I have high confidence that Google does
not dip into Analytics data for its own uses without permission. I am an analytics consultant by profession, so this opinion is colored by the old adage about not understanding something that prevents your paycheck. But it is also colored by a decade of experience with the technical and organizational capabilities and limitations of the tool. Let me lay out my reasoning.
1. Legal and contractual liability.
For the Analytics service, Google is a Processor under GDPR and a Service Provider under CCPA. This means that legally, the only thing they are allowed to do with the data is provide the service requested by their customers.
Many enterprise-level customers require this as a condition of using Google Analytics. If they were to breach this confidence, it would probably result in them losing the enterprise space as a whole.
2. Google Analytics data is first-party data.
There are no means for Google to stitch together panopticon view of a user from the GA data from different companies. The user identifier is a first-party cookie, which is not shared between sites. There are no side-channels. Believe me, I literally spend at least five hours every week staring at hits in the Network tab, and I know where every piece of data comes from and how it gets processed. Cookies are not shared between sites except manually, and then only between sites operated by the same company.
3. Low signal-to-noise ratio.
The median Google Analytics implementation is a dumpster fire. When I engage with a new website, it's actually more common than not that they have double-tracking (or triple or more) on at least some pages, which completely kills the accuracy of bounce rate and time-on-page metrics. Even "good" implementations have a huge amount of variability between the data.
4. They can probably get the data elsewhere.
Google acts as a Controller for several of its other products (notably, Google Ads aka AdWords), meaning that it explicitly acknowledges it does use the data for its own purposes. And Chrome syncs your browsing history to your Google account. While Google Analytics would get them extra coverage, the cost-benefit doesn't seem worthwhile to me, especially consider the GDPR angle.
5. That's not why it's free
There's a common theme in posts like these about "why do you think Google gives GA away for free?" implying that they do it for the data.
Website analytics is a strategic compliment to website advertising. If people can see how much money they make from ads (and moreso, optimize how much money they make from ads), then they will buy more ads. Google makes money from Analytics as a strategic compliment. They do not need to acquire your data for it to be profitable.
Nowadays it's also an integration point with other services in the marketing cloud. See "caveats" below.
CAVEATS
Everything above is about the "default" Google Analytics installation, how it works out of the box. Google Analytics allows you to share data with Google in a variety of way, and actively encourages you to do so for several of those. I'll enumerate the specific points where a particular configuration of Google Analytics has significant privacy impacts.
1. Advertising Features.
This establishes a "cookie match" between the first-party GA cookie and the third-party DoubleClick cookie. Meaning it connects your GA data to Google's own data.
2. Google Ads integrations
This establishes several data connections to the Google Ads dataset, in both directions. Google explicitly acknowledges they act as a Controller for this integration, i.e. it's their data know and they can use it.
3. Google Signals
Hoooooo boy.
This is the setting that explicitly connects data to a user's Google Account. If a user is logged in to Google in Chrome (meaning logged in to the browser), then Google Analytics can use their account as the identity signal instead of a cookie. So the data from this one actually could be aggregated across different GA properties. The Google Account can also be used as the basis for targeting advertising.
Concluding Thoughts
Using Google Analytics "feeds the beast" insofar as it continues to cement Google's hegemony on the Internet. If you want to ditch GA for that reason, I completely sympathize. But saying it "feeds the beast" in that Google actually acquires that data and uses it, borders on a conspiracy theory. There are plenty of good and valid reasons to ditch GA based on principles, and on statements that can be backed up on evidence. There's no need to overreach.
GA is overkill for most small websites. Its main value is to integrate with Google advertising products (to re-iterate: the buttons that do that are off by default but very easy to press). I don't think that logfile parsing is as accessible as many people seem to believe, but there's now a strong landscape of privacy-conscious analytics tools that didn't exist five years ago, which will provide at least the simple metrics that personal websites actually need.
The web would probably be better if Google Analytics stopped being the "default." But that's more about the monoculture of available tools, rather than extending Google's ubiquitous surveillance apparatus.