TL;DR: Google’s stated policy promises users it will “send an email to the user account before disclosing information” in response to government requests. The EFF just proved that’s not what happens. Instead, Google uses a practice called “simultaneous notice”: complying with the request and notifying you on the same day. By the time you get the email, your data is already gone. The EFF filed formal complaints with the California and New York attorneys general on April 14, 2026, asking them to investigate Google for deceptive trade practices. Potential penalties: up to $2,500 per incident under California law. Google received 28,622 subpoenas in the first half of 2025 alone.
The Promise Google Made You
Go read Google’s official policy on government data requests. It says, clearly: “When we receive a request from a government agency, we send an email to the user account before disclosing information” [1].
Before. Not “at the same time.” Not “after.” Before.
Google lists a few exceptions: emergencies, court-ordered gag orders, cases involving child exploitation. If none of those apply, you get notified first. That’s the deal. That’s the promise billions of users have relied on for nearly a decade [1][2].
The EFF says Google broke it.
What Actually Happened
On April 1, 2025, ICE sent Google an administrative subpoena demanding the personal data of Amandla Thomas-Johnson, a Ph.D. candidate and British journalist who attended a pro-Palestinian protest at Cornell University for five minutes in September 2024 [2][3].
The subpoena had a 10-day response deadline. It demanded subscriber information: name, address, IP addresses, session times, and other identifiers. It also included a request (not an enforceable court order) that Google not notify Thomas-Johnson [2][4].
On May 8, 2025, Google complied. It handed ICE everything it asked for. The same day, Google sent Thomas-Johnson an email: “Google has received and responded to legal process from a law enforcement authority” [2][4].
His data was already in ICE’s hands. There was nothing he could do about it.
“Simultaneous Notice”: The Trick That Makes Your Rights Disappear
The EFF’s investigation uncovered the mechanism: Google calls it “simultaneous notice.” Comply first, notify later, all on the same day [2].
It sounds like a minor technical distinction. It’s not. The entire point of advance notice is to give you time to file a motion to quash, a legal challenge asking a court to throw out the subpoena. That’s your right. Without advance notice, that right evaporates [2][4].
Thomas-Johnson’s case makes this painfully concrete. The ICE subpoena had legal deficiencies, including missing required fields like a “Title of Proceeding.” A court might have thrown it out. He never got the chance to ask [4].
And the gag order? ICE asked Google not to tell him. But it was just a request, not a court order, not legally enforceable. Google chose to treat it like one anyway [2][4].
28,622 Subpoenas in Six Months
This isn’t about one student. Google received 28,622 subpoenas in the first half of 2025 alone, according to its own transparency report [4].
How many of those got “simultaneous notice”? How many people found out their data was gone on the same day it was handed over? Google isn’t saying. The EFF is asking the attorneys general to find out [2].
If the practice is as widespread as EFF suspects, the penalty math gets ugly fast. California’s consumer protection law allows penalties up to $2,500 per incident of deceptive trade practices [2].
“Am I Now a Marked Individual?”
Thomas-Johnson didn’t just lose his data. He lost his sense of safety.
After federal agents visited his home and intimidated associates, he fled: first to Canada, then to Geneva. His visa was revoked. His friend Momodou Taal (who did get advance notice from Google and Facebook) had his subpoenas withdrawn before any data was turned over [2][3].
That’s the gap. Taal got warned. He fought back. The subpoenas went away. Thomas-Johnson got “simultaneous notice.” His data shipped same day [2].
“I believed that once I left U.S. territory, I had also left the reach of its authorities. I was wrong,” Thomas-Johnson wrote in his EFF essay [2].
“Am I now a marked individual?” [2]
This Is Bigger Than One Case
We covered the initial Thomas-Johnson subpoena back in February, when The Intercept and TechCrunch first reported that Google gave ICE his bank account numbers, credit card details, IP addresses, and a full service inventory. That reporting focused on administrative subpoenas: the fact that no judge signed off on any of it [5][6].
The new EFF filing goes further. It’s not just about ICE’s overreach. It’s about Google’s complicity: a systematic practice that makes your legal rights worthless by design.
Think about what Google’s “simultaneous notice” means in practice:
- A government agency sends a subpoena, no judge needed
- The agency asks Google not to tell you, no court order needed
- Google complies with both requests
- You get an email after your data is already gone
- Your right to challenge the subpoena has expired
That’s not a notification policy. That’s a notification performance.
What You Can Do
Google isn’t going to fix this on its own. But here’s what you can do right now:
- Minimize your Google footprint. The less data Google has, the less it can hand over. Review your Google Data & Privacy settings and delete what you don’t need stored.
- Turn off web & app activity tracking. Go to myactivity.google.com and turn off location history, web & app activity, and YouTube history.
- Use alternatives for sensitive communications. Don’t use Gmail or Google Voice for anything you wouldn’t want the government reading. Use Signal or ProtonMail.
- Don’t store financial data in Google. Remove saved payment methods from Google Pay. Don’t link bank accounts.
- Read the EFF’s complaint. The full filing is at eff.org. If you’re in California or New York, your attorney general needs to hear from you.
Sources
- Google, “How Google handles government requests for user information,” Google Privacy & Terms
- EFF, “Google Broke Its Promise to Me. Now ICE Has My Data,” April 14, 2026
- TechCrunch, “Google sent personal and financial information of student journalist to ICE,” February 10, 2026
- EFF, “EFF to State AGs: Investigate Google’s Broken Promise to Users Targeted by the Government,” April 14, 2026
- The Intercept, “Google Fulfilled ICE Subpoena Demanding Student Journalist’s Bank and Credit Card Numbers,” February 10, 2026
- CyberInsider, “EFF urges state probe into Google over undisclosed data sharing with ICE,” April 15, 2026