It's just the "Post hoc ergo propter hoc" fallacy. (Possibly also overactive pattern recognition; how many spams does he get about art at times unrelated to gallery visits?) Google does not sell such personal information to spammers (or anyone else).

If you visit non-Google websites, it's technically possible for people to discover relationships and target e-mails (e.g. if you entered your email address on website A and then visited website B, cookies can correlate the visits and, among other things, trigger e-mail; also malware and other privacy leakages), but Google does not use its information in the way alleged.

Disclaimer: I work for Google in privacy engineering, but I'm only speaking for myself based on information Google releases: https://privacy.google.com/#google-information.