I'm looking to pass email address as an encrypted value (DES) to avoid PII in email links for compliance with Google remarketing.

I'm able to use the EncryptSymmetric in the email body to create a DES-encrypted value passed in a URL:

<!-- %%[
Var @encData

SET @encData=EncryptSymmetric(emailaddr, 'des', @null, '0x7FEBCBCBCB9BCB01', @null, @null, @null, @null)

]%% -->

<table id="Table_01" width="640" border="0" cellpadding="0" cellspacing="0" align="center" bgcolor="#ffffff">
            <a href="http://www.garnethill.com/womens-fashion/dresses/?ucv=%%=v(@encData)=%%" conversion="true" alias="0">This email link is encrypted</a></td>

But this method requires me to hard code ?ucv=%%=v(@encData)=%% to the link.

I've tried passing the same variable ucv=%%=v(@encData)=%% in _AdditionalEmailAttribute2 but the resulting link only includes &ucv= without pulling in the dynamic value. Can the _AdditionalEmailAttribute2 only look up a standard personalization string or a dynamic value in a data extension (as opposed to the body of the email sent)?

If this was sent using Web-Analytics Connector to use the dynamic variable (ucv=%%=v(@encData)=%%) would WAC correctly pick up the @encData from the email body?

Any other methods to accomplish DES encryption for email in a parameter?


AMPScript variables will not get evaluated in the Additional Email Attributes, unfortunately.

Yes, you can include email variables in the WAC.

Decrypting SFMC content outside of the platform is tricky.

Here's one solution using AES: EncryptSimmetric AMPScript AES

| improve this answer | |
  • Thanks Adam - I'll run this in WAC on a test account. We have an existing process in place to decrypt the DES value. Much appreciated! – Bill Cobb May 5 '17 at 17:03
  • DES decryption outside of SFMC? – Adam Spriggs May 5 '17 at 17:44
  • Follow up on this issue: I had success passing an encrypted value to a WAC parameter value using Set @encData = EncryptSymmetric and putting a parameter for uid=@encData in WAC. We're continuing to have issues with getting the correct encrypted value - internally we use DES with mode ECB and padding PKCS5. It appears SFMC will only support PKCS7, and even attempts to send with PKCS7 resulted in an error at send. We're engaging an SOW to resolve the encryption. – Bill Cobb May 12 '17 at 12:25
  • I know it's possible to decrypt AES outside the platform. – Adam Spriggs May 12 '17 at 13:14
  • Solved! I had a developer get into our test account and resolve the script issue. We're now able to encrypt the email using DES and pass the encrypted value in a parameter string using WAC. The final encryption string was not dependent on padding. I've created a shared content area to pickup the script for encrypt symmetric across our enterprise business units. – Bill Cobb May 16 '17 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.