They're not interested in the blobs, but in the people accessing them. Their whole suite of "free" developer tools (google analytics, google fonts, firebase, ...) are just a means to get information about what people do online.
Is this actually confirmed to be true? It would make a lot of sense for them to use free-tier GA data for profiling for Display ads etc, but has it ever actually been proven?
From https://developers.google.com/fonts/faq:
> The Google Fonts API is designed to limit the collection ... the Google Fonts API does not set or log cookies ... resource-specific domains...don't contain any credentials ... IP addresses are not logged.
From https://developers.google.com/speed/libraries/terms
> Google Hosted Libraries uses resource-specific domains... Requests unauthenticated ... Google Hosted Libraries only uses cookies as necessary for security and to prevent abuse ... Our systems are designed to remove HTTP referer information before logging
But analytics is a totally different story. https://policies.google.com/technologies/partner-sites
> when you visit a website that uses...Google Analytics...your web browser automatically sends certain information to Google. This includes the URL of the page you’re visiting and your IP address. We may also set cookies on your browser or read cookies that are already there. Apps that use Google advertising services also share information with Google, such as the name of the app and a unique identifier for advertising > Google uses the information shared by sites and apps to ... personalize content and ads you see on Google and on our partners’ sites and apps
So Google's policies do let them use 3rd party Google Analytics data to target ads.
But if they don't know what the blobs are, how does this help them? What can they tie it to?
The latitude and longitude coordinates of my current location have an sha1 hash of 0950e97d3a2e4839e39ad27deb2e852d498100ae. Is this useful information?
Do people really think Google just gives away things for free because they're being nice?
No, I assumed they gave the low tier away for free so people would eventually upgrade to the higher tiers.
(This is my first time building anything that involves a "backend", so I am pretty new to this!)
The SHA-1 thing is a complete non-sequitur, but since you asked, small amounts of data run through unsalted SHA-1 can be brute-forced very easily if someone cared find out where you are.
Sorry about that. I just couldn’t figure out where GP was going.
When you think of it like this you’ll stop asking questions like “what would they do with this piece of data?” Because the answer is always that it is a drop in a giant ocean of machine learning data.
The one and only genuine business reason for Google Fonts is to vacuum visits data from sites that don't have GA installed or by users who have GA blocked. That's it. Free cheese and all that.