You expect a retailer's checkout page to be crawling with trackers. You do not expect it on your bank's mortgage application. A study published July 22 by the security firm Jscrambler found that the same tracking pixels are sitting on banking pages, and behaving exactly the way they do on a shopping cart.
What they found
Jscrambler examined 14 financial-services cases across Europe and the US. At 9 of them, tracking fired without a valid consent choice: before the cookie banner was answered, after the user rejected all cookies, or despite an "essential cookies only" selection.
The data flowed to roughly a dozen third parties, including Google, Meta, TikTok, LinkedIn, Salesforce, and Adobe. Not on marketing pages, but on loan applications, mortgage calculators, and account-opening forms, the pages holding your most sensitive information.
The examples are specific
A Spanish bank, during a mortgage application, sent TikTok the user's hashed email and phone number through a pixel embedded in the page. TikTok was not listed anywhere in the bank's cookie or privacy policy, so a customer reading either would have no idea.
A Portuguese bank sent data that was not hashed at all: during account opening, a pixel transmitted the user's email, then later their name, age, and Portuguese tax number. A consumer-credit provider sent Google Analytics a loan application URL containing the loan amount, the term, and whether insurance was selected.
Why "reject all" often does not work
The banks may not even know it is happening. Jscrambler points to a platform default called "automatic advanced matching," which captures and hashes contact details on its own, with no action from the site owner. Drop in a standard advertising pixel, and it can start forwarding a hashed email from a mortgage page by itself.
That is the important part for you: the cookie banner is a control the bank often is not actually honoring, sometimes because it does not realize the pixel ignores it. Rejecting cookies is worth doing, but it is not a guarantee.
What you can do
Since the site's own consent control can fail, move the defense to your side of the connection, where it does not depend on the bank getting it right.
Use a browser that blocks trackers by default, like Brave, or add uBlock Origin to Firefox.
For whole-network coverage, Pi-hole blocks tracker domains for every device at once.
Still reject non-essential cookies. It works often enough to be worth the two clicks.
None of this is on the customer to fix, and regulators are circling: GDPR, the ePrivacy Directive, and for banks specifically DORA and PSD2 all bear on this. France's regulator has fined Google 100 million euros and Amazon 35 million for dropping ad cookies before consent. But until enforcement catches up, blocking at the browser is the part you control.
Up next · Wednesday
A privacy tool worth setting up, explained plainly.