[DashAnimal]

This seems problematic to me. Beyond just caching issues, did you ever get permission from users to store their personal data? They gave google permission, but not you.

[abraham]

The users are going through an OAuth flow and creating an account. Presumably they are agreeing to a ToS as part of that.

[mattmanser]

It even says in the OAuth flow that the company is requesting your profile image.

[arcfour]

It's a public photo. What's wrong with downloading it?

[yallpendantools]

Folks, read yourself some GDPR for the greater good. Even just https://gdpr-info.eu/art-4-gdpr/

Public data can be personal data and anyone doing the same as TFA is making itself a liable processor. But, aren't you a processor by using OAuth in the first place? Yes but with what TFA is doing you have a greater liability surface.

(IANAL but I cite GDPR because the broad concepts apply to data privacy laws in other jurisdictions. See also: https://en.wikipedia.org/wiki/Brussels_effect)