I don't think Google "cares about" user privacy. I think they care about minimising any legal risk. These are two very different attitudes.
The only way a big company can somehow ensure that all teams are going to follow the privacy or any other policy is to force the teams to "align our data retention policies and tools to Google".
This is literally Google having process to ensure some privacy policy and op having issue with that.
Oh yeah. That's going to be entirely incompatible with how Google does business. Google's primary concern isn't even that their customers care about those things (although they do)... It's the Google is a giant target and there are significant legal consequences for doing things or failing to do things that a jury outside of Google's control will decide after the fact was something they "should have known better" about.
Startup companies end up concerned less about this because they have less to lose. A startup company isn't exactly "judgement-proof..." The wrong decision can certainly get them sued out of existence. but the odds of it happening are lower, because at the end of the day they have fewer assets to seize. There's a much smaller target on their backs and fewer high ticket lawyers for whom the possible compensation would justify taking the case. there's no such reasonable constraint on how much you could sue Google for... a case that a high ticket lawyer wins against Google will definitely pay for itself.