EFF urges state probe into Google over undisclosed data sharing with ICE

The Electronic Frontier Foundation (EFF) has filed complaints with California and New York authorities accusing Google of deceptive practices, alleging that the company failed to notify users before handing their data to law enforcement.

The case centers on a Ph.D. student whose information was shared with US Immigration and Customs Enforcement (ICE) without prior warning, contradicting Google’s long-standing privacy commitments.

The complaints, submitted on April 14, 2026, were authored by EFF Senior Staff Attorney F. Mario Trujillo on behalf of Amandla Thomas-Johnson, a Cornell University Ph.D. candidate. According to the filings, Google disclosed Thomas-Johnson’s account data to ICE on May 8, 2025, in response to an administrative subpoena, but only notified him after the disclosure had already occurred, eliminating his ability to challenge the request in court.

EFF’s investigation indicates this was not an isolated incident but part of a broader internal practice. The organization says Google employs what it calls “simultaneous notice,” a process in which the company complies with legal demands and informs users on the same day, rather than in advance. This approach, EFF argues, undermines users’ ability to contest potentially unlawful or overbroad requests.

Google receives tens of thousands of law enforcement data requests annually, including 28,622 subpoenas in the first half of 2025 alone. Its publicly stated policy promises users advance notice of government requests unless specific exceptions apply, such as emergencies or court-issued gag orders.

In Thomas-Johnson’s case, none of those exceptions were present. Documents reviewed by EFF show ICE issued the subpoena on April 1, 2025, with a requested response deadline of 10 days. The subpoena sought basic subscriber data, including name, address, IP logs, and session information, details that can be used to reconstruct a user’s movements and online activity. A copy of the subpoena included in the exhibits also contains a non-binding request asking Google not to notify the user, rather than a legally enforceable gag order.

Despite having more than a month to respond, Google neither challenged the request nor notified the user in advance. Instead, it complied on May 8 and sent a post-disclosure email from a “no-reply” address to Thomas-Johnson, informing him that his data had already been handed over. A screenshot of that notification included in the complaint shows the company directing the user to contact the government agency for further details rather than providing the subpoena directly.

EFF argues that this practice deprived Thomas-Johnson of the opportunity to file a motion to quash the subpoena, an action that has led to withdrawals of similar requests in other cases. The organization also claims the subpoena itself contained legal deficiencies, including missing required fields such as a “Title of Proceeding,” and may have targeted constitutionally protected protest activity.

The advocacy group is now calling on state regulators to investigate Google for deceptive trade practices and seek penalties or restitution where appropriate. Under California law, violations could carry fines of up to $2,500 per incident, while New York law allows for injunctive relief and financial damages.