Can a bank use transaction data for advertising in the EU and UK?

The General Data Protection Regulation (GDPR) looks at each processing purpose and its lawful basis. A payment purpose and a later advertising purpose can raise separate questions. Further use has its own purpose analysis, and any special category requires a condition under Article 9. A direct marketing objection also reaches related profiling. GDPR Articles 5, 6, 9 and 21.

The second Payment Services Directive (PSD2) separately addresses what payment initiation and account information service providers can do with payment data. The European Data Protection Board (EDPB) explains that explicit consent under Article 94(2) of PSD2 is contractual. It differs from the consent basis in the GDPR. {V07a:Directive (EU) 2015/2366, Articles 66, 67 and 94}; EDPB Guidelines 06/2020, §§ 2.4 and 3.2.

The same guidance addresses silent parties whose information appears in transactions. It separately discusses special categories a payment can reveal. A payment description, merchant name or recurring charge can convey facts about another person or imply something about a customer. The labels used in an ad system cannot answer whether the source fields reveal those facts. EDPB Guidelines 06/2020, §§ 4.3 and 5.

In its 2023 Meta Platforms judgment, the Court of Justice addressed combining data from a social network, other services and third-party sites. It considered special categories and legitimate interests on that record. The Court considered expectations and necessity when assessing advertising based on those data. {V07b:Meta Platforms v. Bundeskartellamt, C-252/21, paras. 69–73, 105–126}.

Device access and transfer have separate rules. In the European Union (EU), Article 5(3) of ePrivacy concerns storage or access on terminal equipment. United Kingdom (UK) regulation 6 has its own conditions and exceptions. Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 under the commencement regulations. SI 2026/82, regulation 2(w), (z13). Transfers also have separate Chapter V conditions in each jurisdiction. ePrivacy Article 5(3); UK Privacy and Electronic Communications Regulations, reg. 6; Data (Use and Access) Act 2025, Schedule 12; GDPR Articles 44–49; UK GDPR Chapter V.

Where the readings collide. Transaction-based targeting raises questions about what a bank customer expects and when a category reveals special-category data. Another point is whether consent under one rule changes a limit imposed by the payment-service role. A UK flow can also differ from the same EU flow at the device step.

• Was the data obtained as the account bank, an account information provider or a payment initiation provider?
• Does each use promote the bank’s products or advertising for a third party?
• Which merchant categories, counterparties and inferences appear?
• Does any step read from or store information on a device?
• Which recipients and countries appear in the data map?
• Which choices, objections and notices were recorded?
• Which countries are in scope for delivery?

A payment record can contain the account holder, the other party, an amount and a description. A feature used by an advertiser might be derived from one field or several. The source map can show whether a later audience could have been produced without reading information about the other party.

An account bank may hold a transaction in its own systems while a different service retrieves the same transaction from another institution. The records may look identical, but the roles and route differ. Counsel can use a data lineage entry to connect each feature to the service in which the field originated.

For delivery, the request sent to a browser can differ from an outbound request assembled by a bank server. A trace can help identify a device operation. Records about transfers can then show which foreign recipient saw which fields and in what role. The same transaction category can support more than one purpose. A bank might use a field to show spending patterns in an app and later use it to choose a promotion. A dated purpose map can distinguish those uses and identify which category is used for each. Counsel can then compare the relationship between the original and later purposes.

A bank can also separate the data it stores from the data it sends to an advertising service. The service might receive a broad audience label while the bank holds individual merchant details. The two records can reveal different things and support separate decisions about the recipients and the basis for processing.

1. For each purpose, which lawful basis do we rely on, and where is the assessment?
2. Is any of the data received as an account information or payment initiation provider?
3. How do we keep silent-party data out of advertising uses?
4. Do merchant categories or inferences reveal special-category data, and what follows?
5. Which device operations need consent under ePrivacy or the UK rules?
6. Which transfers leave the European Economic Area or the UK, and under which mechanism?
7. How do UK rules differ for the same campaign after the Data (Use and Access) Act 2025?
8. What changes when the new EU payment services rules apply?

Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.

Download these questions

A bank may value higher use of its own products, third-party media revenue or stronger customer engagement. Transaction features do not have the same value for each goal. Management and counsel can compare which signal supports which use and which change would require a new partner or a different basis.

The channels also have different exit costs. Removing a rule from a banking app can be faster than renegotiating an offsite data arrangement. A decision record can show whether the choice relied on a narrow own-product purpose, on particular data sources or on a particular country.

Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.

The European Parliament lists both parts of the new payment services package as awaiting its second reading as of 10 November 2026. Both procedure files list Council positions published on 5 November 2026 and an indicative second reading on 14 December 2026. PSD3 procedure 2023/0209(COD), key events and forecasts; Payment Services Regulation procedure 2023/0210(COD), key events and forecasts.

The Official Journal published notice of the appeal in Latombe v. Commission, Case C-703/25 P, against the judgment of 3 September 2025 concerning the EU–US Data Privacy Framework. The published appeal notice records the relief sought. {V07d:Official Journal appeal notice, checked 10 November 2026}.

Related references

• ad tech compliance guide
• data sovereignty
• ad tech legal checkpoints index
• counsel briefing kit
• bank media network reference
• advertising consent signals reference
• eu sovereign ad tech stack
• data residency
• uk data use and access act advertising
• legitimate interest
• data privacy framework
• GLBA and advertising reference

1. GDPR Articles 5(1)(b), 6 and 9. Checked 10 November 2026.
2. GDPR Article 21(2)–(3). Checked 10 November 2026.
3. GDPR Recital 47. Checked 10 November 2026.
4. PSD2 Articles 66(3)(g) and 67(2)(f). Checked 10 November 2026.
5. ePrivacy Directive Article 5(3). Checked 10 November 2026.
6. GDPR Articles 44–49. Checked 10 November 2026.
7. UK SI 2026/82, regulation 2(w), (z13), commencement of device changes. Checked 10 November 2026.
8. European Parliament, PSD3 procedure 2023/0209(COD), key events and forecasts. Checked 10 November 2026.
9. European Parliament, Payment Services Regulation procedure 2023/0210(COD), key events and forecasts. Checked 10 November 2026.
10. EDPB Guidelines 06/2020 on PSD2 and GDPR, §§ 2.4, 3.2, 4.3 and 5. Checked 10 November 2026.