Over the past year, certain Google advertisers have been able to use a "potent new tool" which allows them to track whether ads they run online translated to sales at physical stores throughout the United States, thanks to a secret deal between the Silicon Valley tech giant and Mastercard, reports Bloomberg.

Illustration: Tam Nguyen, AdAge

Most of Mastercard's two billion customers weren't aware of this arrangement, since neither Google parent Alphabet Inc. nor the credit card company told the public about the deal which was brokered after four years of negotiations. The alliance, says Bloomberg, "gave Google an unprecedented asset for measuring retail spending," as part of the search giant's "strategy to fortify its primary business against onslaughts from Amazon.com Inc. and others."

Through this test program, Google can anonymously match these existing user profiles to purchases made in physical stores. The result is powerful: Google knows that people clicked on ads and can now tell advertisers that this activity led to actual store sales. ... It works like this: a person searches for "red lipstick" on Google, clicks on an ad, surfs the web but doesn’t buy anything. Later, she walks into a store and buys red lipstick with her Mastercard. The advertiser who ran the ad is fed a report from Google, listing the sale along with other transactions in a column that reads "Offline Revenue" -- only if the web surfer is logged into a Google account online and made the purchase within 30 days of clicking the ad. The advertisers are given a bulk report with the percentage of shoppers who clicked or viewed an ad then made a relevant purchase. -Bloomberg

Last year Google boasted that that the service, called "Store Sales Management," had access to "approximately 70 percent" of US credit and debit cards.

Last year, when Google announced the service, called "Store Sales Measurement," the company just said it had access to "approximately 70 percent" of U.S. credit and debit cards through partners, without naming them. -Bloomberg

Since Google doesn't define what this means, Bloomberg speculates that it could mean "70 percent of the people who use credit and debit cards. Or it could mean that the company has deals with companies that include all card users, and 70 percent of those are logged into Google accounts like Gmail when they click on a Google search ad."

The deal is likely to raise broader privacy concerns about the volume of consumer data is in the hands of data technology companies such as Google. Of note, "Since 2014, Google has flagged for advertisers when someone who clicked an ad visits a physical store, using the Location History feature in Google Maps."

"People don’t expect what they buy physically in a store to be linked to what they are buying online,” said Electronic Privacy Information Center (EPIC) counsel Christine Bannan. "There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.”

Google reportedly paid Mastercard millions of dollars for the data, according to two people who worked on the deal. The companies also discussed sharing a portion of Google's ad revenue, according to one source. A Google spokeswoman denied any revenue sharing agreement with its partners - while addressing privacy concerns:

"Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information,” the company said in a statement. “We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners.”

The company says that google users can opt out of ad tracking using their "Web and App Activity" online console (though no word if the service will continue to secretly track your purchases like Google's location history, which tracks users regardless of whether they've turned the feature off.)

Mastercard spokesman Seth Eisen said that the company shares transaction trends with merchants and service providers to assist them in measuring "the effectiveness of their advertising campaigns."

The information, which includes sales volumes and average size of the purchase, is shared only with permission of the merchants, Eisen added. "No individual transaction or personal data is provided," he said in a statement. "We do not provide insights that track, serve up ads to, or even measure ad effectiveness relating to, individual consumers." -Bloomberg

According to people familiar with the program, Google has approached other payment companies fopr similar deals - however it is unknown whether they actually signed any. Google, meanwhile, confirmed that the service only applies to people who are logged in to one of its accounts and haven't opted out of ad tracking.

Google is testing the data service with a “small group” of advertisers in the U.S., according to a spokeswoman. With it, marketers see aggregate sales figures and estimates of how many they can attribute to Google ads -- but they don’t see a shoppers’ personal information, how much they spend or what exactly they buy. The tests are only available for retailers, not the companies that make the items sold inside stores, the spokeswoman said. The service only applies to its search and shopping ads, she said. -Bloomberg

According to Bloomberg, Google's first attempt to link consumer browsing habits with spending came in the form of it's mobile payment service; Google Wallet - however adoption never took off.

As we mentioned earlier, Google has been pinging advertisers through their Location Services feature when a user visited a store, however the advertiser wasn't able to know whether the shopper made a purchase.

So Google added more. A tool, introduced the following year, let advertisers upload email addresses of customers they’ve collected into Google’s ad-buying system, which then encrypted them. Additionally, Google layered on inputs from third-party data brokers, such as Experian Plc and Acxiom Corp., which draw in demographic and financial information for marketers. -Bloomberg

In May, 2017, Google introduced "Store Sales Management" which let companies with personal info on consumers such as encrypted email address, upload information into Google's system and synchronize advertising expenditures with offline sales. The second component injects card data.

Early indications suggest the Mastercard deal has been a boon for Google. "Malcolm said her agency has tested the card measurement tool with a major advertiser, which she declined to name. Beforehand, the company received $5.70 in revenue for every dollar spent on marketing in the ad campaign with Google, according to an iProspect analysis. With the new transaction feature, the return nearly doubled to $10.60," according to Bloomberg.

"That’s really powerful," Malcolm said. "And it was a really good way to invest more in Google, frankly."