Well, their legal technique is a little more nuanced.
They are selling a product which is a legal and legitimate driver assistance tool which does not have autopilot.
You, as a user, can then modify the device by flashing unregulated code onto it to give it autopilot code, which is not advised by comma.ai *wink wink*
On public roads. We don't know how many they've done if you include closed track testing, but I'm willing to bet it's at least as many as they've done on public roads.
The real point is that Google isn't selling their system to consumers.
They are selling a product which is a legal and legitimate driver assistance tool which does not have autopilot.
You, as a user, can then modify the device by flashing unregulated code onto it to give it autopilot code, which is not advised by comma.ai *wink wink*