According to Bloomberg, Google advertisers have been able to track the engagement level of ads they ran online: whether it has driven sales at a physical store in the US. The data in part came from Mastercard transactions that Google paid for. Most of Mastercard holders are unaware of this data extraction because the companies never made an official announcement to the public.

“People don’t expect what they buy physically in a store to be linked to what they are buying online,” said Christine Bannan, counsel with the advocacy group Electronic Privacy Information Center (EPIC). “There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.”

According to close sources, both companies settled on a business agreement where Google was able to measure consumer spend online as part of its strategy to cut through the competition. Since the deal never went public it raises privacy concerns about consumer data. However, “Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information,” the company said in a statement. “We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners.”

A Mastercard spokesperson Seth Eisen declined to comment on Google. However, he added that Mastercard shares transaction trends with merchants and service providers in order to reinforce “the effectiveness of their advertising campaigns.”

“No individual transaction or personal data is provided,” he said in a statement. “We do not provide insights that track, serve up ads to, or even measure ad effectiveness relating to, individual consumers.”