Google and Mastercard are secretly tracking your offline purchases

Google has quietly been providing select advertisers a “stockpile” of offline credit card transaction data.

After a four year negotiation, Google and Mastercard reached a deal that would pay the latter millions in exchange for coughing up data on its card holders, according to a Bloomberg report. Google then packaged the data into a new tool, called Store Sales Measurement, that allowed its customers to track whether online ads turned into real world retail sales.

Neither company informed its users of the arrangement. For Mastercard, that means the bulk of its two billion customers have no knowledge of the behind-the-scenes tracking.

“People don’t expect what they buy physically in a store to be linked to what they are buying online,” Christine Bannan, counsel with the advocacy group Electronic Privacy Information Center, told Bloomberg. “There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.”

Last year, when Google first announced the Store Sales Measurement service, the company claimed to have access to “approximately 70 percent” of US credit and debit cards. Purchases made on Mastercard-branded cards account for some 25 percent of all credit card transactions in the US, according to financial research firm Nilson Report.

Though Google didn’t name its partners, the 70 percent figure would suggest Mastercard isn’t the only credit card company it is currently partnered with.

Visa and American Express did not respond to our inquiries about whether they also had similar arrangements with Google.

A Google spokesperson told TNW:

Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information. We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners. Google users can opt-out with their Web and App Activity controls, at any time.

While users have the ability to opt out of offline tracking, it remains unclear whether most users even know it exists. The opt out tool Google mentions makes no mention of tracking offline purchases.

For Google, this is just another step in bridging the gap between online ads and offline sales. Since at least 2014, the company has used Google Maps to notify advertisers about users who viewed their ads and then visited brick-and-mortar establishments. This tool, however, didn’t track sales made within the stores.

Mastercard couldn’t be reached for comment. A spokesperson, however, told Slate:

Regarding the [Bloomberg] article you cited, I’d quickly note that the premise of what was reported is false. The way our network operates, we do not know the individual items that a consumer purchases in any shopping card — physical or digital. No individual transactions or personal data is provided. That delivers on the expectation of privacy from both consumers and merchants around he world. In processing a transaction, we see the retailers name and the total amount of the consumer’s purchase, but not specific items.