TL;DR: Google has a published policy promising to notify users before handing their data to law enforcement. When ICE sent an administrative subpoena for PhD student Amandla Thomas-Johnson's data in April 2025, Google handed over his IP addresses, physical address, account identifiers, and session data, without telling him first. ICE didn't have a warrant. There was no court-ordered gag order. Google just did it anyway. Thomas-Johnson is now living in exile in Switzerland. The EFF has filed deceptive trade practice complaints with the California and New York Attorneys General.
What Google's Policy Actually Says
Go to Google's Privacy & Terms page right now. It's still there. Google promises: "When we receive a request from a government agency, we send an email to the user account before disclosing information" [1].
That promise has been on Google's website for nearly a decade. It's the reason billions of people trust Google with their email, their search history, their location data, their photos, their documents. Google told you they'd give you a heads-up if the government came knocking.
Google does list exceptions to this policy. If a court issues a gag order, Google says they can't notify you. That makes legal sense: a judge reviewed the situation and decided notification would compromise an investigation. Fine.
But here's what matters: the exceptions Google lists are narrow and specific. And none of them applied here.
What Google Actually Did
In April 2025, ICE sent Google an administrative subpoena demanding data on Amandla Thomas-Johnson, a PhD student and former journalist. Google complied in May 2025. The data they handed over included [1][2]:
- IP addresses
- Physical address
- Account identifiers
- Session times and durations
Thomas-Johnson described this package as "a detailed surveillance profile" that reveals location patterns, where someone sleeps, and the timing of their communications [1].
Google didn't notify him before complying. They used what the EFF calls "simultaneous notice," complying with the subpoena and sending the notification at the same time, giving Thomas-Johnson zero opportunity to challenge the request before his data was already in ICE's hands [2].
ICE had "requested" that Google not notify Thomas-Johnson. But that request wasn't a court order. It wasn't enforceable. It wasn't mandated by any judge. ICE just asked nicely, and Google said "sure" [1][2].
That's the whole story. ICE asked. Google folded. A student lost his data and his country.
Who Is Amandla Thomas-Johnson
Thomas-Johnson is a dual British and Trinidad and Tobago citizen. He was a PhD student and a former reporter who had published work in Al Jazeera and The Guardian. In September 2024, he briefly attended a pro-Palestinian protest at Cornell University [1][3].
That was enough.
After President Trump issued executive orders targeting students who protested in support of Palestinians, Thomas-Johnson's visa was revoked. Federal agents visited his home and interrogated people about his whereabouts. He fled, first to Canada, then to Switzerland, where he remains in exile [1][3].
"With their massive stores of data, technology companies can facilitate those arbitrary investigations," Thomas-Johnson told the EFF. "Who, exactly, can I hold accountable?" [2]
A five-minute protest turned into visa revocation, a federal investigation, a data dump to immigration enforcement, and exile from the country where he was earning his PhD. And Google, the company he trusted with his data, made it easier.
The Legal Gap: Administrative Subpoenas vs. Warrants
This is the part that should bother you most.
ICE didn't get a warrant. They didn't go to a judge. They didn't present probable cause to anyone in the judicial branch. They used an administrative subpoena, a document that federal agencies issue internally, with zero court oversight [3].
The difference matters:
- A warrant requires a judge to review the evidence, find probable cause, and sign off. The Fourth Amendment requires this for searches and seizures.
- An administrative subpoena is a letter from a federal agency. No judge reviews it. No probable cause is established. The agency just stamps it and sends it.
Here's the critical detail: companies are not legally required to comply with administrative subpoenas the way they are with court orders. Google had every right to push back. They could have challenged the subpoena. They could have asked a court to review it. They could have demanded a warrant.
They chose not to.
This is a business decision, not a legal requirement. Google decided that maintaining a smooth relationship with ICE was worth more than keeping a promise to a PhD student.
EFF's Complaint: Deceptive Trade Practices
On April 14, 2026, the EFF filed complaints with the California and New York Attorneys General asking them to investigate Google for deceptive trade practices [2].
The argument is straightforward: Google published a policy promising user notification. Users relied on that promise when choosing to store their data with Google. Google broke that promise. That's textbook deceptive trade practice.
F. Mario Trujillo, EFF Senior Staff Attorney, put it bluntly: "Google should answer the question: How many other times has it broken its promise to users?" [2]
That question is the real bombshell. Thomas-Johnson's case only came to light because the EFF got involved. How many other people had their data handed to ICE (or the FBI, or DHS, or any other agency) without the notification Google promised? Google isn't saying.
The EFF's complaint highlights that Google's use of "simultaneous notice" defeats the entire purpose of the notification policy. The point was to give users time to challenge requests. Sending an email the same day you hand over the data is notification in name only [2].
What This Means for Every Google User
You probably have a Google account. You probably use Gmail, Google Calendar, Google Maps, Google Drive, YouTube. Google knows where you sleep, where you work, who you talk to, what you search for, what you watch, and where you go.
Google told you they'd let you know before giving that information to the government. They lied.
If Google broke this promise for one student who attended a five-minute protest, they can break it for you. There's no mechanism to verify that Google actually notifies users. There's no audit. There's no enforcement. Google's notification promise is entirely voluntary, and now we know exactly how much that voluntary promise is worth.
The trust model for Big Tech privacy policies just collapsed. These aren't contracts. They aren't regulations. They're marketing copy that companies can ignore whenever it's convenient.
What You Can Do to Protect Yourself
Audit Your Google Account
Go to myaccount.google.com/data-and-privacy and see what Google has on you. Download your data archive. Then start deleting what you don't need stored there: location history, search history, YouTube watch history.
Remove Financial Data
Unlink bank accounts and credit cards from your Google account unless you absolutely need them for active subscriptions. Review at myaccount.google.com/payments-and-subscriptions. In Thomas-Johnson's earlier subpoena, Google even handed over bank and credit card numbers.
Compartmentalize
Don't use one Google account for everything. Use separate accounts (or separate providers) for different parts of your life. If one account gets subpoenaed, the others aren't automatically swept up in the same request.
Switch to Privacy-First Providers
Use ProtonMail for email. Use Signal for messaging. Use a VPN that doesn't log. The less data a company stores, the less they can hand over, regardless of their promises.
References
- EFF: "Google Broke Its Promise to Me. Now ICE Has My Data." (April 14, 2026)
- EFF: EFF to State AGs: Investigate Google's Broken Promise to Users Targeted by the Government (April 14, 2026)
- The Intercept: Google Fulfilled ICE Subpoena Demanding Student Journalist's Bank and Credit Card Numbers (February 10, 2026)
Published: April 25, 2026