> What’s important from a user perspective ... I'd say that's important for a very tiny subset of users. For most users, the main question is whether the devic

> What’s important from a user perspective ... I'd say that's important for a very tiny subset of users. For most users, the main question is whether the devices are useful. I have them, and I'm not sure myself. For the users who would want to verify that their stuff isn't being used any way they don't like, it's hard to say what could practically be done to convince them. Even if Google explained the inner workings of its privacy protection systems in detail (and it has, in some various contexts), you still can't watch the code running and verify that it's doing what Google says. Short of building from source and running it yourself, there's no way to verify that things are behaving as you desire. Not using devices in this class is the only option, I guess, at least until it becomes practical to move all the computation on prem, and until someone has an economic incentive to build a system with that feature.