Mastercard has secret contract to supply Google with offline transaction records

You can rest assured that when Google shows you an ad, it knows if you make an online purchase related to that ad. But what if you physically go to a store and buy a product because of an online advertisement?

Well, it turns out that Google knows about at least some of those as well. We know this now because Bloomberg just exposed a secret Mastercard-Google contract which gives the search giant access to the offline transaction records of a portion of Mastercard’s two billion customers.

While the contract itself isn’t that surprising, the fact that both Google and Mastercard kept the agreement a secret from the public is a little concerning.

According to three anonymous people who worked directly on the deal, Google and Mastercard negotiated the contract over the span of about four years. Although an exact amount wasn’t disclosed, it’s alleged that Google paid Mastercard millions of dollars for the customer data. The two companies also discussed sharing profits from ad revenue related to the data, although Google denied this was the case.

Google did make a statement on the security of the advertising tool related to the contract, but neglected to directly discuss the Mastercard partnership:

“Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information. We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners.”

The encryption technology Google is referencing enables the tracking of data and connecting it to a user’s profile, but then sharing that data anonymously with advertisers and Google. In other words, it goes like this:

1. Online shopper views and clicks an ad for a Samsung smartphone. The shopper doesn’t buy anything.
2. Sometime later (within 30 days of the ad-click), the user enters a physical store and buys a Samsung smartphone with their Mastercard.
3. The advertiser (in this case, Samsung) is fed a report that shows that an ad-click led to a sale at a physical store. Samsung and Google do not know any info about who made the purchase, how much was spent, or when, just that the same user who clicked an ad went out to buy a product.

Google emphasized in its statement that users can opt-out of ad-tracking at any time; however, the fact that no one knew this was happening makes that advice a little disingenuous.

A Mastercard spokesperson also declined to comment on the Google partnership directly but pointed out that Mastercard often shares transaction history with merchants and service providers.

According to anonymous tipsters speaking with Bloomberg, Google has had discussions with other credit card companies about partnerships, and ad agencies have approached Google about tracking even more offline information about customers, such as the time of the transactions and how much was spent.

NEXT: Google’s digital payment app for India, Tez, is now Google Pay