Reading the Rule in Its Own Words
The provision sits inside Google's personalized advertising requirements for publisher products. It states that, in the United States and Canada, audience gender, age, parental status, marital status, or postal code may not be used to promote three groups of products: housing and real estate services; employment services, with a narrow exception for certain pre-determined US government advertisers relying on a bona fide occupational qualification; and credit-related or banking products and services, plus certain financial planning and management services. The policy's own examples for the third group are credit cards and loans, bank and checking accounts, and debt management products.
It is a targeting restriction, not a content ban. Credit card offers remain ordinary commercial content in this policy set. What disappears is a set of audience signals marketers have long used to decide who sees an offer. Personalized advertising here means ads selected or targeted using audience data such as cookie lists — the rules attach to that selection step, not to the offer itself.
Five Signals, One Category
The restricted fields are specific: gender, age, parental status, marital status, postal code. Each is a coarse proxy. A ZIP code is not income data, but it tracks closely with it. Marital status is not a credit history, but it hints at household obligations. The policy does not explain its reasoning. What it does show is placement: credit sits beside housing and employment, where audience attributes are handled cautiously. Read that as context, not as policy text.
Income, credit score, and occupation are absent from that list, so the restriction is narrower than a blanket ban on financial targeting. The sensitive-data rule, covered next, supplies part of the remaining limit.
The Sensitive-Data Layer That Applies Everywhere
Separately, and without a US or Canada qualifier, personalized ads may not be selected or targeted using sensitive information. The list covers inferred or actual data about health or medical records, ethnicity or race, religion, criminal behavior, political affiliation, union membership, sexual behavior or orientation — and negative financial status, such as information suggesting a low credit rating or a high debt burden.
This layer is stricter in kind. The five-signal rule blocks named targeting fields for one product category in two countries. The sensitive-data rule blocks credit distress signals anywhere, for any product. In practice it rules out segments built on subprime or high-debt inferences, and cookie lists that encode them.
Contextual Is Not a Loophole, but It Is the Fallback
When audience signals are unavailable, credit card content still monetizes the old way: the page is about balance transfers or travel rewards, so the ad matches the page. That is contextual placement, and the five-signal list does not reach it, because the list governs audience selection.
Two obligations follow if audience data is used. Advertisers running personalized ads through Google platform products or ad code must hold every right needed to use cookie lists and similar audience data; they must label the ad as interest-based, for example with the Ad Options icon; and all parties must follow applicable industry codes, such as the Digital Advertising Alliance's self-regulatory principles or the IAB Europe framework.
The Disclosures That Sit Alongside Targeting
Privacy obligations are separate and are not limited to credit. A publisher must maintain and follow a privacy policy that clearly discloses any data collection, sharing, and use occurring because of Google products, including cookies, web beacons, IP addresses, and other identifiers. The scope covers websites, apps, connected TV, consoles, and email platforms. Cookie placement and reading by third parties tied to ads on the site must be disclosed to users, alongside an easily found link explaining how Google uses partner data.
Copy That Turns a Reminder Into a Strike
Credit card content also meets the misrepresentation rules. Deceptive promotion of products or services is prohibited, and quick-rich schemes are named examples. The penalty guidance is sharper, and it is worth reading before writing a headline.
Ordinary violations accumulate: five policy violations equal one strike. An egregious violation equals one strike on its own. Egregious examples are concrete, impossible promises — free or cash offers, unreasonably cheap offers, promises to hire — plus specific promises outside the advertiser's control, such as opening a PNC high-yield savings account with no credit check. A credit card page guaranteeing approval, or advertising "no credit check" terms it cannot deliver, sits close to that line. A reported warning also stays on record for two years from the most recent report.
A Review Sequence for Credit Card Inventory
- Audit every audience segment attached to credit card campaigns for gender, age, parental status, marital status, or postal code, and rebuild those that rely on them from page context.
- Confirm that no segment rests on inferred financial distress, low credit rating, or high debt burden.
- Check that personalized ads carry the interest-based label and that cookie-list rights are documented, not assumed.
- Read the landing copy for approval guarantees, "no credit check" positioning, and any offer the advertiser cannot control.
Three Limits on This Reading
The geographic scope is written into the rule: the five-signal restriction names the United States and Canada, so a campaign built for those markets cannot be transplanted unchanged. The policy is also a floor rather than a complete answer, since lending and disclosure rules, and platform-level ad policies, can add obligations this document does not describe. And the rules are revised over time — the program policies note that changes may be published at any time — so a review tied to an old version is not a review. Where credit, money, and disclosure meet, take the question to compliance counsel rather than to a policy summary.
The First Edit to Make
Pull every credit card audience segment that leans on age, gender, marital or parental status, or ZIP code, and rebuild it from page context. That single change brings targeting back inside the rule while leaving the rest of the campaign structure intact.