> Legal and contractual liability
I disagree. The GDPR consent prompt Google has implemented on their websites is not compliant with the regulation, and Google have a history of dark patterns elsewhere when it comes to privacy that may also run afoul of the regulation.
Contractual obligations was supposed to prevent Facebook from breaking their promise of not using 2FA phone numbers for advertising purposes, and we all know how that ended up.
Ad targeting involves so many factors that Google can very well use the analytics data for it and still maintain plausible deniability as it would be impossible to prove this from the outside, so the risk is limited compared to the potential rewards.
> There are no means for Google to stitch together panopticon view of a user from the GA data from different companies
Having a view over the entire web would allow you to track user sessions across websites with just IP addresses, browser fingerprinting and heuristics. Cookies are not necessary for this.
> Low signal-to-noise ratio.
I don't think Google dips into individual analytics events; that would indeed be vulnerable to noise plus would require understanding how every site uses analytics and what events represent what. I think they just get a general metric such as "user X is interested in the general category of your website" or "user X is active during these times of day" or "user X is often connecting from this IP, from which user Y is also frequently seen, thus they probably live nearby or together".
> They can probably get the data elsewhere.
They do, which makes this so much worse because it gives them plausible deniability. There's no way to prove with any certainty that they are/aren't doing this because the data could come from multiple different sources instead, but there's also no reason to believe GA is not one of these sources (even if it's only used to merely confirm the accuracy of other sources' data).
> That's not why it's free
If analytics was a loss leader for their advertising product, they could very well include it as part of advertising - setting up an ad account (and maybe depositing some $$$) gives you access to analytics. At this point they also have a lot of "freeloaders" who don't use/need advertising and use GA which it would make sense to kick out now that it's clear they will never convert to an advertising customer. They don't do neither of these things, and are happy to crunch gigantic amounts of data for absolutely zero revenue. This doesn't make sense unless they gain something from it internally, and their business model incentivizes them to do so.