Avanza: new pixel features sent bank data beyond the intended marketing scope

IMY’s decision describes unintended activation of Automatic Advanced Matching and Automatic Events. Its record includes financial and identifying values sent to Meta during the period 15 November 2019 to 2 June 2021. IMY decision DI-2021-5544.

The decision describes marketing-cookie consent conditions for the functions. This case is therefore presented as a security and data-scope finding, rather than a finding that the pixel necessarily fired before consent. Authority notice on EDPB.

The original decision imposed SEK 15,000,000. The EDPB notice gives an approximate euro equivalent; this library retains Swedish kronor. Later appeals and payment were not verified. IMY decision DI-2021-5544.

These are implementation checks suggested by Inth, not additional findings about the company.

• Audit pixel-console settings as well as repository code, especially automatic matching and automatic event collection.
• Inspect real payloads from financial forms and authenticated journeys, including hashed values.
• Use a field allow-list and retest whenever the SDK, vendor configuration or page markup changes.

Code audit can trace values into reviewed vendor calls. Website audit can record observable requests from accessible pages and their consent state.

Vendor-console changes may not appear in a pull request. Hashing a value or obtaining a general marketing choice does not by itself establish an appropriate disclosure.

• IMY decision DI-2021-5544
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.