Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources DATA PRIVACY IDENTITY & ACCESS MANAGEMENT SECURITY CYBERSECURITY OPERATIONS CYBERSECURITY ANALYTICS NEWS Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. EU Financial Institutions Leak Data Through Cookie Trackers European banks inadvertently transmitted customer data to ad platforms via tracking pixels, raising serious compliance, security, and privacy concerns. Alexander Culafi,Senior News Writer,Dark Reading July 22, 2026 6 Min Read SOURCE: FAITHIECANNOISE VIA GETTY IMAGES There's a pattern of financial institutions exposing customer data through cookie tracking technology, and these organizations may not even be aware of it. Jscrambler published research today regarding how financial institutions in Europe and the US transmit sensitive information to third-party advertising, analytics, and personalization platforms, possibly without the banks' knowledge. Sometimes this happens before the user makes a consent choice, and other times it continues even after the user rejected tracking technologies. LOADING... These findings follow up from a previous Jscrambler study in which researchers found TikTok and Meta use tracking pixels to follow users even after they click over to advertiser sites, receiving personally identifiable (PII) information in the process. Today's research describes a pattern of financial institution websites firing tracking technologies. Across the 14 financial services cases documented in this research, "tracking fired without a valid consent choice at nine separate companies, whether before the banner was actioned, after the user rejected all cookies, or despite an essential-cookies-only selection," the blog post noted. Related:Inconsistent Privacy Labels Don't Tell Users What They Are Getting The data then went to about a dozen different third parties, including Google, Meta, TikTok, LinkedIn, AdSafety, Salesforce, Adobe, Yext, and others. It's not just on basic information pages either; Jscrambler presented examples where banks activated tracking pixels that inadvertently sent customer data back to the technology firms that run them; worse, this is occurring on loan applications or other pages containing customers' most sensitive data. In several cases, the information was either transmitted as deterministic hashes or merely encoded rather than encrypted, meaning it could still potentially be linked back to specific individuals under the right circumstances. "Tracking pixels and personalization tags were once simple tools for confirming an ad impression or counting a visit. On a banking website, the same tags now sit alongside mortgage calculators, account-opening forms, and loan applications, and they behave the same way as they do on a retailer's checkout page," Jscrambler's research blog read. "They collect contact details, hash them, attach them to persistent identifiers, and transmit product and financial intent to platforms the bank does not control. Most institutions are unlikely to realize how much of this is happening by default." European Financial Institutions Mishandle Customer Data In one example, Jscrambler observed a Spanish bank that presented users with the usual choices to accept, configure, or reject cookies while going through a mortgage application process. Once the user accepted, TikTok received the user's hashed email and phone number through a request to its pixel endpoint, originating from an embedded iframe on the mortgage page. TikTok does not appear as a vendor on the bank's cookie policy or privacy policy, so a customer reading either would have no way to know that accepting cookies sent hashed details to TikTok. Related:AI Rising: Do We Know Enough About the Data Populating It? In another case involving a Portuguese bank, personal data was not hashed at all. During the account opening flow, a tracking pixel sent a request to Evergage (now Salesforce Interaction Studio), including the user's email address in the request URL. Later, steps of the same flow sent additional personal data, "including the customer's name, age, Portuguese tax number (NIF), and a Salesforce Marketing Cloud contact key." Researchers offered several examples in all trackers sending egregious data to advertisers. A Portuguese consumer-credit provider sent Google Analytics a full loan application URL that included significant encoded financial details such as loan amount, term, an indication that insurance was selected, and more. Depending on circumstance, tracking sometimes began prior to cookie consent being offered, restarted as soon as the user went to a different subdomain than where they started, or operated despite the tracking request noting cookies had been rejected. Regulatory and Responsibility Implications The question of who's responsible is a challenging one to answer. TikTok and Meta have previously noted that advertisers set the parameters for these trackers, and put primary responsibility on the shoulders of the website operator — the banks themselves. Jscrambler disagreed with this framing in the blog post, noting that many of the data controls that allow swaths of data to be forwarded to these tech giants are enabled by default. "That framing only holds if the collection is something the operator deliberately switched on, and much of what we observed is not. Features such as automatic advanced matching are enabled by default and are designed to capture and hash contact details with no explicit action from the site owner. A bank that drops in a standard pixel does not intentionally configure it to send a customer's hashed email and phone number from a mortgage page," the firm said, adding that, "in these situations, default platform behavior becomes a significant factor in what data is collected and transmitted." Rather, inappropriate data collection appears to be a shared responsibility across all parties. And it's not just an ethical question. The General Data Protection Regulation (GDPR) framework, Europe's main privacy law, requires that organizations don't misuse user data. Financial institutions in particular need to adhere to the Digital Operational Resilience Act (DORA), which demands banks, insurers, investment firms, and other such entities make sure their technologies and suppliers don't create increased risk. Europe's ePrivacy Directive regulates digital cookies and tracking tools. These rules have led to the clearest consequences. In 2020, France's Commission for Digital Freedom fined Google €100 million ($114 million) and Amazon €35 million ($39.9 million) for dropping advertising cookies without clearly explaining their purpose and prior to any consent being given. The commission and other regulating bodies have doled out similar rulings since 2020. On top of that, the EU's Payment Services Directive 2 (PSD2) imposes obligations on banks and other financial institutions in regard to secure handling of customer financial information and payment-related data. Everything involving a customer's financial journey being shared with third parties would be of particular interest. It then becomes paramount that European financial organizations ensure customer data is not being mishandled as described here. Jscrambler recommends financial institutions monitor runtime behavior, enforce runtime controls, honor consent choice in practice (to not track until consent is obtained, and to honor consent across subdomains), and disable advanced matching and automatic collection where it is not justified. Gareth Bowker, head of security research at Jscrambler, tells Dark Reading that the issue described in the research is simultaneously a privacy problem, a security problem, and a third-party risk problem, "and that's exactly why it falls through the cracks," he adds. "At its root, it's a third-party risk problem: code the organization does not write or fully control is executing on its most sensitive pages. It becomes a privacy problem the moment that code sends personal data to platforms the user never agreed to, and a security problem because sensitive values end up in request URLs and third-party systems, and because we also saw invasive device fingerprinting and local-port probing," he says. "Treat it as only a privacy issue, or only a marketing issue, and it doesn't get the scrutiny it deserves." Read more about: Europe About the Author Alexander Culafi Senior News Writer, Dark Reading Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere. At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels. He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense st