[Enforcement library](/enforcement)

# Avanza: new pixel features sent bank data beyond the intended marketing scope

IMY fined Avanza SEK 15 million after unintended Meta Pixel functions transferred financial and identifying data.

## Key facts

- **Regulator or court:** Swedish Authority for Privacy Protection (IMY)
- **Jurisdiction:** Sweden
- **Framework:** GDPR Articles 5(1)(f) and 32(1)
- **Record date:** 2024-06-24
- **Procedural status:** Administrative decision DI-2021-5544; later appeal status not established

IMY fined Avanza SEK 15 million after unintended Meta Pixel functions transferred financial and identifying data.

Swedish Authority for Privacy Protection (IMY) · GDPR Articles 5(1)(f) and 32(1) · Decision: 24 June 2024

## The problem

Consent to marketing cookies does not define which fields an automatic matching or event feature is allowed to extract.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Swedish Authority for Privacy Protection (IMY) |
| Jurisdiction | Sweden |
| Law | GDPR Articles 5(1)(f) and 32(1) |
| Decision date | 24 June 2024 |
| Recorded fine | SEK 15,000,000 |
| Procedural status | Administrative decision DI-2021-5544; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [IMY decision DI-2021-5544](https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-avanza.pdf).

## What the authority found

IMY's decision describes unintended activation of Automatic Advanced Matching and Automatic Events. Its record includes financial and identifying values sent to Meta during the period 15 November 2019 to 2 June 2021. [IMY decision DI-2021-5544](https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-avanza.pdf).

The decision describes marketing-cookie consent conditions for the functions. This case is therefore presented as a security and data-scope finding, rather than a finding that the pixel necessarily fired before consent. [Authority notice on EDPB](https://www.edpb.europa.eu/news/swedish-sa-administrative-fine-against-bank-for-transferring-customer-data-to-meta_en).

## Outcome and limits

The original decision imposed SEK 15,000,000. The EDPB notice gives an approximate euro equivalent; this library retains Swedish kronor. Later appeals and payment were not verified. [IMY decision DI-2021-5544](https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-avanza.pdf).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Audit pixel-console settings as well as repository code, especially automatic matching and automatic event collection.
- Inspect real payloads from financial forms and authenticated journeys, including hashed values.
- Use a field allow-list and retest whenever the SDK, vendor configuration or page markup changes.

## How Inth helps

Code audit can trace values into reviewed vendor calls. Website audit can record observable requests from accessible pages and their consent state.

Vendor-console changes may not appear in a pull request. Hashing a value or obtaining a general marketing choice does not by itself establish an appropriate disclosure.

## Sources and limits

- [IMY decision DI-2021-5544](https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-avanza.pdf)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/swedish-sa-administrative-fine-against-bank-for-transferring-customer-data-to-meta_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.