"And even if your business doesn’t have a large loyalty program, you can still measure store sales by taking advantage of Google’s third-party partnerships, which capture approximately 70% of credit and debit card transactions in the United States."
According to what they presented at a crypto conference, they went to great pains to avoid capturing personally identifiable transactions. The overall strategy is that Google Knows = Set A = (all ads shown for user X at Merchant Y) Merchant/Credit Card Proccessor Knows = Set B = (all $$$ paid by User X at Merchant Y), and that it is possible to cryptographically compute sum($$$ of A intersect B) without either side learning Set(User X).
Now whether you believe in the security of the algorithm and whether there are side channel leaks or attacks is another issue.
Edit: http://bristolcrypto.blogspot.com/2017/01/rwc-2017-secure-mp...
About 10 minutes in https://www.youtube.com/watch?v=ee7oRsDnNNc