I would expect for this data on Google's servers to be useless without some secondary data from me. (Forgive my encryption terminology naivety.) In a way similar to how I guess-understand Apple claims it can perform private AI computations with it's newish thingy.
Otherwise it's Google using my biometrics outside a device or environment, where I have NO reasonable expectation to own or control. (Sorry for the double negatives... How better to say this?)
What is this??!