" If all money goes into a general fund, there's no distinguishing "whose" money it is..."
Sounds to me like an easy accounting exercise.
So don't put it in a general fund. Make a Restricted Account for privacy research. Then when you do privacy research, just make sure it comes from there and only there. Also make sure none of Google's money gets in there. Standard GAAP should handle that like a snap.
"Money" sounds "fungible", but it's not. In many ways, "money" = "$ combined with the source and destination". Or you can do it in reverse, and make Google's money a Restricted Account, and run it backwards in that general fund money can fund anything, but pulling Google's money needs a senior management review that it is "not reasonably construed" as privacy research.
And yes, get Legal on this. Because for example you can tweak a footnote of almost anything to "improve privacy" even if the original research was "Study of Seattle's laws penalizing food wastes in trash."
The world is just becoming messy because those old fluid "neutral zones" are closing up and Flannery O'Connor was right, "everything that rises must converge".