For nearly a decade, Google promised users something specific: if law enforcement requested your data, Google would tell you first. That promise is dead. And Immigration and Customs Enforcement was the first to benefit. The Promise Google's Privacy & Terms page states: "When we receive a request from a government agency, we send an email to the user account before disclosing information." This was not a courtesy. It was a functional safeguard. Advance notice allows users to challenge overbroad or illegal subpoenas in court before their data is handed over. Without notice, there is no opportunity to contest. The data is gone before you know anyone asked for it. Google listed exceptions to this policy — if a court issued a gag order, for example, Google would comply with the court. But absent a court order, the promise stood. Until it didn't. The Case of Amandla Thomas-Johnson Amandla Thomas-Johnson is a dual British and Trinidad and Tobago citizen. He was a Ph.D. candidate at Cornell University studying in the US on a student visa. In September 2024, he briefly attended a pro-Palestinian protest on campus. The Trump administration had made its position clear. Federal power was being directed at international students engaged in political speech. Federal agents came to Thomas-Johnson's home looking for him. A friend was detained at a Tampa airport and interrogated about his whereabouts. Thomas-Johnson went into hiding for three months. He eventually left the United States, crossing into Canada at Niagara Falls. He believed that by leaving US territory, he had also left the reach of its authorities. He was wrong. In April 2025, ICE sent Google an administrative subpoena requesting his account data. The subpoena focused on subscriber information: IP addresses, physical addresses, session times and durations, and account identifiers. ICE "requested" that Google not notify Thomas-Johnson, but this request was not a court order. It carried no legal weight. Google handed over the data anyway. Without notice. Without giving Thomas-Johnson any chance to challenge the subpoena. Weeks later, in Geneva, Switzerland, Thomas-Johnson received an email from Google stating that his data had already been disclosed to the Department of Homeland Security. The language was final: "Google has received and responded to legal process from a law enforcement authority compelling the release of information related to your Google Account." He had not been accused of any crime. What ICE Got The subpoena requested routine subscriber information. Combined, these fragments form a detailed surveillance profile: IP addresses can be used to approximate physical location over time Physical addresses confirm where someone sleeps Session times and durations reveal when someone communicates and with what frequency Account identifiers link activity across services Even without message content, the picture that emerges is intimate and invasive. ICE now holds a timestamped map of Thomas-Johnson's digital life, obtained through a process he was never given the chance to challenge. The Pattern The EFF alleges Thomas-Johnson's case is not isolated. On April 14, 2026, the organization filed formal complaints with the California and New York Attorneys General, accusing Google of deceptive trade practices. The EFF states that "through a hidden but systemic practice, Google has likely violated that promise numerous other times over the years." Google's administrative subpoena process has become a backdoor for agencies like ICE to obtain user data without judicial oversight. An administrative subpoena does not require a judge's approval. It is issued by the agency itself. The only check on that power was Google's promise to notify users so they could challenge it in court. That check is gone. Why This Matters Now The political context makes this timing significant. The administration that received Thomas-Johnson's data had made explicit threats against international students engaged in protected political speech. ICE was not investigating a crime — it was monitoring dissent. Administrative subpoenas to tech companies have become a primary tool for identifying critics of government policy. When a company as large as Google removes the last procedural safeguard — user notification — the barrier between government inquiry and government surveillance collapses. The data request focused on Thomas-Johnson because he attended a protest. He was not charged. He was not a suspect. He exercised a constitutionally protected right, and Google handed ICE the data to build a file on him. What Google Says Google's exceptions to its notification policy are narrow. The company states it will not notify users if a court-ordered gag order is in place, if there is an emergency involving danger of death or serious physical injury, or in certain cases involving child safety. None of these exceptions applied to Thomas-Johnson's case. ICE requested non-notification. Google complied voluntarily. The request was not enforceable by a court. Google chose to break its own policy. The EFF's Response The EFF filed complaints with the California and New York Attorneys General on April 14, 2026, asking both states to investigate Google for deceptive trade practices. The EFF also sued DHS and ICE on April 22, 2026, demanding public records about their use of administrative subpoenas to identify online critics. "Google should answer the question: How many other times has it broken its promise to users?" said EFF Senior Staff Attorney F. Mario Trujillo. The answer matters. If Google has been silently complying with non-binding ICE requests to bypass notification, every Google user should assume their data is available to federal immigration enforcement on request — without warning, without due process, without any way to challenge it. What You Can Do Audit your Google data exposure. Use Google Takeout to see what the company stores about you. The data ICE obtained from Thomas-Johnson is the same data Google holds on every account. Request your own records. Under the Freedom of Information Act, you can request records of government subpoenas targeting your accounts. The EFF maintains guides on how to do this. Reduce your Google surface area. Move email to a provider that encrypts at rest. Use a browser that doesn't log your session times. Use a search engine that doesn't maintain account-level activity logs. Support the EFF. These complaints are the primary mechanism holding Google accountable. The outcome of the California and New York AG investigations will determine whether Google faces consequences for breaking its promise. Google's notification policy was never a gift. It was the minimum viable safeguard in a system where tech companies hold comprehensive surveillance dossiers on every user. When that safeguard disappears, the data is not hypothetical. It is already in ICE's hands. --- Audit what your browser reveals about you: Use our header auditor