Your Bank May Be Sending Your Loan Details to TikTok Without Knowing It

Key points

• Jscrambler documented 14 financial services cases in Europe and the US where customer data leaked through third-party tracking tools embedded in bank websites.
• Tracking fired without a valid consent choice at nine separate companies, either before the cookie banner appeared, after users rejected tracking, or despite an 'essential cookies only' selection.
• A Spanish bank sent hashed customer email addresses and phone numbers to TikTok during a mortgage application, despite TikTok appearing nowhere in the bank's privacy policy.
• A Portuguese bank transmitted a customer's name, Portuguese tax identification number, age, and a Salesforce contact key during an account-opening process, all in plain text.
• Several tracking requests began before any consent was offered, or restarted automatically when a user moved to a different section of the bank's website.

Your bank's website almost certainly contains code it didn't write. Tiny invisible programs called tracking pixels, small pieces of code that advertising platforms use to record what you look at and do online, are standard furniture on most commercial websites. On a retailer's homepage, that's mildly irritating. Embedded in a mortgage application form, it's something else entirely.

Security firm Jscrambler published research this week showing that banking websites in Europe and the US are firing these trackers in ways that send genuinely sensitive customer data to companies including Google, Meta, TikTok, LinkedIn, Salesforce, Adobe, and others. The research, first flagged by Dark Reading, covered 14 financial services cases. We first reported on pixel trackers harvesting sensitive user data on 4 July, when Australian health websites were caught feeding patients' fertility searches to Meta and TikTok; this Jscrambler report shows the same behaviour has now been documented inside European banking.

How did customers' private details end up with advertisers?

Default settings are the short answer. When a bank drops a standard advertising pixel onto its website, that pixel often comes pre-configured to grab and transmit whatever personal data it can find. The bank's web team may never have switched that feature on deliberately. It was simply on.

Jscrambler watched one Spanish bank run a standard cookie-consent banner during a mortgage application. The user accepted. TikTok's pixel then collected the user's hashed email address and phone number, where "hashed" means the data was scrambled with a mathematical formula rather than stored as plain text. Scrambling isn't the same as encryption; with enough data and the right tools, hashed values can sometimes be matched back to real people. TikTok doesn't appear anywhere in that bank's privacy policy, so the customer had no way to know.

A Portuguese bank skipped even the hashing step. During an account-opening flow, a tracker sent a customer's email address, name, age, and Portuguese tax identification number to Salesforce in plain, readable text inside a web request.

A separate Portuguese credit provider sent Google Analytics a full web address from a loan application page. That address contained the loan amount, repayment term, and a flag that insurance had been selected.

Should someone be held responsible?

TikTok and Meta have previously said advertisers control how the pixels are configured, placing primary responsibility on the banks themselves. Jscrambler pushes back, pointing out that features such as automatic advanced matching are switched on by default, meaning a bank that simply copies the standard pixel code is inadvertently collecting far more than it intended. Jscrambler calls it a shared responsibility across all parties.

For customers in Europe, several laws are directly relevant. The General Data Protection Regulation, Europe's main privacy law, requires careful handling of personal data. The ePrivacy Directive covers cookies specifically, and France already fined Google 100 million euros and Amazon 35 million euros in 2020 for dropping advertising cookies without clear explanation or consent. Banks also face obligations under the EU's Digital Operational Resilience Act, which requires financial institutions to ensure their technology suppliers don't create additional risk.

If you've recently applied for a loan or used an online mortgage calculator at a European or US bank, your details may have reached advertising platforms without your knowledge. There's no simple fix on your end, but sharing only what a form strictly requires is a reasonable precaution.

Jscrambler recommends banks audit what third-party code runs on their most sensitive pages, enforce consent rules across every subdomain, and disable automatic data-collection features they haven't explicitly approved.