IIRC a non-identifiable portion of the hash is given to the Google, then Google returns a bunch of potential matches with associated safety score, and then it’s up to the client to either block or not.