Google Broke Its Promise to Me. Now ICE Has My Data.
"Google had already disclosed my data without telling me. There was no opportunity to contest it."
[Amandla Thomas-Johnson for the EFF]
There’s an important distinction at the heart of this case.
The synopsis, from the EFF:
“In September 2024, Amandla Thomas-Johnson was a Ph.D. candidate studying in the U.S. on a student visa when he briefly attended a pro-Palestinian protest. In April 2025, Immigration and Customs Enforcement (ICE) sent Google an administrative subpoena requesting his data. The next month, Google gave Thomas-Johnson's information to ICE without giving him the chance to challenge the subpoena, breaking a nearly decade-long promise to notify users before handing their data to law enforcement.”
Subpoenas are legal orders compelling someone to either testify or produce evidence. They come in three broad flavors: civil, criminal, and administrative. Civil subpoenas arise from disputes between private parties (or between a party and the government in a non-criminal matter), typically over money, contracts, property, or rights. Criminal subpoenas are issued in the context of a criminal investigation or prosecution, where the government is pursuing charges against someone for violating criminal law. Administrative subpoenas are a legal grey area that sit in the middle. They’re issued by federal agencies (in this case, ICE, under the Department of Homeland Security) without prior approval from a judge or grand jury.
Statutory non-disclosure orders and national security letters are common in criminal and national security contexts; they’re rare-to-nonexistent in civil ones. If one exists, the subject can’t disclose that a subpoena was given or that they provided the information. Otherwise, they are free to notify.
The information here has often been given fewer Fourth Amendment protections under the third party doctrine. IP addresses, physical address, other identifiers, and session times and durations are metadata. US cell phone providers, too, will hand out this information with relatively little friction.
When your data is stored with a cloud provider like Google, prosecutors are most likely to ask Google for it, rather than you. If they’re issued a subpoena without a gag order, they’re supposed to notify you about it. If they’re issued one with, they can’t tell you about it in order to stay within the bounds of the law. Even without one, some companies may be tempted to comply in advance in order to stay on the government’s good side.
As is laid out in the linked piece, another student, Momodou Taal, was notified by both Google and Meta that his data was requested. Here, the system worked: because he was notified, he was able to fight off the order, and his data remained private. Amandla Thomas-Johnson didn’t receive the same courtesy.
Google is meant to notify users, if they can. If they didn’t, that’s a real problem. And it seems like that’s the case: that’s why EFF is going after them. The precedent here will matter a great deal for everybody’s privacy: commitments to notify should be enforceable. Hopefully regulators will hold that they are.
[Link]
