Exclude recent purchasers from Meta retargeting

01/The build

How to build it

1. 01

   Create the 'recent purchasers — suppress' Custom Audience

   Needs a human

   In Meta Ads Manager, create a Custom Audience of type Customer List and leave it empty — this is the suppression bucket, not a targeting audience. Copy its audience ID; that's what the API writes to. Name it so future-you knows it's an exclusion list (e.g. 'SUPPRESS — bought in last 30d') and not something you'd ever accidentally target.

2. 02

   Catch paid orders from Shopify

   Runs itself

   Register the Shopify orders/paid webhook (Settings → Notifications, or via the Admin API) pointing at an n8n webhook node. orders/paid fires on actual payment, not order creation, so you don't suppress someone whose checkout never captured. From the payload, grab the customer's email and phone plus the order's processed_at timestamp.

3. 03

   Normalize and SHA-256 hash the identifiers

   Runs itself

   Meta only accepts hashed PII for customer-list audiences, and the match rate collapses if the normalization is off. Email: trim whitespace and lowercase it. Phone: strip everything but digits and prepend the country code (e.g. 13105551234). Then SHA-256 each value to a lowercase hex string in an n8n Crypto node. Send both EMAIL_SHA256 and PHONE_SHA256 — two keys beats one for match rate.

4. 04

   Add the hashed customer to the suppression audience

   Runs itself

   POST to the Marketing API at /{AUDIENCE_ID}/users with schema ["EMAIL_SHA256","PHONE_SHA256"] and a data array of [emailHash, phoneHash] rows. You can batch up to ~10,000 rows per call, but for a per-order webhook you're sending one row. Respect marketing consent: only push customers who accepted marketing (Shopify's accepts_marketing / consent fields), so the suppression list stays clean and defensible.

5. 05

   Set the audience as an exclusion on every retargeting ad set

   Needs a human

   This is the step that actually saves the money, and it's a one-time config Meta won't do for you: open each retargeting ad set (website visitors, view-content, add-to-cart, IG/FB engagers) and add the suppression audience under Excluded audiences. Make it part of your ad-set checklist so new retargeting campaigns inherit it. Without this, the audience fills up and changes nothing.

6. 06

   Time-box it: remove buyers after the suppression window

   Runs itself

   Run a daily n8n Schedule node that re-queries Shopify for orders whose processed_at is now just past your window (say 30 days for a one-time product, or your replenishment cycle for a consumable), hashes those customers, and DELETEs them from the audience via the same /{AUDIENCE_ID}/users endpoint. That's what lets a past buyer flow back into retargeting — or into a win-back flow — instead of being suppressed forever.

7. 07

   Guard the removal: don't pull someone who just bought again

   Runs itself

   Before removing a customer in the daily job, confirm they have no other paid order inside the window — otherwise a repeat buyer whose first order aged out gets un-suppressed while their second order is still fresh. Also reset the clock on subscription renewals (Recharge/Shopify subscription orders) so active subscribers don't get retargeted between charges.

8. 08

   Verify the match rate and that the exclusion is live

   Needs a human

   Meta takes a few hours to match and populate a customer-list audience, so don't panic at an empty count on day one. After a day, check the audience size is climbing and the match rate is reasonable (low match rate usually means a hashing/normalization bug, not bad data). Confirm in Ads Manager that the exclusion shows on each retargeting ad set — a fast spot-check that catches a campaign someone duplicated without it.

02/The stack

What it’s built on

Shopify

Source of truth for who bought and when. Its orders/paid webhook triggers the add, and a daily re-query of processed_at drives the time-boxed removal.

Meta Ads

Holds the suppression Custom Audience and applies it as an exclusion on your retargeting ad sets. The Marketing API's /{audience_id}/users endpoint is what you add and remove hashed customers through.No special tier needed — customer-list Custom Audiences and the exclusion field are standard in any Meta ad account. You only need a system user token with ads_management access to call the API; nothing to buy.

n8n

The glue: catches the webhook, normalizes and hashes the identifiers, calls the Marketing API to add the buyer, and runs the daily schedule that removes them after the window.n8n is open-source and self-hostable for free; their cloud tier just saves you running it yourself. Hashing customer PII on infrastructure you control (self-hosted) is the cleaner privacy story.

03/Questions

Before you build