Because they've made public statements to that effect, including in the privacy policy.
Now, your next question is presumably going to be "why don't they just lie?".
First, the lie would be very expensive. What do you think privacy regulators around the world would think of it? What do you think that lying to customers about how their data is used would do to the their $25 billion / year enterprise business?
Second, the lie would get discovered very quickly, because somebody would leak it. Plenty of much less serious things seem to leak weekly.
Third, there's very little to be gained by using the data and lying about this compared to the alternatives (say nothing; tell the truth; don't use the data). "Use the data but lie about it" is the absolute worst strategy possible.
You have a great deal more trust in Google than I. I think that if Google lied about this and got caught, the end result wouldn't be that damaging to Google.
Not saying they are lying, of course, but I don't think the incentives against it are as strong as you do.
But then, I'm skeptical enough about privacy policies that I've stopped reading them. The vast majority of them, including the ones I've read from Google, leave more than enough room for the companies to do pretty much anything they want with your data.
Like most privacy policies (I'm certainly not saying Google is unique here), they include phrases such as:
> We collect information to provide better services to all our users
Which is vague to the point of uselessness. Google could argue that pretty much any purpose they put that information to is to provide better services to all their users.
This sort of thing is why I ignore privacy policies. They tend to have quite a lot of verbiage of that sort. Even when they appear to solidly say they won't do something, often there's wording elsewhere that provides an exception.
The only way I'd put any stock in a privacy policy is if I have my attorney review it and explain to me what it really says (not being a lawyer, I am not capable of adequately interpreting contracts). Since it's entirely unrealistic to have an attorney review every privacy policy, the safest approach is to assume that they allow the company to do whatever they wish in the end.
And that's all assuming that companies put any real effort to adhering to their privacy policies.
EU Privacy Regulators already effectively made Google (and most other US companies) illegal 8 years ago, after Google et al. gave personal data away to the NSA in breach of EU's fundamental rights :
