What the restriction actually says
Google's personalized advertising policy bars advertisers and publishers from selecting or targeting personalized ads — and from collecting or using audience data such as Cookie lists — based on sensitive information. In the United States and Canada, a separate clause adds credit-related products and services, banking products and services, and certain financial planning and management services to a short list of categories that may not be targeted using an audience's gender, age, parental status, marital status, or postal code. Google's own examples name credit cards and loans, bank and checking accounts, and debt management products. Card advertising is not banned; the audience signals available to it are narrowed.
Why the postal code is the hardest part
Most compliance notes dwell on age and gender because those controls are obvious in an ad platform interface. The postal-code rule is subtler and catches more real campaigns. A regional bank launching a branch card, a retailer pushing a store card in selected neighborhoods, or a credit union testing a local acquisition offer will reach for ZIP-level targeting first, and that is precisely the signal the policy names. Demographic layers compound the problem: audiences built from parents, a narrow age band, or married homeowners cannot be applied to a card line, even where the same layers are routine for travel or retail accounts.
The sensitive-data layer behind the demographics
The demographic rule sits on top of a broader sensitive-information rule. Personalized targeting may not draw on inferred or real sensitive data, and the policy explicitly lists negative financial information and other detailed personal financial circumstances — signals suggesting a lower credit rating or a heavier debt burden. That closes off a familiar acquisition tactic: building an audience from people who visited debt-relief, hardship, or credit-repair pages, then serving them a balance-transfer or rebuild-your-credit offer. The creative may be relevant; the audience construction is the violation.
What still works
Two routes remain open, though neither removes the need for review. Contextual placement — choosing slots by surrounding content rather than by who the user is — sits outside the personalization the rule governs, and content-derived signals appear in the policy's guidance as an allowed basis for related suggestions. Interest-based personalization is available too, but only with three conditions stacked together: the advertiser must hold every right needed to use audience data such as Cookie lists; the ad must carry a notice that it is personalized to the user's interests, such as the Ad Options icon; and the parties involved must follow applicable industry self-regulatory principles — the Digital Advertising Alliance's online behavioral advertising principles in the US, or the IAB Europe framework in Europe.
A working sequence for a card campaign
Start by classifying the product rather than the campaign name; a co-branded airline card, a secured card, a store card, and a debt-consolidation offer all read as credit-related. Inventory every audience signal in the account — demographic layers, exclusions, lookalike seeds, ZIP radii, uploaded lists — and mark each against the prohibited set. Split the account into contextual and personalized placements so restricted signals only touch the part of the buy where they are allowed. Confirm data rights and the in-ad notice for any Cookie-list audience, and confirm the notice actually renders. Then check the surrounding disclosures: the privacy policy must state what data Google products cause to be collected, shared, and used, including third-party cookies, web beacons, and IP addresses, and should link users to Google's explanation of how it uses data from partner sites and apps.
Precise location is a separate obligation
Precise location adds another layer. If a campaign collects, processes, or discloses information that identifies or can infer precise location — GPS, Wi-Fi, or cell-tower data — policy requires a notice through an interstitial or in-the-moment prompt covering the purposes, including personalization, analytics, and attribution and possible partner sharing; explicit opt-in before collection; encrypted transmission to Google; and disclosure in every applicable privacy policy.
Where campaigns break in practice
Three failures recur. Audience reuse: a compliant card campaign inherits a non-compliant list from an earlier brand campaign and nobody re-screens it. Traffic-source mismatch: a lead-generation partner promises a card offer the landing page does not deliver, or makes a promise outside the issuer's control; Google's examples treat promised loans and a no-credit-check account opening as egregious misrepresentation. Creative ambiguity: a card ad shaped like a navigation element or download link invites a deceptive placement finding.
Suitability, and the boundary you should not cross
Suitability follows from the same facts. A national issuer with broad contextual creative can operate almost unchanged, because the restriction rarely bites. A local institution whose media plan depends on tight geography needs a different buy and, realistically, legal review before launch. An affiliate or lead-generation publisher carries the most exposure, since it controls both the traffic source and the landing page. None of this is credit law: these are platform rules, and meeting them does not establish compliance with fair lending, disclosure, or consumer-protection obligations. They also vary by market, with the EU user consent policy, COPPA obligations for child-directed properties, and other regional requirements sitting alongside the US and Canada credit-category rule. Enforcement is real: Google may suspend services, require an implementation to stop or change, or exercise rights under its service terms, and policies may be revised at any time with responsibility for staying current resting on the advertiser. Novel edge cases belong with qualified counsel rather than a blog post.
The next action
Before the next flight, pull one card campaign's audience report. Flag every age, gender, parental-status, marital-status, and postal-code signal attached to it, move those signals off the card line, and document why each remaining audience is either contextual or a properly disclosed interest-based list. That single pass is the difference between a campaign that survives review and one rebuilt under pressure.
研究の知恵