An unidentified watchdog organization is urging the Federal Trade Commission to investigate Google’s new advertising program Store Sales Management (SSM), which collects purchase data and shares it with advertisers, The LA Times reports

When Google announced the program in May, saying the “revolutionary” technology would track the credit and debit card purchases of 70% of United States consumers, allowing analysts to draw unprecedented correlations between online ad clicks and brick-and-mortar sales for the first time.

Google did not disclose the means by which it obtained the transaction data, nor did the company explicitly confirm that customers had consented to have the data shared. The company did say, though, that its “partners” had “the rights necessary” to use the information.

A confidential algorithm anonymizes and encrypts the data so that the identities of individuals remains private. The company maintains that it does not have access to the names and personal information of specific users and that it does not release the information of any individual Google user to the advertisers. Google presents the data in aggregate: it may say, for instance, that of the 20,000 people who clicked on an ad, 11% bought the product.

The complaint asks the FTC to investigate the encryption algorithm to ensure that it is ethical and secure. Allegedly, SSM’s encryption mechanism employs a technology called CryptDB, which has been breached before. In 2015, researchers hacked a healthcare database that was encrypted via CryptDB.

Presumably, one aspect of the investigation will look into whether Google itself indeed lacks the ability to trace purchase behavior to individual consumers. If individual purchase information is available, and consumers do not know how Google obtains it, then those who wish to maintain their privacy have no avenue by which to protect their information. The LA Times points out that purchase history can reveal a number of intimate details about a person, such as religious beliefs, medical conditions, etc.

Google says users can opt out of SSM at any time. Those who wish to do so can go to their My Activity page, click “Activity controls,” and then disable “Web & App Activity.” However, the complaint alleges that even with “Web & App Activity” turned off, Google collects server and click data.

Despite earlier claims that Store Sales Management was revolutionary, in response to the complaint, Google has said that the technology is “common.” Indeed, services such as amazon.com track customer purchases, and curate “recommended for you” sections, as well as other content tailored to a specific consumer. Yesterday, news broke of Starbucks’ plan to launch an app that will track customers’ purchases and make recommendations based on a staggering array of factors.

Google is taking a step forward by connecting online purchase data with brick-and-mortar. From an advertising perspective, those connections are valuable, for they are important data points that have hitherto been absent from advertising research.

Much of the trepidation on the parts of groups like the Rotenberg’s is born out of suspicion of the specific practices Google is using to collect the data. The internet behemoth has been secretive about those practices—understandably so, given that confidentiality protects security. Secretiveness, though, can also conceal unethical behavior. If Google is accessing individual purchase records without consumers’ knowledge or consent, it could easily use “security” as an excuse to block regulators’ efforts to investigate the system.

Google’s website claims services like SSM use users’ data to benefit users. In some ways, they do, and many users are grateful to have an experience tailored to their tastes. But, if consumers don’t know how or whether Google is obtaining and using their data, they have no volition to protect their own privacy as they see fit.

Some checks and balances are healthy in an environment where manipulation and deception can pad the bottom line. As prominent as Google is, those checks and balances could be should be employed to ensure the giant is acting responsibly.

“Google is seeking to extend its dominance from the online world to the real, offline world, and the FTC really needs to look at that,” said Marc Rotenberg, the organization’s exGecutive director.