I wonder if this is legal. In Europe, purchase data might be “sensitive data” according to the GDPR, and that means both Google and Mastercard could face seriously crippling fees.
Of course, the US is different, but even so, it’s not obvious that selling such data about individuals is legal. IANAL, but this is quite brazen.
