[Nextgrid]

This assumes you're trusting Google. Technically you are still sending a lot of data to them (IP address and persistent identifier, which would allow them to correlate other info they gather from other sources) and they have the capability to use it for nefarious purposes if they decide.

Google is a malicious actor as a result of their business model and has already demonstrated their willingness to breach the GDPR with the non-compliant tracking consent prompts they use on their services, so it isn't that far-fetched to believe they can also use data from other services in ways you don't expect, especially when they can have plausible deniability.