Analysis Shows Financial Institutions Are Sending Sensitive Customer Data to Google, Meta, TikTok, LinkedIn, and Salesforce Without Valid Consent

PORTO, Portugal, July 22, 2026 /PRNewswire/ -- New research from Jscrambler reveals that banking websites are transmitting sensitive customer information, including hashed identifiers, loan details, and financial intent signals, to third-party advertising, analytics, and personalization platforms. The analysis of 14 financial institutions, spanning retail and investment banks, payment providers, and consumer credit platforms, found that this data routinely leaves the site before a cookie consent choice is made and, in some cases, even after users explicitly reject tracking.

Key Highlights:

• Across 14 financial services websites in Europe and the US, tracking technologies fired without valid user consent on 9 sites, sending data to at least a dozen third parties, including Google, Meta, TikTok, LinkedIn, Pinterest, Adobe, and Salesforce.
• Hashed and unhashed emails, phone numbers, and government tax IDs sent from account-opening and mortgage flows, plus precise loan details — including a €27,000 loan simulation with full repayment terms — from credit and loan-simulator flows.
• Tracking often continued after users rejected cookies, and consent choices frequently didn't carry over into iframes and subdomains handling the same transaction.

As financial institutions accelerate digital banking, personalization, and embedded financial services, more critical customer interactions are moving into the browser, creating new exposure points beyond traditional application security controls.

While banks present themselves as among the most careful custodians of personal and financial data, Jscrambler's research shows that the public-facing reality often does not match this. The report found that some of the most regulated and sensitive pages on the web—mortgage applications, account openings, credit simulators—have tracking and personalization scripts that collect and transmit data far beyond what ordinary financial customer-journey measurement requires.

Incidents identified by the research include:

• A Spanish bank's mortgage process sent a customer's hashed email and phone number to TikTok's pixel endpoint immediately after cookie acceptance, despite TikTok appearing in neither the bank's cookie policy nor its privacy policy.
• In a Portuguese bank's account-opening flow, a customer's email address was sent to a Salesforce marketing platform alongside the customer's name, age, and national tax number (NIF), without valid consent.
• A credit and loan simulator at two other Portuguese institutions shared the full details of a customer's loan request, including exact amounts, terms, interest rates, and total cost of credit, with Google Analytics. This created a continuous stream of borrowing-intent signals that flowed into a third-party advertising ecosystem used across industries.
• The analysis uncovered examples of leading U.S. banking and investment websites sending analytics requests to third parties before visitors had the opportunity to provide consent, highlighting how browser-side technologies can bypass intended privacy controls.

The research also documented three distinct consent failures with tags firing before a cookie banner was actioned, tags that continued firing after a user selected "reject all," and consent choices that were correctly recorded on a bank's main site but not carried into iframes or subdomains handling the next step of the same transaction. In one instance, LinkedIn logged a user's click on the "reject all" button as a tracking event in the same moment the rejection was being ignored.

"Banks have spent years hardening their perimeter, but critical customer journeys like account opening, lending, and personalization increasingly run through third-party scripts they don't fully control," said Gareth Bowker, Head of Security Research, Jscrambler. "You can outsource the function, but you can't outsource the risk. Our research shows this is not a handful of isolated misconfigurations. It's a pattern that's consistent across countries and institutions, where sensitive financial data leaves the browser through technologies many organizations do not fully understand or govern."

The findings raise significant compliance considerations under GDPR and the ePrivacy Directive's prior-consent requirements, the EU's DORA framework governing third-party risk in financial services, the incoming Payment Services Regulation, and US directives, including the Gramm-Leach-Bliley Act, CCPA, and CPRA. Jscrambler notes that responsibility is shared between institutions that don't audit the runtime behavior of the scripts they deploy, and ad-tech platforms whose default configurations, such as automatic advanced matching, capture and transmit contact data with no explicit action required from the site owner.

Jscrambler recommends that financial institutions do the following:

• Move beyond point-in-time vendor review and static tag audits toward continuous runtime monitoring of account-opening, lending, and simulation flows.
• Deploy enforcement controls that block unauthorized data exfiltration, including data placed in request URLs.
• Verify that rejected consent actually stops data collection rather than merely logging a denied signal.
• Use consent enforcement that extends across iframes and subdomains rather than breaking at the site boundary.

The full research report, Beyond the Vault: What Banking Sites Quietly Share Before You Ever Log In, is available here. 

In addition to the report, Jscrambler will host a webinar to examine the research findings, including real-world examples of sensitive financial data exposure, consent failures, competitive intelligence risks, and the runtime controls that financial institutions need to regain visibility and control over browser activity.

Webinar Details:
Date/Time: August 20, 2026, at 10 AM EST
Participants: Gareth Bowker, Head of Security Research; Nathan Coppinger, Product Marketing Manager; David Alves, Security Analyst.
Registration: Available here.

About Jscrambler
Jscrambler is the Client-Side Security Platform for the modern enterprise. The first vendor to unify software integrity and data governance at browser runtime, Jscrambler's Behavioral Enforcement Core gives AppSec and data governance teams a single control plane to protect, enforce, and ensure compliance — from a single deployment. Built on 15 years of browser runtime expertise and proprietary research, Jscrambler serves Fortune 500 companies, financial institutions, airlines, online retailers, and media organizations whose success depends on what happens in the browser. Learn more at jscrambler.com.

Media contact
Doug Fraim
Guyer Group for Jscrambler
[email protected]