There’s a pattern of financial institutions exposing customer data through cookie tracking technology, and these organizations may not even be aware of it.
Jscrambler published research today regarding how financial institutions in Europe and the US transmit sensitive information to third-party advertising, analytics, and personalization platforms, possibly without the banks’ knowledge. Sometimes this happens before the user makes a consent choice, and other times it continues even after the user rejected tracking technologies.
These findings follow up from a previous Jscrambler study in which researchers found TikTok and Meta use tracking pixels to follow users even after they click over to advertiser sites, receiving personally identifiable (PII) information in the process.
Today’s research describes a pattern of financial institution websites firing tracking technologies. Across the 14 financial services cases documented in this research, “tracking fired without a valid consent choice at nine separate companies, whether before the banner was actioned, after the user rejected all cookies, or despite an essential-cookies-only selection,” the blog post noted.
The data then went to about a dozen different third parties, including Google, Meta, TikTok, LinkedIn, AdSafety, Salesforce, Adobe, Yext, and others.
It’s not just on basic information pages either; Jscrambler presented examples where banks activated tracking pixels that inadvertently sent customer data back to the technology firms that run them; worse, this is occurring on loan applications or other pages containing customers’ most sensitive data. In several cases, the information was either transmitted as deterministic hashes or merely encoded rather than encrypted, meaning it could still potentially be linked back to specific individuals under the right circumstances.
“Tracking pixels and personalization tags were once simple tools for confirming an ad impression or counting a visit. On a banking website, the same tags now sit alongside mortgage calculators, account-opening forms, and loan applications, and they behave the same way as they do on a retailer’s checkout page,” Jscrambler’s research blog read. “They collect contact details, hash them, attach them to persistent identifiers, and transmit product and financial intent to platforms the bank does not control. Most institutions are unlikely to realize how much of this is happening by default.”
European Financial Institutions Mishandle Customer Data
In one example, Jscrambler observed a Spanish bank that presented users with the usual choices to accept, configure, or reject cookies while going through a mortgage application process. Once the user accepted, TikTok received the user’s hashed email and phone number through a request to its pixel endpoint, originating from an embedded iframe on the mortgage page. TikTok does not appear as a vendor on the bank’s cookie policy or privacy policy, so a customer reading either would have no way to know that accepting cookies sent hashed details to TikTok.
In another case involving a Portuguese bank, personal data was not hashed at all. During the account opening flow, a tracking pixel sent a request to Evergage (now Salesforce Interaction Studio), including the user’s email address in the request URL. Later, steps of the same flow sent additional personal data, “including the customer’s name, age, Portuguese tax number (NIF), and a Salesforce Marketing Cloud contact key.”
Researchers offered several examples in all trackers sending egregious data to advertisers. A Portuguese consumer-credit provider sent Google Analytics a full loan application URL that included significant encoded financial details such as loan amount, term, an indication that insurance was selected, and more.
Depending on circumstance, tracking sometimes began prior to cookie consent being offered, restarted as soon as the user went to a different subdomain than where they started, or operated despite the tracking request noting cookies had been rejected.
Regulatory and Responsibility Implications
The question of who’s responsible is a challenging one to answer. TikTok and Meta have previously noted that advertisers set the parameters for these trackers, and put primary responsibility on the shoulders of the website operator — the banks themselves. Jscrambler disagreed with this framing in the blog post, noting that many of the data controls that allow swaths of data to be forwarded to these tech giants are enabled by default.
“That framing only holds if the collection is something the operator deliberately switched on, and much of what we observed is not. Features such as automatic advanced matching are enabled by default and are designed to capture and hash contact details with no explicit action from the site owner. A bank that drops in a standard pixel does not intentionally configure it to send a customer’s hashed email and phone number from a mortgage page,” the firm said, adding that, “in these situations, default platform behavior becomes a significant factor in what data is collected and transmitted.”
Rather, inappropriate data collection appears to be a shared responsibility across all parties.
And it’s not just an ethical question. The General Data Protection Regulation (GDPR) framework, Europe’s main privacy law, requires that organizations don’t misuse user data. Financial institutions in particular need to adhere to the Digital Operational Resilience Act (DORA), which demands banks, insurers, investment firms, and other such entities make sure their technologies and suppliers don’t create increased risk.
Europe’s ePrivacy Directive regulates digital cookies and tracking tools. These rules have led to the clearest consequences. In 2020, France’s Commission for Digital Freedom fined Google €100 million ($114 million) and Amazon €35 million ($39.9 million) for dropping advertising cookies without clearly explaining their purpose and prior to any consent being given. The commission and other regulating bodies have doled out similar rulings since 2020.
On top of that, the EU’s Payment Services Directive 2 (PSD2) imposes obligations on banks and other financial institutions in regard to secure handling of customer financial information and payment-related data. Everything involving a customer’s financial journey being shared with third parties would be of particular interest. It then becomes paramount that European financial organizations ensure customer data is not being mishandled as described here.
Jscrambler recommends financial institutions monitor runtime behavior, enforce runtime controls, honor consent choice in practice (to not track until consent is obtained, and to honor consent across subdomains), and disable advanced matching and automatic collection where it is not justified.
Gareth Bowker, head of security research at Jscrambler, tells Dark Reading that the issue described in the research is simultaneously a privacy problem, a security problem, and a third-party risk problem, “and that’s exactly why it falls through the cracks,” he adds.
“At its root, it’s a third-party risk problem: code the organization does not write or fully control is executing on its most sensitive pages. It becomes a privacy problem the moment that code sends personal data to platforms the user never agreed to, and a security problem because sensitive values end up in request URLs and third-party systems, and because we also saw invasive device fingerprinting and local-port probing,” he says. “Treat it as only a privacy issue, or only a marketing issue, and it doesn’t get the scrutiny it deserves.”
