In just a few days, representatives from Google, Facebook, Apple, Twitter, and Amazon will once again convene on Capitol Hill to testify before lawmakers, with each walking the fine line between their critics on the right, who claim tech is hopelessly biased against conservatives, and their critics on the left, whose concerns center on election interference and user privacy. According to Axios reports, each company has zeroed in on a message that it hopes will appease lawmakers—Facebook’s, for instance, is something along the lines of We’re at the table. We’re willing to accept some regulation. We don’t have all the answers. Of all the companies, Google’s mantra is perhaps the most straightforward: Our algorithms have no politics. It refers, of course, to Donald Trump’s recent tirades against the search engine, in which he baselessly asserted that its results for the query “Trump news” are biased against conservative outlets, and that Google failed to promote his State of the Union address. Google, it seems, sees this line of thinking as the primary threat from lawmakers, and is preparing to head it off with, well, facts.

But another, bigger problem looms for Google—one for which it has received markedly less criticism. While Facebook has come under suspicion for playing fast and loose with user data, Google, which collects massive amounts of information on users to sell to its advertisers, has flown relatively under the radar. A new report from Bloomberg adds a fresh dimension to the problem: according to the outlet, for the past year, some Google advertisers have had access to a tool that tracks whether the ads they run online eventually lead to in-store purchases. To supply them with these metrics, Google matches the data of 2 billion Mastercard holders, which it reportedly purchased for millions of dollars, with the user profiles of people who have been served certain ads on its site. If a Google user saw an ad, but didn’t buy the product, the company can divine whether that person purchased the item with their Mastercard later on. If so, Google’s report to advertisers will include a section about the offline effectiveness of their ads. Google technically announced this service, called “Store Sales Measurement,” last year, noting it could access data from “approximately 70 percent” of U.S. debit and credit cards through its partners. While Google maintains that users can opt out of ad tracking, some inside the company say there’s no obvious or immediate way for people to do so.

The company insists that the data is totally secure: “Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information,” Google said in a statement to Bloomberg. But the real crux of the matter is that the vast majority of Mastercard holders were never informed that Google had bought their data, because neither company disclosed the deal to the public. “People don’t expect what they buy physically in a store to be linked to what they are buying online,” the Electronic Privacy Information Center’s Christine Bannan told Bloomberg. “There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.”

Questions about Google’s handling of user data may very well emerge during next week’s hearings. After all, it has been in the business of monetizing users much longer than Facebook has, and other reports—such as one earlier this month about Google apps reportedly storing precise time-stamped location data about you automatically, without asking permission—may ultimately back the tech giant into a tight corner. Google’s response to claims of anti-conservative bias is largely a matter of politics: all the company can do is present the facts, which will then be twisted one way or another by liberal or conservative lawmakers, respectively. But the company may find it trickier to answer questions about the amount of data they share and exploit, a point that’s all the more damning because it’s both true, and central to the company’s business model.