Mastercard and Google have reportedly reached a secret deal that will enable Google to track Mastercard user buying habits both online and offline, and use the data for ad targeting and attribution. According to Bloomberg, the deal was brokered last year following four years of negotiation.

Neither Google nor Mastercard have publically announced the partnership, and so far neither company has let customers know that offline purchases made in stores using Mastercard are being tracked and correlated with online ad interactions.

According to Bloomberg, which cites four people with knowledge of the deal, the partnership has given Google an unprecedented tool when it comes to establishing online-to-offline attribution, as well as a potent new data source for targeting ads.

The technology comes into action when a Google user clicks on one of the search giants ads but doesnt buy the product or service in question. If, within 30 days, they then use a Mastercard to buy that item in a physical store, Google will notify the advertiser as part of its reporting on ad effectiveness.

Consumers are able to opt-out of the attribution technology by toggling off Web and App Activity, a broad category that controls whether Google can pinpoint your exact GPS coordinates. This same category came under the spotlight earlier this month when it was revealed that Google was using it to track user locations even when users had opted out of Location Services.

However, the deal has raised concerns over how much consumer information Google has access to, and the lack of transparency and consumer information provided regarding the partnership.

“People dont expect what they buy physically in a store to be linked to what they are buying online,” said Christine Bannon, counsel with the advocacy group Electronic Privacy Information Centre (EPIC). “Theres just far too much burden that companies place on consumers and not enough responsibility being taken by companies to inform users what theyre doing and what rights they have.”

Google reportedly paid millions of dollars to acquire the data provided by Mastercard, and the companies have discussed sharing a portion of the ad revenues facilitated by the deal, although there is currently no such revenue sharing agreement currently in place.

Google have declined to comment on the partnership with Mastercard, but stated that its new double-blind encryption technology prevents both Google and its partners from viewing personally identifiable information for users.

Mastercard has also declined to comment on the deal, but has confirmed that it shares transaction trends with both merchants and their service providers to aid in measuring “the effectiveness of their advertising campaigns”.