Well, the GP comment already pointed out they do use it for Photos search. Generally if someone is paying for the disk space to store your data, that’s with some use in mind, at the very least serving it back.
Now, if you worry about some use you wouldn’t like… These are declared in open, if possibly too large, text in all the privacy policies. As a Googler I can tell you the internal bureaucracy for upholding these is dead serious. My product is used only by Google employees in their work duties, yet it took a couple months for us to get access to stats of our own UI. Something like an ads subsystem wanting to read a photos data field is likely to involve quarters of disputes with multiple lawyers.
