Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Google collects payment card numbers, purchase activity, and related payment information when users make purchases or process payments through Google services.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Collection of payment card numbers and financial transaction data by Google is operationally significant for compliance teams assessing PCI DSS obligations, data security requirements, and financial data disclosure requirements applicable to Google Pay and related services.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part of a broader 'ad and analytics services' ecosystem, and broadens the scope of data linking to explicitly include 'cookies and other technologies'. The policy also clarifies that data sharing occurs even in private browsing modes. Review your Google Account activity controls to understand what data is being collected and linked across services you use.
View change record →The removal of explicit payment and financial data collection provisions is significant as it may obscure the breadth of sensitive financial information Google processes.
View full change record →This new provision explicitly discloses collection of sensitive financial data including payment card numbers, which was not previously detailed and represents a significant privacy consideration for users engaging in transactions.
View full change record →Under this clause, Google may collect payment card numbers, purchase activity, and other payment information when users transact through Google services. The policy discloses this collection but does not specify detailed retention periods or PCI DSS compliance measures in this document.
How other platforms handle this
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you use Google services to make purchases, process payments, or take part in promotions, we may collect information like your purchase activity and payment information, including your payment card number and other card information.Excerpt from YouTube Ads's Google Privacy Policy
1) REGULATORY LANDSCAPE: Financial and payment data collection engages PCI DSS (Payment Card Industry Data Security Standard), CCPA/CPRA (financial information as a sensitive personal information category), GDPR (financial data as personal data requiring lawful basis), and state consumer protection statutes. The FTC and state attorneys general have authority over deceptive or unfair practices involving payment data. 2) GOVERNANCE EXPOSURE: Medium. Collection of payment card numbers is a high-sensitivity data category requiring PCI DSS compliance. The policy does not specify the security controls or PCI DSS scope applicable to Google's payment processing, which is a standard limitation of consumer-facing privacy policies. 3) JURISDICTION FLAGS: California CPRA classifies financial information as sensitive personal information. EU/EEA: financial data requires appropriate GDPR lawful basis and security measures. New York SHIELD Act and other state data breach notification laws require notification if financial data is compromised. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations integrating Google Pay or Google payment processing features should assess PCI DSS scope implications for their own systems and confirm contractual security obligations with Google. 5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that Google's payment processing services operate under appropriate PCI DSS certification and that data breach notification obligations covering financial data are addressed in vendor agreements.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Collection of payment card numbers and financial transaction data by Google is operationally significant for compliance teams assessing PCI DSS obligations, data security requirements, and financial data disclosure requirements applicable to Google Pay and related services.
Under this clause, Google may collect payment card numbers, purchase activity, and other payment information when users transact through Google services. The policy discloses this collection but does not specify detailed retention periods or PCI DSS compliance measures in this document.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.