The five blocked audience attributes
Under Google's personalized advertising policy, advertisers using Google platform products or Google ad code cannot select or target personalized ads—or collect or use audience data such as cookie lists—for credit-related products or services in the US and Canada based on audience gender, age, parental status, marital status, or postal code. The credit category explicitly includes credit cards and loans, bank and checking accounts, and debt-management products. Housing and employment sit under the same US/Canada restriction, but the card marketer's immediate checklist is the five attributes above.
These terms concern selection, not the ad's text. A US card ad can still run. What fails is a media plan that defines the recipient by age band, marital situation, parental stage, gender, or ZIP-level geography. The creative may be ordinary; the audience logic is still prohibited.
Hardship signals under sensitive data
Age and postal code are visible filters. Financial hardship is less obvious but reaches the same result through a different rule. Google bars personalized advertising, and the collection or use of audience data such as cookie lists, when the basis is sensitive information. The policy specifically names negative financial status information and other detailed information about a person's financial situation, including signals that indicate a lower credit rating or a higher debt burden.
For card advertisers, that reaches beyond the five demographic and geographic attributes. A list whose labels encode a lower credit rating, higher debt burden, or other negative financial status describes financial situation in exactly the way the policy warns about. The restriction follows what the signal reveals, not the label given to the list. A neutral-looking segment name does not settle the question if its underlying definition depends on those financial details.
The policy's sensitive-data category also covers health information, ethnicity, religion, criminal records, political affiliation, union membership, and sexual behavior or orientation. Card teams do not need to resolve every edge of those categories, but they should recognize that financial-hardship proxies are not the only sensitive signals that can appear in an audience description.
Context and audience are different questions
A page about balance transfers or travel rewards is contextual inventory. Its readership is defined by the page topic, not by an inferred demographic or financial profile. A card ad placed there is not automatically barred by the five-attribute rule. That distinction matters because a page topic can sit outside the restriction while a list-based extension of the same campaign does not. The analysis changes when the same campaign narrows delivery with an uploaded list, a demographic filter, or a model built from financial outcomes. A contextual placement can be unsuitable for other reasons, but it is not the specific targeting signal this policy prohibits.
What a cookie-list campaign still needs
The five-attribute ban does not exhaust the obligations for audience-based card ads. If a campaign uses Google platform products or ad code for personalized advertising, the advertiser must hold every right needed to use cookie lists and similar audience data; add an in-ad statement that the ads are based on user interest, for example through the Ads Options icon; and ensure all parties follow applicable self-regulatory principles, such as the Digital Advertising Alliance's principles for online behavioral advertising or IAB Europe's framework where relevant.
Publisher-side privacy duties run alongside those advertiser duties. The privacy policy must clearly disclose data collection, sharing, and use connected to Google products, including cookies, web beacons, IP addresses, and other identifiers. It must tell users that third parties may place and read cookies in their browsers and may use web beacons or IP addresses. Google offers a link to its "How Google uses data when you use our partners' sites or apps" page as a way to meet that data-use disclosure. The policy also bars setting, modifying, intercepting, or deleting cookies on Google domains, passing personally identifiable information to Google, identifying users or merging such data with previously collected non-personal information without clear advance notice and opt-in consent, and attempts to break down aggregated reporting.
A pre-launch signal audit
Start with audience definitions, not creative. Read the description behind each segment name and remove gender, age, parental status, marital status, and postal-code filters from personalized use in US/Canada card campaigns. Next, trace financial-situation signals: labels or model outputs that imply a lower credit rating, higher debt burden, or other negative financial status. Ask whether lookalike expansion or optimization is, in practice, selecting on one of those attributes; the label does not settle the question.
Then verify the mechanical obligations: interest-based notice in every ad format, rights documentation for each list, self-regulatory compliance, and privacy-policy wording that matches the disclosures above. Keep records of the audit. Google's publisher documentation places responsibility on participants to follow the current policy version, not the version in place at launch.
Scope limits and first step
This article covers Google's published personalized-advertising and publisher policy only. Other legal duties, card issuer requirements, and network rules are separate questions it does not resolve. The five-attribute restriction is stated for the US and Canada together; other markets have their own frameworks. Policy language makes the clear cases clear, but edge cases—a narrow geographic setting, a modelled segment, a partner's data—still require interpretation. Ambiguous plans should go to legal or compliance review before launch, not after a disapproval.
The first step is narrow: audit audience definitions first. That is where the policy's specific credit-card targeting prohibitions actually bite.