GDPR limits what a tracking pixel sends from your app, even with cookie consent

Workers on Outlier, the web app where Scale AI's freelancers train AI models, recorded what their browser sent while they worked. According to a report by DiPLab, a research group on platform work, LinkedIn was told when they clicked "Start task", Meta received the project and hourly rate attached to a task, and a survey tool received their names, phone numbers and pay rates. The privacy group noyb filed five GDPR complaints on 27 October 2026, and Scale AI told The Register the report's claims are "unfounded and inaccurate" and that its practices require contributors' consent. EU law asks two things of every script like these: the user's consent before it runs, unless the app cannot work without it (the joint reading of the EU's data protection regulators, though some apply it more narrowly at home), and, consent or not, that what it sends is limited to what is necessary and kept secure.

The tools on the Outlier list include Segment, PostHog, Fullstory, Sentry, Google Analytics, LinkedIn, Meta and TikTok, all mainstream products sold to software teams, so the same recording on your own product may show the same thing. One fine shows what that can cost: Sweden fined Avanza Bank 15 million kronor over account data its Meta pixel sent from logged-in pages, through pixel features the bank had switched on by mistake. If you sell to businesses there is a contract risk too: a session recorder that captures your customers' data without being on your sub-processor list puts you outside the agreement you signed with each of them.

I do not read the complaint as a verdict on Scale AI, and as of 3 November 2026 no regulator has ruled. What I find useful is the method: the workers recorded what their browser sent while they did their job, and anyone can do the same on their own product.

Does a script inside a logged-in product need consent?

Yes, with one narrow exception. Article 5(3) of the ePrivacy Directive, the EU rule behind every cookie banner, allows storing information on a user's device, or reading information already there, only with the user's consent. The exception covers storage or access "strictly necessary" for a service the user explicitly asked for 1.

This covers scripts that set no cookies at all. The European Data Protection Board, where the EU's data protection regulators agree on how to read the law, says that loading a tracking pixel and running the JavaScript that sends its request both fall under Article 5(3) 2.

The exception does not stretch to advertising. A user who logs in to do their work has asked for the product, and the product works the same with the LinkedIn tag removed. My rule of thumb is a removal test: if nothing breaks when you remove the script, it needs consent. Product analytics usually needs consent by that test, though some countries allow audience measurement without it under strict conditions, which I went through in the post on analytics consent. Error monitoring such as Sentry is the arguable case, and regulators judge it country by country.

What did Sweden fine Avanza for?

For failing to keep its customers' data secure. Sweden's data protection authority, IMY, decided the case in June 2024 3.

Avanza had put Meta's pixel on parts of its website and app, including pages only logged-in customers could see, to improve its advertising on Facebook. Two optional pixel features were then switched on by mistake. The bank said it had never decided to use them, and it could not establish how or by whom they were activated:

• Automatic Advanced Matching sent scrambled (hashed) copies of what people typed into five forms, including personal identity numbers, loan amounts and account numbers, in a form Meta can match against its own records.
• Automatic Events tried to detect button presses on its own. Avanza's pages used button-like elements to expand panels with account details, so when customers tapped them, Meta's script sent the contents in plain text: holdings, loan amounts, credit limits and account numbers.

Data on 500,000 to 1 million people, mostly logged-in customers, went to Meta between 15 November 2019 and 2 June 2021, and the bank learned of it from an outside source. The bank told IMY the features only ran for people who had accepted its marketing cookies. IMY's reasoning does not turn on it. IMY treated the pixel's data flow as outside Sweden's cookie rule (a narrower reading than the EDPB's), judged only what left and whether the bank had protected it, and fined Avanza 15 million kronor under the GDPR's security rules, Articles 5(1)(f) and 32(1) 3 4. The bank's review process only caught changes that went through that process. These features were switched on outside it, and IMY said regular checks would have caught them 3.

Two more GDPR rules apply to any company sending data through a pixel. Personal data must be "adequate, relevant and limited to what is necessary" for its purpose 4, and a Facebook ad campaign does not need a credit limit. Where consent is the legal basis for sending it, the consent must be "specific" and "informed" 4. A click on "accept marketing cookies" is, in my reading, a thin basis for sending a customer's account details to an ad network.

What can a script see after login that it cannot see on a marketing site?

It sees the data the product exists to handle. On a marketing site a pixel sees which pages a visitor read. Inside the product it sees what the person does at work, and in a business product much of that belongs to your customer:

• URLs and page titles often carry project names, customer IDs, invoice numbers or search terms, and ad pixels and analytics tools typically send the current page address with every event.
• Automatic capture of clicks and button text, the feature that caught Avanza, records whatever text the element shows. Many analytics and ad tools offer it.
• Session recording captures the screen itself, including names, emails and figures that belong to your customers' own users, unless masking is set up for each field. On Outlier, Fullstory recorded each worker action so it could be replayed as video.
• Identify calls often pass the full user record to the analytics tool: name, email, plan, company.

If you sell to businesses, this runs into your contract with each customer. You handle their users' data as their processor, and GDPR Article 28(2) says a processor "shall not engage another processor" without the customer's written authorisation 4, which in practice is the sub-processor list in your DPA. (Who counts as a processor is in the post on which vendors need a DPA.) A session recorder that captures your customers' records is one of those processors, and if it is not on the list, you are outside the contract. Adding one under a general authorisation means telling customers in advance and giving them a chance to object 4, as covered in the post on sub-processor changes.

An ad network receiving that data is worse. A processor may process the customer's data only on the customer's instructions (GDPR Article 29), and advertising your own product is not one of them. Under Article 28(10), a processor that breaks the GDPR by deciding the purposes and means of processing is treated as a controller for it, which adds a controller's duties on top of the breach 4.

What should you check in your own app?

If your product has a logged-in app, you need to know what each third-party script sends from inside it and keep ad pixels out of it, or you risk Avanza's position: a fine for data nobody decided to send. This is the order I would work in:

1. Record what leaves the browser. Log in as a test user, open the developer tools, and use the product with the Network tab open. Save it as a HAR file (a recording of that traffic), as the Outlier workers did. List every domain that is not yours.
2. Take ad pixels off logged-in pages. If they load from a tag manager, limit them to marketing pages there, and check that a sign-up conversion still fires where you need it.
3. Read the payload of each remaining script. Look for URLs with IDs in them, captured button text, and identify calls sending more than an ID. Turn off automatic capture, and set up masking in any session recorder.
4. Ask for consent inside the app. Scripts the product works without should wait for consent after login too. If the app runs on its own subdomain, check whether your consent tool carries the choice over from the marketing site; if it does not, the app has to ask.
5. Match the list against your documents. Every remaining recipient should appear in your privacy policy and, where it touches customer data, on your sub-processor list.
6. Check again on a schedule. Avanza's features were switched on without any change the bank's own review saw. After the leak, the bank wrote a process for adding third-party scripts and moved them onto its own servers, so a vendor could not change them unnoticed 3. A change made in a tag manager or a vendor's dashboard never reaches your code, so this check has to run on a calendar.

Changes that do go through your code are the other half. Lawcel, the compliance tool we build, reads pull requests and points out when one adds a script or vendor that needs an edit to your privacy policy.