Deduplication is the part that goes wrong. Each event must carry the same event_name and event_id from both the browser and the server. Omit the event ID and Meta counts one purchase twice, doubling your reported conversions and corrupting the bidding signal you installed CAPI to improve.
CAPI improves event match quality by sending hashed customer information — email, phone, name, city, external ID — that the browser pixel often cannot access. Match quality directly affects how well Meta can attribute and optimise, and Meta scores it out of 10 in Events Manager.
All personal identifiers must be SHA-256 hashed and normalised before sending: lowercase, trimmed, phone numbers in E.164. Sending a raw email address is both a policy violation and a data-protection incident.
See how your site handles this
TagEasy's free auditor checks any URL for Consent Mode v2 signals, PII in tracking, duplicate pixels, and 10 other tracking-quality faults. No signup.