FinTech Privacy: PSD2, Open Banking & GDPR
Date: April 18, 2026 Author: GetCookies Team Category: Industry Guide Reading Time: 15 min
Money requires trust. In FinTech, trust is built on data security.
The intersection of PSD2 (Payment Services Directive 2), Open Banking, and GDPR creates a complex web of obligations for modern financial apps. You must open your data APIs (PSD2) while locking down user privacy (GDPR).
The Conflict: Access vs. Privacy
- PSD2 says: "You must share customer data with Third Party Providers (TPPs) if the customer asks."
- GDPR says: "You must ensure data is secure and minimized."
The Solution: Strong Customer Authentication (SCA) and explicit consent management.
Cookie Consent in FinTech
Financial sites have a unique category of cookies: Fraud Prevention.
- Essential Cookies: Cookies used to detect botnets, fingerprint devices for security, or maintain secure sessions are "Strictly Necessary."
- Consent: You do not need user consent for fraud prevention cookies (Recital 29 of GDPR).
- Implementation: Configure GetCookies to classify your fraud tools (e.g., Sift, Seon) as "Essential." Do not let users toggle them off.
Marketing in Banking
While fraud cookies are essential, retargeting pixels are not. The Risk: Using transaction data for marketing.
- If a user pays for a subscription to a cancer support group via your banking app, you cannot use that data to target them with life insurance ads unless you have explicit, specific consent for that processing.
Data Localization (GLBA / SOX / GDPR)
FinTechs often face strict data residency rules.
- US: GLBA requires safeguarding financial info.
- EU: GDPR + Local banking secrecy laws (e.g., Swiss Banking Secrecy).
- Strategy: Ensure your CMP and analytics stack supports Data Residency. Do not send German banking logs to a US analytics server.
Checklist for FinTech CPOs
- Audit Essential Cookies: Verify that cookies marked "Essential" are actually for security/auth, not analytics.
- Consent Receipt: Log every consent event with a timestamp and IP. In finance, you need an audit trail for everything.
- Vendor Risk: Your marketing team wants to add a new "Growth Hack" tool. Vetting it is your job. If it scrapes screen data (session replay), it might capture IBANs. Block it.
Conclusion
FinTech privacy is high-stakes. A breach isn't just embarrassing; it's expensive and regulated. Use your CMP as a gatekeeper to ensure only approved, compliant vendors ever touch your user's browser.