Physical control is the only trust model with any kind of practical verifiability, so anything outside of that trust model is essentially blind trust.

This is obviously not a viable approach pragmatically (Mozilla must e.g. trust the hosting provider for their own data, distribution pipelines for their software, etc.), but these are all cases where reasonable precaution can be taken (signing, etc.). Google Analytics' APIs support no such measures.

> Are you concerned ... that they're entirely lawless?

This is a bit of a strawman / hyperbolic question. A company or its employees needn't be "entirely lawless" (whatever this extreme phrase even means), to be outside of regulatory compliance. And the latter is something Google are found to be on a very regular basis.

What's an example of Google sharing customer data when their contract says they're not allowed to?