Start with the rule, not the ad
If you searched about debt, entered an income range on a card comparison page, or typed a ZIP code, then saw repeated credit card ads, the natural assumption is that those details drove the ads. The better question is narrower: which signals may be used to select a personalized ad, and which are barred? Google's publisher policy, as summarized in the retrieved AdSense Help material, sets out two layers: a ban on certain sensitive information and a category-specific rule for credit products in the United States and Canada.
Layer one: negative financial status is barred
The general prohibition covers personalized ad selection and targeting based on inferred or actual sensitive information. The policy's examples include negative financial status information, such as information indicating a user has a low credit rating or a high debt burden. The ban also reaches the collection or use of audience data, including cookie lists, for that kind of targeting. This matters because it is not only a rule about ad wording. It restricts using a financial-status signal to decide who receives the ad. The list is illustrative, not exhaustive.
Layer two: the credit-category restriction
In the United States and Canada, the policy adds a separate restriction. Personalized ads may not be targeted to an audience based on gender, age, parenting status, marital status, or ZIP code for credit-related products or services, banking products or services, and certain financial planning and management services. The policy names credit cards and loans as examples of credit-related products; it also names bank and checking accounts and debt management products. This is category-scoped, not a blanket ban on those signals everywhere, and it sits on top of the financial-status ban; avoiding one listed signal does not make a credit card ad compliant.
Comparison: two signals, two rules
| Signal | Status as a targeting signal for personalized ads in general | Status for credit card or credit-related ads in the US and Canada |
|---|
| Low credit rating or high debt burden (negative financial status information) | Prohibited — inferred or actual sensitive information may not be used to select or target personalized ads or to collect or use audience data such as cookie lists | Prohibited — the sensitive-information listing applies independently; the policy states no credit-category exception |
| Gender, age, parenting status, marital status, or ZIP code | Not listed among the prohibited sensitive-information signals; other policy requirements still apply | Restricted — may not target credit-related products or services, banking products or services, or certain financial planning and management services; credit cards and loans are examples |
The table shows the layering: a signal can be absent from the general sensitive-information list and still be barred for credit ads in the United States and Canada. It does not cover every targeting rule, and it does not prove how any single ad was targeted.
Why you still see credit card ads
The policy restricts listed targeting bases; it does not ban credit card advertising. A personalized ad can still run if it avoids prohibited signals, and delivery that is not personalized is a separate path. Because a personalized and a non-personalized ad can look identical in a browser, seeing a card ad is not proof that your debt, age, or ZIP code was used. Nor is the absence of a prohibited signal proof that no profiling occurred. The retrieved evidence does not establish how any individual ad was targeted, and it does not describe issuer-specific practices.
The notice and disclosure trail
Readers have two observable checks. First, advertisers running personalized ads must have all necessary rights to use audience data such as cookie lists, must add an in-ad notice that the ad is interest-based, for example through the Ad Options icon, and must comply with applicable self-regulatory guidelines such as the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising or IAB Europe's EU Framework. The notice is checkable, but a single ad does not prove compliance. Second, the site hosting the ad must maintain a privacy policy disclosing data collection, sharing, and use from Google products, including cookies, web beacons, IP addresses or other identifiers. It must disclose that third parties may place and read cookies or use web beacons or IP addresses because ads are served there. Publishers may meet the Google data-use disclosure by prominently linking to Google's page on how Google uses data from partner sites or apps.
Other barred bases sit outside this question
Separate from credit signals, personalized ads also may not be based on past or current activity on adult, gambling, or government-agency sites or apps, or on activity of users known to be under 13 or on sites or apps directed to children under 13. These rules broaden the privacy picture, but they do not change the credit-specific analysis above.
What this article cannot tell you
This is not legal or financial advice, and no attorney, compliance reviewer, or financial professional reviewed it. The policy is summarized from a translated version of Google's publisher documentation; wording here is paraphrase, not an official English quotation. Policies change without notice. The retrieved material contains no card rates, fees, rewards, issuer practices, credit-scoring details, or statutory citations, so none are supplied. Applying a prohibited-signal rule to a specific ad you saw is not possible from public information. Verify details against the current official policy page.
A practical check before you click
On a card comparison page, open the privacy policy and look for the specific cookie, web beacon, IP address, and third-party-cookie disclosures. On the ad itself, look for an interest-based notice such as the Ad Options icon. Treat those as evidence of disclosed practices, not proof of what happened in your case. For personal financial decisions, consult a qualified professional.