# Can a bank use transaction data for advertising in the EU and UK?

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
| --- | --- | --- | --- |
| A cautious reading | Advertising based on transactions can exceed a customer’s expectations for banking. This reading looks to consent and a separate special-category condition where relevant, and excludes silent-party and restricted payment-service data. | [GDPR Articles 5, 6 and 9](https://eur-lex.europa.eu/eli/reg/2016/679/oj), [EDPB Guidelines 06/2020](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202006_psd2_afterpublicconsultation_en.pdf), and {V07b:C-252/21, paras. 105–126} | The design separates advertising consent and strips data connected with silent parties and sensitive merchant categories. |
| A permissive reading | Limited own-channel marketing of the bank’s products can rely on legitimate interests after assessing the balance and giving effect to objections. This reading distinguishes that use from third-party or device-based advertising. | [GDPR Articles 6(1)(f), 21 and Recital 47](https://eur-lex.europa.eu/eli/reg/2016/679/oj) and the specific processing facts | The design keeps own-channel signals limited and separates any shared data or device operations. |

**Where the readings collide.** Transaction-based targeting raises questions about what a bank customer expects and when a category reveals special-category data. Another point is whether consent under one rule changes a limit imposed by the payment-service role. A UK flow can also differ from the same EU flow at the device step.

## Questions to take to your counsel

1. For each purpose, which lawful basis do we rely on, and where is the assessment?
2. Is any of the data received as an account information or payment initiation provider?
3. How do we keep silent-party data out of advertising uses?
4. Do merchant categories or inferences reveal special-category data, and what follows?
5. Which device operations need consent under ePrivacy or the UK rules?
6. Which transfers leave the European Economic Area or the UK, and under which mechanism?
7. How do UK rules differ for the same campaign after the Data (Use and Access) Act 2025?
8. What changes when the new EU payment services rules apply?

[Read the full checkpoint](https://adsovereign.com/blog/bank-transaction-data-advertising-gdpr-psd2) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)