EU Financial Institutions Leak Data Through Cookie Trackers

European financial institutions are inadvertently exposing customer data to third-party advertising and analytics platforms through tracking pixels, even when users haven't consented to tracking. Jscrambler’s research revealed that banks are sending sensitive information, including hashed email addresses, phone numbers, and financial details, to platforms like TikTok, Meta, and Salesforce, often without the customer’s knowledge or explicit consent. This practice raises significant compliance concerns under regulations like GDPR and DORA, and highlights a shared responsibility between banks and third-party vendors.

There’s a pattern of financial institution websites firing tracking technologies. Across the 14 financial services cases documented in this research, "tracking fired without a valid consent choice at nine separate companies, whether before the banner was actioned, after the user rejected all cookies, or despite an essential-cookies-only selection," the blog post noted. These tracking pixels are often activated by default, sending data to platforms the bank doesn’t control.

In one example, a Spanish bank presented users with the usual choices to accept, configure, or reject cookies while going through a mortgage application process. Once the user accepted, TikTok received the user’s hashed email and phone number through a request to its pixel endpoint, originating from an embedded iframe on the mortgage page. TikTok does not appear as a vendor on the bank’s cookie policy or privacy policy, so a customer reading either would have no way to know that accepting cookies sent hashed details to TikTok.

Another case involved a Portuguese bank where personal data was not hashed at all. During the account opening flow, a tracking pixel sent a request to Evergage (now Salesforce Interaction Studio), including the user’s email address in the request URL. Later, steps of the same flow sent additional personal data, "including the customer's name, age, Portuguese tax number (NIF), and a Salesforce Marketing Cloud contact key."

Researchers offered several examples in all trackers sending egregious data to advertisers. A Portuguese consumer-credit provider sent Google Analytics a full loan application URL that included significant encoded financial details such as loan amount, term, an indication that insurance was selected, and more. Depending on circumstance, tracking sometimes began prior to cookie consent being offered, restarted as soon as the user went to a different subdomain than where they started, or operated despite the tracking request noting cookies had been rejected.

Regulatory and Responsibility Implications: The question of who’s responsible is a challenging one to answer. TikTok and Meta have previously noted that advertisers set the parameters for these trackers, and put primary responsibility on the shoulders of the website operator — the banks themselves. Jscrambler disagreed with this framing in the blog post, noting that many of the data controls that allow swaths of data to be forwarded to these tech giants are enabled by default. "That framing only holds if the collection is something the operator deliberately switched on, and much of what we observed is not. Features such as automatic advanced matching are enabled by default and are designed to capture and hash contact details with no explicit action from the site owner. A bank that drops in a standard pixel does not intentionally configure it to send a customer’s hashed email and phone number from a mortgage page," the firm said, adding that, "in these situations, default platform behavior becomes a significant factor in what data is collected and transmitted."

Rather, inappropriate data collection appears to be a shared responsibility across all parties. It’s not just an ethical question. The General Data Protection Regulation (GDPR) framework, Europe’s main privacy law, requires that organizations don’t misuse user data. Financial institutions in particular need to adhere to the Digital Operational Resilience Act (DORA), which demands banks, insurers, investment firms, and other such entities make sure their technologies and suppliers don’t create increased risk. Europe’s ePrivacy Directive regulates digital cookies and tracking tools. These rules have led to the clearest consequences. In 2020, France’s Commission for Digital Freedom fined Google €100 million ($114 million) and Amazon €35 million ($39.9 million) for dropping advertising cookies without clearly explaining their purpose and prior to any consent being given. The commission and other regulating bodies have doled out similar rulings since 2020.

On top of that, the EU’s Payment Services Directive 2 (PSD2) imposes obligations on banks and other financial institutions in regard to secure handling of customer financial information and payment-related data. Everything involving a customer’s financial journey being shared with third parties would be of particular interest. It then becomes paramount that European financial organizations ensure customer data is not being mishandled as described here. Jscrambler recommends financial institutions monitor runtime behavior, enforce runtime controls, honor consent choice in practice (to not track until consent is obtained, and to honor consent across subdomains), and disable advanced matching and automatic collection where it is not justified. Gareth Bowker, head of security research at Jscrambler, tells Dark Reading that the issue described in the research is simultaneously a privacy problem, a security problem, and a third-party risk problem, "and that's exactly why it falls through the cracks," he adds. "At its root, it's a third-party risk problem: code the organization does not write or fully control is executing on its most sensitive pages. It becomes a privacy problem the moment that code sends personal data to platforms the user never agreed to, and a security problem because sensitive values end up in request URLs and third-party systems, and because we also saw invasive device fingerprinting and local-port probing. Treat it as only a privacy issue, or only a marketing issue, and it doesn't get the scrutiny it deserves."