Data gathering/brokering and payment information security are not really connected. PCI compliance standards are well standardized and fairly strict.

I would trust Google to handle payment information securely over any ‘media’ company.

If personal data was regulated at even the fraction of what payment data goes through we would all be better off.