# Your Bank Said No to Cookies. The Tracking Pixels Disagreed.
Somewhere between clicking "Reject All" on a European bank's cookie banner and submitting a loan application, your data took a detour. It went to Google. Possibly Meta. Maybe TikTok. And the bank probably had no idea.
That's the blunt upshot of new research from Jscrambler, published Tuesday, documenting how financial institutions across Europe and the United States are inadvertently firing tracking pixels that route sensitive customer data to third-party advertising, analytics, and personalization platforms — in many cases before users have made a consent choice at all, and in others, *after explicitly rejecting tracking*.
Across 14 documented cases in financial services, tracking fired without a valid consent basis at nine separate institutions. The data recipients read like a who's-who of the ad-tech industrial complex: Google, Meta, TikTok, LinkedIn, AdSafety, Salesforce, Adobe, Yext, and more. That's roughly a dozen companies receiving data that customers almost certainly believed was protected by a combination of regulatory obligation and their own explicit rejection of tracking.
## Where the Leak Actually Happens
The mechanics matter here, and most coverage glosses over them. This isn't about a misconfigured database or a breach by outside actors. The exposure happens at the page-rendering layer — tracking pixels embedded in financial institution websites fire as the page loads, before or independent of whatever consent logic is supposed to govern them.
Jscrambler's previous research caught TikTok and Meta operating pixels that follow users from advertiser sites back to their own platforms. This new study documents the other side of the same problem: banks and financial firms deploying those same third-party tools without adequately controlling when they activate.
The specific pages matter too. Researchers found instances of pixels firing not just on generic informational pages but on loan applications and other high-sensitivity workflows — exactly the surfaces where a customer's income, debt profile, or credit inquiry data might be present in page elements, form fields, or URL parameters.
And the transmission method adds another layer of concern. In several cases, customer data was sent as deterministic hashes or as mere encoding rather than true encryption. That distinction is significant: a hash of an email address or phone number is not anonymized. It can be matched against other datasets the ad platform already holds, re-linking an individual's financial activity to their advertising profile with no brute-force effort required. Encoding is even weaker — it's obfuscation, not protection.
## GDPR's Specific Promises, Broken
European data protection law doesn't operate on vibes. The General Data Protection Regulation defines specific lawful bases for processing personal data, and for behavioral tracking, the lawful basis is almost always explicit consent — freely given, specific, informed, and unambiguous. A pre-ticked box doesn't cut it. Firing tracking before the banner is actioned definitely doesn't. Continuing to track after a user selects "Reject All" is arguably the most direct violation possible: the user made their choice, the system ignored it.
Financial institutions in the EU face a compounding obligation. Under both GDPR and the sector-specific regulatory frameworks governing banking and investment services, data minimization and purpose limitation are foundational principles. Transmitting customer data to ad platforms for targeting purposes is about as far from a "necessary for the performance of a contract" legal basis as it gets.
The consent management platforms (CMPs) banks deploy to display those cookie banners are supposed to gate pixel firing based on user choices. The research documents that this gate frequently fails — either by design in the CMP implementation, by misconfiguration, or because the tracking code loads through a pathway the CMP doesn't control.
## The Third-Party Liability Trap
Banks didn't write the TikTok pixel. They didn't author Google's tag. But under GDPR, the data controller — the bank — is responsible for ensuring that the third-party tools it deploys comply with the law. "We didn't know the pixel was doing that" is not an Article 5 defense.
This is the third-party supply chain problem manifesting in a privacy context rather than a security one, and it deserves the same rigor that security teams apply to software dependencies. A tracking pixel is code running on the bank's domain, with access to whatever's on that page, firing requests to external infrastructure. The attack surface isn't hypothetical — it's the entire page DOM on the loan application your customer just submitted.
What makes this particularly difficult is that tag management systems, A/B testing tools, and marketing analytics stacks are often managed by teams far removed from compliance or security. A marketing manager spinning up a new LinkedIn Insight Tag doesn't think about GDPR lawful bases. A CMP configured six months ago may not account for every tracking vendor added since.
---
## HackWire Analysis
The Jscrambler research is a useful dataset, but the real story here is about accountability gaps at regulated institutions that should know better.
European banks are among the most heavily supervised organizations in the world. They file detailed regulatory reports, undergo capital stress tests, submit to AML audits, and face significant penalties for data breaches under both GDPR and sector-specific frameworks. And yet the tracking pixel — a piece of marketing technology that has existed since the late 1990s — is apparently bypassing their entire compliance apparatus.
That's not a technology failure. It's a governance failure. Security and compliance teams at financial institutions rarely have visibility into what the marketing stack is doing at the page-render layer, and marketing teams rarely understand the regulatory exposure created by their tooling choices. The gap between those two groups is where the data leaks.
The timing of this research also matters. EU data protection authorities have been accelerating enforcement — the Irish DPC levied a €1.2 billion fine against Meta in 2023 partly over transatlantic data transfers. A financial institution found to have systematically transmitted customer loan application data to Meta's pixel, post-consent-rejection, would face a very uncomfortable regulatory conversation. The maximum GDPR penalty is 4% of global annual turnover.
For defenders at financial institutions: this is a tag audit problem. Map every third-party tag deployed across your web properties. Verify your CMP vendor list matches what's actually firing. Test the reject path in a clean browser session and watch the network tab. If you're seeing pixels fire after "Reject All," you have a compliance exposure that needs legal and security involvement, not just a developer fix.
The broader pattern here: as browser vendors have tightened first-party cookie tracking, the industry has shifted toward pixel-based server-to-server integrations and hashed-identifier matching — methods that are harder for users to block and, apparently, harder for banks to govern. The privacy-tech arms race is outpacing institutional controls at organizations that regulators assume have those controls in place.
— HackWire Editorial
---
## Related Coverage