The Markup, now a part of CalMatters, uses investigative reporting, data analysis, and software engineering to challenge technology to serve the public good. Sign up for Klaxon, a newsletter that delivers our stories and tools directly to your inbox. The Markup, now a part of CalMatters, uses investigative reporting, data analysis, and software engineering to challenge technology to serve the public good. Sign up for Klaxon, a newsletter that delivers our stories and tools directly to your inbox. Klaxon When someone applies for a mortgage, they trust a home loan lender or mortgage broker with some of the most sensitive information they have: information about their credit, their home, and the personal details of their lives. Unbeknownst to those prospective homeowners, they may also be sharing that information with Facebook. The Markup tested more than 700 websites that offer loans for people looking to purchase or refinance a home, from major online brokers to lesser-known regional lenders, and found that more than 200 of them share some amount of user data with Facebook. On their sites, these companies embedded the Meta Pixel, a small piece of tracking software that shares visitors’ information with Facebook. As users filled out mortgage applications or requested quotes for mortgage rates, the pixel tracked information about their credit, veteran status, occupation, the specific homes they wanted, and more. Experts told The Markup that it might be against the law for mortgage lenders to feed this kind of information to Facebook. tested What Have Mortgage Brokers Shared with Facebook? The Markup found mortgage brokers sent Facebook a range of different data points about visitors, including: Estimated credit
Veteran status
Occupation
Co-borrowers’ names
Bankruptcy status
Homeownership status
Citizenship status
Interest in specific homes
The addresses of those homes Estimated credit Veteran status Occupation Co-borrowers’ names Bankruptcy status Homeownership status Citizenship status Interest in specific homes The addresses of those homes The Fairway Independent Mortgage Corporation, for example, offers mortgage options across the U.S. and says it funds more than $70 billion in transactions per year, making it among the largest lenders in the country. The Markup found the company’s website using the Meta Pixel to track detailed information about visitors, including every button they clicked on a preapproval page, and the type of home that visitors were interested in. The site even tracked responses to a question about visitors’ estimated credit, asking visitors to select a numbered band from “Poor,” or less than 580, to “Excellent,” or more than 740. Clicking “I Decline” to the site’s cookie notice didn’t stop the pixel from tracking. The Fairway Independent Mortgage Corporation across the U.S. funds more than $70 billion largest lenders in the country The pixel also sent Facebook a scrambled version of a visitor’s name and email address. Meta says these “hashed” email addresses “help protect user privacy.” But it’s simple to determine the pre-obfuscated version of the data—and Meta explicitly uses the hashed information to link other pixel data to Facebook and Instagram profiles. help protect user privacy it’s simple explicitly uses Kirby Bradley, the chief content officer for Fairway Mortgage, said in an emailed response to questions from The Markup that the company has stopped using the pixel. She said the credit estimates shared with Facebook were not scores but rather “categories made up completely by the respondent based on nothing but their feeling at the time.” Bradley told The Markup that Fairway did not collect or transmit personally identifiable information during the time the pixel was in use but declined to detail how the company defines such information. LendingTree lets users compare loan offers from different companies. Its website sent data to Facebook through the Meta Pixel when we filled out its mortgage search form. The data included a unique ID, as well as information on co-borrowers, bankruptcy, homeownership, and military history. LendingTree Veterans United Home Loans, which offers loans backed by the U.S. Department of Veterans Affairs, used the Meta Pixel for its online loan calculator, telling Facebook whether visitors are homeowners and even what branch of the military they served in. The company’s site also tracked personal information, including full name and phone number, but those fields show up blank when the data goes to Facebook. It is not clear whether this is intentional, and the company did not respond to a request for comment from The Markup. its online loan calculator Doorway Home Loans, a Texas-based lender that offers services across the country, tracked button clicks throughout its online application process, which includes questions about citizenship and whether applicants own a home. Facebook did not receive explicit application responses, but it did receive information about which buttons applicants pressed, making it easy to infer their selections. offers services ZeroDown is not itself a lender but a startup that offers to buy a home on customers’ behalf through its rent-to-own program. The site sent the exact address of homes that users viewed to Facebook, attached to a unique URL, and told the social platform how far down they scrolled through individual pages. It also sent financial information including offers or what mortgage payments the potential customer could afford. If someone used the site’s chatbot for information or sent a message about a listing, the full text of their conversation was even sent to Facebook. that offers to buy a home Local mortgage lenders used the pixel, too. Indiana-based Ruoff Mortgage logged hashed email addresses and names in an application, sending them along to Facebook. The company’s site also tracked users’ responses to questions about their veteran status and dependents and logged the value of property that visitors currently own. The Arkansas Federal Credit Union’s website sent Facebook the emails and phone numbers of visitors through the pixel, along with the fact that visitors were interested in a loan. Ruoff Mortgage A spokesperson for Meta, Emil Vazquez, said in an emailed statement that the company’s system uses automated tools to filter out “potentially sensitive data it is able to detect.” “Advertisers should not send sensitive information about people through our Business Tools. Doing so is against our policies and we educate advertisers on properly setting up Business Tools to prevent this from occurring,” the spokesperson said. LendingTree, Veterans United, Doorway, and ZeroDown did not respond to requests for comment. Neither did Ruoff Mortgage nor the Arkansas Federal Credit Union. Many large lenders didn’t transfer especially sensitive data through the pixel. Rocket Mortgage, the largest mortgage lender in the U.S., for example, used the tool to track where people navigated on an application but did not share any personal information they entered on forms. Possible FTC Penalties The online mortgage industry is valued at tens of billions of dollars globally, and it’s on track to keep taking up a greater share of the market for home loans. Digital mortgage companies offer a simple way to apply for a loan, enticing potential borrowers with simple forms and faster processing times for applications. But those businesses are also beholden to strict rules under the law about handling consumers’ financial information and could be penalized by the Federal Trade Commission for violating those rules. valued at tens of billions of dollars globally keep taking up a greater share of the market faster processing times The FTC and Consumer Financial Protection Bureau have the power to police financial data under the Gramm–Leach–Bliley Act. The legislation is meant to secure users’ private financial information; while it applies to businesses like banks, it also covers several “non-banking financial institutions” that handle consumers’ financial data. Among the types of businesses that the FTC says are covered by the law are payday lenders, car dealerships—and mortgage brokers. the FTC says Those types of businesses are required to take specific steps to keep unauthorized users from accessing financial data. If a breach does happen, those businesses must inform the FTC promptly, or face potential fines. The businesses must also clearly inform customers about how their information is shared, and give them a chance to opt out, or risk a crackdown from regulators. Representatives for the FTC and the CFPB declined to comment. Natalie Loebner, a consultant and former Justice Department trial attorney who has litigated financial cases, told The Markup in an interview that mortgage companies using the pixel to share sensitive information with Facebook could violate the Gramm–Leach–Bliley Act or other regulations. Loebner said it could also lead to scrutiny from regulators if the mortgage brokers failed to properly disclose how they used customer information. In its testing of sites, The Markup did not agree to data-sharing terms beyond generic cookie disclosures. While this type of disclosure could be allowed in certain limited circumstances, Loebner said that The Markup’s reporting on the Meta Pixel suggested that regulators might want to examine how mortgage companies are also using the tool. “I think that there’s a level of sloppiness that you’ve identified in some of the other [Markup] reporting that may give rise to concern by the FTC that it’s something they should explore more closely,” she said. Hunting the Meta Pixel To investigate how mortgage companies use the pixel, The Markup relied on two organizations, Home Lending Pal and the Mortgage Research Center, that maintain lists of home lenders, banks, and mortgage brokers that are registered in the national database of mortgage lenders. We also added a few other well-known online lenders, like Rocket Mortgage, to the list. Home Lending Pal Mortgage Research Center the national database Using an automated script on Google to find each mortgage company’s associated websites, we developed a list of more than 700 domains to check. Then we ran those websites through Blacklight, a tool developed by The Markup that scans sites for tracking technology, to see which ones used the Meta Pixel. We then found the associated website for each of those domains, ending up with a list of more than 200 that were using the pixel. Blacklight more than 200 The Meta Pixel is a small piece of code that quietly underpins the business of advertising on the internet. As web users click, search, browse, and shop, they’ll almost undoubtedly run into one of the millions of pages across the internet that use the code to track customers. The idea behind the code, which Meta makes freely available, is that businesses can better target future customers by gathering information on them. If a person visits a website looking for a bathing suit, for example, the pixel can track that interaction. The owner of the website can then go to Facebook and pay to advertise on the platform to everyone who viewed that bathing suit. Maybe the business will try to show them other bathing suits on Facebook or entice them into considering a matching pair of sunglasses. The majority of the mortgage company sites we examined didn’t track users in an especially troubling way. Many used the pixel only on their homepages, for example, and sent users to a separate page without pixels to apply for a loan. Dozens of other sites we examined had informed Facebook that a visitor had viewed a certain page but they didn’t log any information the person entered on applications. This was the case for some companies, like the widely used Credit Karma. Several other sites we examined, like LendingTree and ZeroDown, used the pixel in slightly more invasive ways. Only a handful of sites tracked detailed personal and financial information. Alicia Solow-Niederman, an associate professor of law at George Washington University, said that the data sharing found by The Markup is “at a minimum” legally dubious. “It certainly does not comport with what I think are reasonable consumer expectations when I tell a site my sensitive financial information,” she said. Businesses pay Meta for the advertisements that follow users across the internet, giving companies a chance to reach more customers. Meta also reserves the right in its business tools terms of service to use the data it collects to power its advertising algorithms, which rely on massive amounts of information to build profiles on people. Facebook can then use that information to more effectively target its ads. Facebook may gather this information whether or not a person has an account on the platform. business tools terms of service It’s not entirely clear where this information winds up—one leak from company engineers suggested even Facebook itself can’t say for certain where the data it collects goes. The engineers wrote in a document obtained by Vice’s Motherboard in 2022 that they “do not have an adequate level of control and explainability over how our systems use data.” Sensitive data like this may be powering Facebook’s systems without humans being aware of it at all. (A spokesperson told Motherboard that the document did not accurately describe how the company handles and protects personal data.) a document obtained by Vice’s Motherboard in 2022 To better understand how pervasive the pixel is, The Markup launched the Pixel Hunt in 2022, a series of investigations dedicated to uncovering the surprising and concerning information harvested by pixels. launched the Pixel Hunt in 2022 Since launch, the series has uncovered several instances of pixels gathering sensitive data. Among other places, we uncovered pixels on sites for federal student aid, hospitals, and suicide prevention organizations. The revelations have led to private litigation and calls from lawmakers for action. sites for federal student aid private litigation calls from lawmakers In November 2022, we found that major tax preparation services, including H&R Block and TaxAct, told Facebook about users who were filling out their taxes. The companies sent the tech giant information on filers’ income and dependents, among other data. we found The tax prep companies have faced lawsuits and regulatory scrutiny in response, and the FTC warned the businesses directly that they might be penalized if they kept doing it. In letters to the companies The Markup investigated, the FTC said it considered it “an unfair or deceptive act or practice to use tracking technologies such as pixels” in some contexts without informed user consent. The warnings said businesses could face penalties of more than $50,000 for violations. lawsuits regulatory scrutiny letters to the companies Despite the repeated incidents, Meta has said that it doesn’t want companies that use the pixel to send sensitive financial information, like income and credit scores. The tech company has pointed out that businesses using its tools must agree through its terms of service not to send such information. Facebook also says it uses automated tools to attempt to block sensitive information from being sent, but it’s not clear in any case whether that’s happened. sensitive financial information In practice, despite the terms of use, businesses send this sort of data again and again. Solow-Niederman told The Markup that one problem is that regulators are overwhelmed and can’t fully enforce penalties for companies caught violating privacy regulations. “I actually think there are people at agencies like the FTC and the CFPB who are trying their best to adapt their laws,” she said, “but they have the tools that they have and they’re so resource-constrained and deprived of the funding and staff that they need.” Credits Colin Lecher, Investigative Reporter
Ross Teixeira, Investigative Data Journalist Colin Lecher, Investigative Reporter Colin Lecher Ross Teixeira, Investigative Data Journalist Ross Teixeira Art Direction Gabriel Hongsdusit Gabriel Hongsdusit Gabriel Hongsdusit Illustrator Vincent Kilbride Vincent Kilbride Vincent Kilbride Copy Editing Emerson Malone Emerson Malone Emerson Malone Engagement Maria Puertas Maria Puertas Maria Puertas Editing Ko Bragg
Michael Reilly Ko Bragg Ko Bragg Michael Reilly Michael Reilly Also published here here Photo by Jakub Żerdzicki on Unsplash Jakub Żerdzicki Unsplash

Credit Karma

Google

Unsplash

The Markup Wins Six News Design Awards From the Society for News Design

Every dollar you donate helps support The Markup’s work.

Mortgage Brokers Are Sending Personal Data to Facebook

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Conversation with Kashmir Hill: Envisioning a Chaotic Future

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

03/09/2018: Biggest Stories in the Cryptosphere

The Noonification: Immigrant Teens Are Working Dangerous Night Shifts in Factories (11/21/2022)

The Noonification: How to Implement a Merkle Tree in Solidity (11/12/2023)

10 Ways to Optimize Your Database

A Conversation with Kashmir Hill: Envisioning a Chaotic Future

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

03/09/2018: Biggest Stories in the Cryptosphere

The Noonification: Immigrant Teens Are Working Dangerous Night Shifts in Factories (11/21/2022)

The Noonification: How to Implement a Merkle Tree in Solidity (11/12/2023)

10 Ways to Optimize Your Database

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps