Update 5/15/19 11:35 PM EST: Google has told us that this issue has been fixed and BleepingComputer has confirmed that the privacy settings now appear on the normal Settings page.

Update 5/15/19 1:07 PM EST: Google has replied to our questions with the following statement:

“All users are currently able to access these privacy settings via the ‘Google Payments privacy settings page’ link in the Google Pay privacy notice. The different settings views described here are an issue resulting from a previous software update and we are working to fix this right away so that these privacy settings are always visible on pay.google.com.”

It has been discovered that Google is hiding three Google Pay privacy settings unless you access the service's Settings screen through a special URL. These settings allow you to restrict whether Google Pay shares your creditworthiness, personal information, or Google Pay account information.

Google Pay is a payment service from Google that allows you to purchase items online and in stores by using stored payment information. Like all online services, Google Pay has a Settings screen in their Google payments center that allows you to configure various settings related to the service.

This Settings page can be accessed using the navigation sidebar, as shown below, or directly through the URL https://pay.google.com/payments/u/0/home#settings. From the Settings screen you can set your address, payment users, some general settings, and other information. There is, though, no privacy settings on this page when accessing it normally.

Normal Settings screen linked to from the Google Payments center

On the other hand, if you access the same page using a different URL, https://pay.google.com/payments/u/0/home?page=privacySettings#privacySettings, the same settings as the above page will be displayed, but this time with three additional privacy settings.

Hidden privacy settings displayed using special URL

These new privacy settings allow you to restrict how Google Pay shares your information with other companies owned or controlled by Google or with sites you visit.

Allow Google Payment Corporation to share third party creditworthiness information about you with other companies owned and controlled by Google LLC for their everyday business purposes. Allow your personal information to be used by other companies owned and controlled by Google LLC to market to you. Opting out here does not impact whether other companies owned and controlled by Google LLC can market to you based on information you provide to them outside of Google Payment Corporation. Allow Google LLC or its affiliates to inform a third party merchant, whose site or app you visit, whether you have a Google Payments account that can be used for payment to that merchant. Opting out may impact your ability to use Google Payments to transact with certain third party merchants.

These settings are all enabled by default. Furthermore, this URL is not linked to from the Google Payment Center navigation links.

The URL was discovered by a user who posted about it on Reddit who saw it on the Google Payment Privacy Notice page in the following paragraph:

"If you don't want us to share personal information about your creditworthiness between GPC and its affiliates, or if you do not want our affiliates to use your personal information collected by us and shared with them to market to you, or if you do not want Google LLC or its affiliates to inform a third-party merchant, whose site or app you visit, whether you have a Google Payments account that can be used for payment to that merchant, please indicate your preference by logging in to your account, going to the Google Payments privacy settings page, and updating your preferences."

It is baffling that after all the privacy lapses, congressional hearings, and concerns that users increasingly have regarding the use of their data that Google would intentionally hide or make it difficult to access privacy settings.

BleepingComputer has contacted Google with questions regarding these settings and why they are hidden, but had not heard back at the time of this publication.