EFF Demands Investigation: Google Breaks Promise, Discloses User Data to ICE Without Notice
Featured image: Photo by Miguel Á. Padriñán on Pexels.
The Electronic Frontier Foundation (EFF) has launched a significant legal challenge against Google, accusing the tech giant of deceptive trade practices. At the heart of the matter is Google’s alleged failure to uphold a long-standing promise to notify users before disclosing their personal data to law enforcement agencies. This breach of trust has come to light through the harrowing experience of Amandla Thomas-Johnson, a Ph.D. candidate whose data was handed over to U.S. Immigration and Customs Enforcement (ICE) without prior warning, effectively denying him the opportunity to contest the subpoena [1], [2]. The EFF has formally requested the Attorneys General of California and New York to investigate Google’s practices, asserting that this is not an isolated incident but part of a systemic issue that undermines user privacy and due process [2].
Google’s Broken Pledge to Users
For nearly a decade, Google has publicly assured its billions of users that it would notify them before disclosing their personal data in response to government requests. This commitment, clearly stated on its Privacy & Terms page, serves as a critical safeguard, empowering users to protect their privacy and challenge potentially overbroad or illegal demands from law enforcement [1], [2]. The rationale behind this promise is straightforward: advance notice provides individuals with the chance to seek legal counsel, understand the scope of the request, and, if necessary, take action to quash or narrow a subpoena before their sensitive information falls into government hands. Many times, Google has indeed adhered to this policy, demonstrating its feasibility and importance [2].
However, the EFF’s complaints reveal a troubling pattern where Google has, through a hidden and systematic practice, likely violated this promise numerous times. This practice, which Google internally refers to as “simultaneous notice,” involves complying with a law enforcement request and then informing the user on the very same day that their data has already been disclosed. This effectively renders the “notice” useless as a protective measure, as the opportunity to challenge the request has already passed [2]. Such a maneuver fundamentally undermines the spirit and intent of Google’s public commitment, transforming a promised safeguard into a mere post-factum notification of a completed data transfer.
The Ordeal of Amandla Thomas-Johnson
The severity of Google’s alleged deception is starkly illustrated by the case of Amandla Thomas-Johnson. In September 2024, while studying in the U.S. on a student visa, Thomas-Johnson briefly attended a pro-Palestinian protest at Cornell University [1]. Months later, in April 2025, ICE sent Google an administrative subpoena requesting his data. Despite receiving the subpoena in April, Google waited until May 8, 2025, to comply with the request, disclosing Thomas-Johnson’s information to ICE. Crucially, later that same day, Google sent him an email stating that his account data had already been handed over to the Department of Homeland Security [1], [2].
Thomas-Johnson’s experience stands in stark contrast to that of an associate, Momodou Taal, who had previously received advance notice from Google and Facebook regarding data requests. In Taal’s case, the advance warning allowed him to challenge the subpoenas, which were subsequently withdrawn by law enforcement before any data was disclosed [1]. Thomas-Johnson had assumed he would be afforded the same opportunity. However, the language in his email from Google was definitive: “Google has received and responded to legal process from a law enforcement authority compelling the release of information related to your Google Account.” There was no opportunity to contest it; the disclosure was already a fait accompli [1]. This “simultaneous notice” practice, as explained by Google’s outside counsel in communications with the EFF, occurs when the company does not fulfill a subpoena within a government-provided artificial deadline, leading them to provide notice on the same day as compliance [2]. This technicality, however, has profound implications for user rights.
The data disclosed to ICE included subscriber information such as Thomas-Johnson’s name, physical address, IP addresses, and other personal identifiers, as well as session times and durations [1], [2]. While individual pieces of information might seem innocuous, together they form an incredibly detailed and invasive surveillance profile. IP logs can approximate location, physical addresses reveal where one lives, and session times can pinpoint when an individual was communicating with friends or family. Even without the content of messages, this aggregated data paints an intimate picture of a person’s life and activities [1].
The Personal and Societal Impact
For individuals like Amandla Thomas-Johnson, the consequences of such data disclosure are far from abstract. After his ordeal began, he left the United States, crossing into Canada. Yet, even abroad, he feels the lingering reach of U.S. authorities. Being investigated by the federal government is inherently intimidating, leading to profound personal questions about safety, future travel, and the potential for heightened scrutiny. He wonders if he is now a “marked individual” and if he can safely visit family in the Caribbean, particularly given his background as a reporter and Ph.D. student [1]. This chilling effect on individuals engaged in constitutionally protected activities, such as attending protests, is a grave concern, especially when agencies like ICE are involved [2].
Thomas-Johnson’s case underscores a broader and more alarming truth: anyone can become a target of law enforcement, and technology companies, with their vast stores of personal data, can inadvertently facilitate arbitrary investigations. The combination of state power, corporate data, and algorithmic inference creates a formidable system that is often opaque to the public, making it incredibly difficult to detect and even harder to challenge [1]. When a company like Google, entrusted with billions of users’ data, fails to uphold its promises, it erodes the foundation of digital privacy and empowers unchecked government surveillance. The ability to contest a data request is not a mere technicality; it is a fundamental aspect of due process and a vital defense against overreach and potential abuse of power.
EFF Demands Accountability
In response to Google’s systematic failure, the Electronic Frontier Foundation has taken decisive action, sending complaints to the Attorneys General of California and New York. The EFF urges these state officials to investigate Google for deceptive trade practices, emphasizing that the company’s broken promise to provide prior notice before disclosing user information to law enforcement constitutes a significant consumer deception [2]. As EFF Senior Staff Attorney F. Mario Trujillo stated, “Google should answer the question: How many other times has it broken its promise to users? Advance notice is especially important now, when agencies like ICE are unconstitutionally targeting users for First Amendment-protected activity. State attorneys general should investigate Google for this deception” [2].
The complaints highlight that Google received Thomas-Johnson’s subpoena in April but waited over a month to comply, yet still failed to provide him with advance notice. This delay, coupled with the eventual “simultaneous notice,” deprived him of the crucial opportunity he would have used to successfully challenge the subpoena [2]. The Attorneys General of California and New York possess the authority to halt deceptive business practices and seek financial restitution for damages caused by such practices. The EFF’s objective is to compel Google to end this deceptive behavior, honor its public commitment to advanced user notification, and be held accountable for its past failures [2]. This legal pressure aims not only to rectify the wrongs committed against individuals like Amandla Thomas-Johnson but also to establish a precedent that safeguards the privacy rights of all Google users against similar governmental demands in the future.
Key Takeaways
- Google is accused by the EFF of systematically breaking its promise to notify users before disclosing their data to law enforcement.
- Amandla Thomas-Johnson’s data was given to ICE without prior notice, preventing him from challenging the subpoena.
- Google’s “simultaneous notice” practice is cited as a deceptive method that bypasses effective user notification.
- The disclosed data, including IP addresses and session times, can create an intimate surveillance profile.
- The EFF has filed complaints with the California and New York Attorneys General, urging an investigation into Google’s deceptive trade practices.
- This case highlights the critical need for tech companies to uphold privacy promises and for individuals to have the opportunity to challenge government data requests.
Sources
- [1] Google Broke Its Promise to Me. Now ICE Has My Data. (www.eff.org)
- [2] EFF to State AGs: Investigate Google's Broken Promise to Users Targeted by the Government (www.eff.org)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
