I wonder how Google can possibly enforce this restriction. At best, it can yank oauth tokens from companies that misbehave AFTER that misbehaviour is made publi

I wonder how Google can possibly enforce this restriction. At best, it can yank oauth tokens from companies that misbehave AFTER that misbehaviour is made public. Better than nothing, I guess, but I don't believe that will help Google's perception much. In a few months, with the next cambridge analytica scandal involving Gmail, Google's spiel of 'it's their fault, they didn't follow our policy' won't really protect them except for a very legalistic POV. They will still lose in the court of public opinion.