Did he set up his device to upload his private data to Google, or did Google create an OS that automatically sent everyone's private data to their AI server for scanning without explicit consent?
(It is, granted, a bit pushy about it and will ask multiple times when you run it with an intrusive dialog.)
It's right there plain as day in the TOS. I don't know how people can use these products without understanding the contract they locked themselves into. /s