This Google announcement is repeated here in the belief that many companies may have missed it earlier.  As of May 17, 2011, AdWords policy has the following requirements for advertisers who solicit certain personal or financial information.

Advertisers who collect any of the following personal information must provide a clear, accessible explanation of how the information might be used, as well as a simple, effective way to opt out of future direct communications:

• Full name
• Email address
• Mailing address
• Phone number
• National identity, pension, social security, tax ID, health care, or driver's license number
• Mother's maiden name or birth date in addition to any of the above information

In addition, AdWords policy will require the following information to be transmitted securely over an SSL (https:) connection:

• Credit and debit card numbers
• Bank and investment account numbers
• Checking account numbers
• Wire transfer numbers
• National identity, pension, social security, tax ID, health care, or driver's license number