A behind-the-scenes deal between Google and Mastercard was just revealed, whereby Google paid “millions of dollars” for “a stockpile of Mastercard transactions” that most of the credit card company’s two billion users were unaware of. Over the past year, Google provided select advertisers with the ability to track whether online ads led to sales at physical stores in the U.S. While the deal could give Google leverage over rivals such as Amazon, it could also raise privacy concerns regarding how customer data is used and shared. Google says no personal data was shared about users.

Bloomberg reports that, according to sources, Google and Mastercard “discussed sharing a portion of the ad revenue.” A Google spokeswoman, who declined to comment on the partnership, said no revenue is being shared.

“Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information,” stated the company. “We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners.”

In its test program, Google could “anonymously match these existing user profiles to purchases made in physical stores,” and also “plugs transaction data into advertiser systems as soon as they occur, fixing the lag that existed previously and letting Google slot in better-performing ads.”

Although Google pointed out that users can opt out of ad tracking via its “Web and App Activity” online console, “inside Google, multiple people raised objections that the service did not have a more obvious way for cardholders to opt out of the tracking,” said one source.

Mastercard spokesman Seth Eisen said that Mastercard shares “transaction trends with merchants and their service providers” to help them measure “the effectiveness of their advertising campaigns.” Information includes “sales volumes and average size of the purchase … [but] no individual transaction or personal data is provided.”

Google’s Store Sales Measurement, which the company launched last year, was touted as having access to “approximately 70 percent” of U.S. credit and debit cards, but did not name partners. The service, said Google, “only applies to people who are logged in to one of its accounts and have not opted out of ad tracking.”  Bloomberg reports, “Purchases made on Mastercard-branded cards accounted for around a quarter of U.S. volumes last year, according to the Nilson Report, a financial research firm.”

Privacy advocates, however, have shared their concerns. “People don’t expect what they buy physically in a store to be linked to what they are buying online,” said Electronic Privacy Information Center (EPIC) attorney Christine Bannan. “There’s just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what they’re doing and what rights they have.