I think the analogy is a poor one, but let's run with it anyway.
No, you are not responsible because the teen was not operating within the terms of the contract. You did not authorize or ask him to get stoned or run someone over.
Did google authorize (or even think) that their staff would contract with a company that would hire folks who would scan homeless people's faces in a way that was improper?
I don't know. I do know that in these kinds of situations, the contract typically spells out clearly what, exactly, the contractor is going to do and how, though.
Even though it is usually reviewed, the methods of data gathering are usually not spelled out in the contracts themselves. Instead you have a distribution of liability where the data broker agency assumes the risk of having gathered and/or sold the data incorrectly to the purchaser.
