The Limit Is Targeting, Not Topic
Start with what the policy does not say. The publisher-restriction list covers sexual content, shocking content, explosives, firearms, tobacco, recreational drugs, alcohol, online gambling, prescription drugs, unapproved supplements, and apps removed from Google Play. Credit cards, banking, and debt management are absent from it. The credit constraint sits in a different section of publisher policy: personalized advertising.
Three conditions must all hold before that section applies. The user is in the United States or Canada. The advertised category is credit-related products or services, banking products and services, or certain financial planning and management services; Google's examples are credit cards and loans, bank and checking accounts, and debt-management products. And the ad is personalized — chosen using audience data rather than page context.
Contextual and page-topic setups are not named in that clause. Reading them as outside it is an inference from the wording, not a stated Google permission, so verify against the live page.
The Five Named Signals, Side by Side
| Audience signal | Status for personalized ads in these categories, US and Canada | Scope note |
|---|
| Gender | Listed as off-limits for selecting or targeting | One of the five named signals; US/Canada only |
| Age | Listed as off-limits for selecting or targeting | Same five-signal list; not a blanket ban elsewhere |
| Parental status | Listed as off-limits for selecting or targeting | Paired with marital status, so household-stage split falls inside |
| Marital status | Listed as off-limits for selecting or targeting | Same list, same scope |
| ZIP code | Listed as off-limits for selecting or targeting | "Offers in your area" logic keyed to postal code is where it surfaces |
| Inferred negative financial status | Prohibited as sensitive information generally | Not limited to US/Canada; also a data-source rule |
Two different boundaries separate the rows. The first five answer "may I select this audience?" and their reach is narrow: US and Canada, those categories. The sixth answers "may I build this audience at all?" and travels with personalized ads everywhere.
The ZIP-code row deserves its own check because it hides in friendly copy. If a page promises "card offers near you," find out whether postal code enters the audience layer or stays inside the article text. One is targeting; the other is writing.
Interest and page-topic signals sit outside the five-signal clause; treat that as interpretation, not permission.
A Second, Broader Exposure: Financial Hardship
The sensitive-information clause forbids selecting or targeting personalized ads with — and collecting or using cookie lists and audience data based on — inferred or actual sensitive information. Negative financial-status information and detailed personal financial detail are named, including signals that a user has a low credit rating or a high debt burden.
For a credit site, the practical trigger is provenance. An audience list built from visitors to "bad credit," "debt relief," or "credit repair" pages is financial-hardship-derived data, and folding it into card campaigns moves you from a targeting question to a data-source question. This clause is stated generally, not limited to the US and Canada.
What Has to Be in Place First
Personalized ads through Google products or ad code carry four documented conditions. You must hold all rights needed to use the audience data, cookie lists included. The advertiser must add a notice that the ads are interest-based, such as the AdChoices icon. All parties must follow applicable self-regulatory principles — the Digital Advertising Alliance principles or the IAB Europe framework, for example.
Fourth, your privacy policy must disclose data collection, sharing, and use arising from Google products, and state that third parties may place and read cookies on the user's browser or use web beacons and IP addresses because ads are served there. A site can satisfy the first three and still fail here, which is why a policy notice sometimes points at disclosure rather than at targeting.
Where Credit Copy Trips
The AFS penalty framework separates normal from egregious violations, and credit pages tend to produce both.
Egregious, at one strike each, covers "promising loans," concrete and explicitly stated promises that cannot be fulfilled, and specific promises outside your control — the retrieved illustration is an account-opening line promising no credit check. Those are quote-level patterns, not templates.
Normal, at five violations per strike, covers promises made but not clear or explicit, and specific information offered but never delivered: a "see the best card offers" page with no real offer data is that shape.
Two placement rules apply to the same pages. Related-search and product-integrated units may not use misleading text to pull users in — the retrieved example is "click here to get the best offer" — and may not become the page's focal point; every related-search term sent to Google must exactly match the clicked term, not a shortened or expanded rewrite. And Google-served ads may not appear on screens where ads or paid promotional content occupy more layout than your own content, or where there is no publisher content or only low-value content.
Audit Order and Honest Limits
Work in this order: inventory the audience lists; map each to a named signal; check the interest-based notice and privacy text; check credit copy and related-search wording; re-read the live policy page; log the date you audited.
Google is migrating publisher policies to the Publisher Policies Help Center and may revise them, so record which version you checked. Enforcement is discretionary: the material supplies examples, not guarantees about review outcomes or reinstatement. This is policy-reading guidance, not legal advice. Card economics, advertiser-side Google Ads financial-services rules, EU and UK requirements, and fair-lending analysis fall outside this article and need separate review.