Google has reportedly bought Mastercard credit card data in the US to help it track users' offline spending in stores.
The two firms had not made the deal public but it was discovered by Bloomberg.
Mastercard denied suggestions that its data could be used to identify exact purchases.
The Open Rights Group told the BBC the confidential nature of the deal raised privacy issues.
"This raises serious concerns regarding the use of private financial data," said legal director Myles Jackman.
"Will Mastercard be compensating their clients for the data they have given away to Google for their own financial gain?"
Google says all the data is anonymised and that users can opt out of ad tracking by switching off the web and app activity control.
It is testing a service for ad buyers in the US that shows how digital ads influence in-store spending.
On its website, the firm claims that advertisers who qualify to use its "store sales management" service can see whether an ad click or video view results in an in-store purchase within 30 days.
Google said the service was a test product in the US and only available to certain ad buyers.
It launched the ad tool in 2017.
"Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users' personally identifiable information," the firm said in a statement.
"We do not have access to any personal information from our partners' credit and debit cards, nor do we share any personal information with our partners."
- Eight ways you are being influenced without even realising it
- Google tracks users who turn off location
Mastercard told the BBC it offers its own "media measurement services" to retailers, in which the merchant provides advertising campaign details and it supplies spending data for the duration of the campaign.
"We only provide merchants and their designated service providers trends based on aggregated and anonymised data, such as the merchant's average ticket size and sales volumes," said a spokesman.
"We do not provide insights that track, serve up ads to, or even measure ad effectiveness relating to, individual consumers."