature of all major advertising platforms. For each one, I list what the feature is called, what it collects, and\u2014most importantly\u2014whether it scans forms automatically and whether it is enabled or disabled after creating an account.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Meta (Facebook\/Instagram)<\/strong><\/h3>\n\n\n\n

“Automatic Advanced Matching” feature<\/strong><\/p>\n\n\n\n

Pixel searches forms and collects email, phone number, first and last name, city, state, postal code, country, date of birth, gender, and external ID. By default, this feature is disabled<\/strong>\u2014you must actively enable it in Events Manager (Data Sources \u2192 Pixel \u2192 Settings). Companies in “restricted industries” (banking, insurance, pharmaceuticals, healthcare) cannot use automatic pairing at all and must resort to the manual option.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Google<\/strong><\/h3>\n\n\n\n

\u201eUser-Provided Data” function (in GA4) \/ \u201eEnhanced Conversions” (in Google Ads)<\/strong><\/p>\n\n\n\n

In GA4, this feature is called “User-provided data collection,” and in Google Ads, it is called “Enhanced Conversions.” The Google tag can automatically detect data that looks like an email address, phone number, or name and address. By default (after creating an account), it does not send data, even though it may appear to do so.<\/p>\n\n\n\n

To turn it on, you need to:<\/p>\n\n\n\n

    \n
  1. Admin > Property > Data Collection and modification > Data streams > Configure tag settings > Allow user-provided data capabilities
    This setting is enabled by default.
    \"\"
    <\/li>\n\n\n\n
  2. Admin > Property > Data Collection and modification > Data collection
    Here, you need to enable User-provided data collection.
    \"\"<\/li>\n<\/ol>\n\n\n\n

    If both conditions are met, the parameters em <\/code>(with email hash), ecid<\/code> (matching identifier), and ec_mode=a<\/code> (detection mode, where a means automatic detection) will be added to requests to GA4.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    TikTok<\/strong><\/h3>\n\n\n\n

    Funkce \u201eAutomatic Advanced Matching”<\/strong><\/p>\n\n\n\n

    Pixel automatically identifies form fields<\/a>, hashes and collects emails, phone numbers, names, addresses, and other identifiers. TikTok goes the furthest of all \u2014 it scans not only forms, but also static text on the page (e.g., the displayed email of a logged-in user) and JavaScript variables such as window.dataLayer<\/code>.<\/p>\n\n\n\n

    By default, the feature is disabled \u2014 it can be enabled in the pixel settings in Events Manager. And, unsurprisingly, TikTok marks the feature as recommended.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Pinterest<\/strong><\/h3>\n\n\n\n

    \u201eAutomatic Enhanced Match” function<\/strong><\/p>\n\n\n\n

    Pinterest tag collects emails, names, phone numbers, gender, birth dates, external IDs, cities, states, zip codes, and countries.<\/p>\n\n\n\n

    When you create a new tracking tag, “Enable automatic enhanced match” is enabled <\/strong>by default. Unless someone checks this, form scanning runs from day one.<\/p>\n\n\n\n

    I consider this to be the biggest dark pattern of all the platforms mentioned. A platform full of fashion and cakes, yet with a data appetite like Meta after three days of fasting.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    Manual user matching<\/h2>\n\n\n\n

    Not all platforms scan forms automatically. Some only allow manual user linking\u2014you have to submit personal data to the platform in the source code. In my opinion, this is a better option\u2014you have control over what you send and can monitor all the necessary data.<\/p>\n\n\n\n