Hmm, that feels incident worthy.

My bank should send precisely zero things to advertising / marketing companies.

Have you raised it with their Help team? You should.

Unfortunately I cannot as I do not have a facebook account so cannot determine whether or not facebook hold data on me without creating an account.

You might (justifiably) not like it, and it might inspire you to boycott the business or plead for regulatory relief, but it's not an "incident" from their perspective to be intentionally doing what they do to run their business.

This is a bank, and they are regulated. Depending on the information shared, this may be a breach of that regulatory code.

I do not have access to see what the data is, but would certainly in their shoes investigate with high priority, and Would raise a security incident to do so. If it turns out to be empty and of no concern, then great. But ignoring such things is seldom wise.

Might be worth a post on their community.

What do you mean by community? Like a Facebook community? Do you need an account to post on the facebook community?

They have a Discourse forum: https://community.monzo.com

Not really.

They have the Facebook Pixel installed likely to do retargeting advertising when a person visits their website.

It's one of the most effective methods so it's very common to see it everywhere.

This is related to their app not their website.

Same applies to their app.

Doing retargeting for when (a) someone downloads their app but doesn't signup and (b) someone is a customer but has low engagement i.e. is likely to churn.

That may be true, but I still think it's a low-effort way for them to do it, and I expect better from Monzo than this. Plus it tracks people regardless of if they fit in a) or b) - neither of which is the case for me.

Could you say more or provide a screenshot? I’m very curious and concerned about this.

For Revolut, I have many many entries like:

ID 894103617218109 Event CUSTOM Received on 13 November 2019 at 09:51

The only event is "CUSTOM".

I use Revolut but my page is empty. I imagine it's because I don't have the Facebook nor Messenger apps installed on my phone.

Same here. I suspect most of the commenters on this post that are confused about how their data got acquired have the FB app and/or Messenger installed on their phones.

I also suspect that soon Whatsapp will be doing the same sinister activity tracking once they go ahead with their plan to introduce ads later this year.

It just says <number> interactions were received from Monzo.

Relevant but not exhaustive:

https://monzo.com/help/legal-stuff/information-facebook

I have Monzo in my list too and downloaded the actual data. The only things listed are `ACTIVATE_APP` events. It doesn't seem to send any details to Facebook aside, from that you "activated" (opened) the app.

Still not ideal, but not completely terrible.

When I used to have https://lua.xprivacy.eu/ it used to prompt me a lot, saying "This app is calling this API, do you want to allow or deny? (or allow/deny for 1 minute or 10 minutes). The Facebook app would query what packages/apps are installed on the Android phone.

Yeah, Android devs, why is that an accessible API call?

For one thing this is how FB could figure out how popular their competitors like WhatsApp, Instagram or Snapchat were, and why they bought them, or tried to.

It's part of the Intent system in Android. It's a really nice system where you can say "someone open the file with this URL and mime type" and the system asks the user which app they want to use to open it (or use their default if they set one.

It all works really well and lets app be loosely coupled to each other. It's also super flexible so you can use it for lots of different use cases. The API itself hasn't changed much since the first release of Android.

The issue is that you can query the Intent system to see if there is an app installed that can open your Intent. On the face of it, this makes a lot of sense. You could then display an error message to the user asking them to install and app that can handle it. The problem is that you can create an Intent that you know can only be handled by a single app (using the package name) and then you'll know if it's installed or not.

For what it's worth, iOS used to have exactly the same issue. You could query the phone could handle a specific "custom protocol scheme" (used for deep linking). You could then just query a scheme which you know is for a specific app and tell if the user had it installed. Apple fixed this by requireing you to include a predefined list of schemes which you can query for in your Info.plist (manifest file) and limiting the number you can have (30 I believe).

All APIs with good intentions, but very easy to abuse. Apple is just more comfortable breaking backward compatibility to fix these sorts of issues.

As far as I can tell almost every bank with an app is sending your email/advertising id/name/etc. to Facebook(+ other surveillance companies).

I have a couple of other bank accounts and none of the others seem to be sending data to Facebook.

I saw HSBC

I didn't see HSBC, but I did see Monzo - which I was surprised and disappointed by. I see no legitimate reason for them to be connecting me to my (disused aside from messenger because of friends' network effects) facebook account. Not impressed.