Privacy preserving federated learning is a thing - essentially you train a local model and send the weight updates back to Google rather than the data itself....but also it's early days so who knows what vulnerabilities may exist