FWIW after enabling non-phone 2FA, you can delete the phone number from your Google account - this doesn't remove 2FA.
By all means, use a throwaway number for signup / 2FA setup.
There are also laws against using data for some other purpose than it was collected for, but they're less well enforced, and it's pretty frequent that a sneaky T&C clause let's them use data for something else.
if(IsEUCitizen()) {
...;-)
And since they don't believe they will get caught (probably due to their track record with getting away with everything) there is no reason to care either.
And they don't have to be as blatantly stupid to send ads to the numbers, they could do as facebook, use it for a shadow profile.
Does the phone number serve another purpose besides security? If it does, then any assurances during sugn up that the information provided will only be used for the purposes it is disclosed would be false. Knowingly false statements made to induce someone to sign up could be considered misrepresentation.