EFF to State AGs: Investigate Google's Broken Promise to Users Targeted by the Government

Key Takeaways

• EFF urges California, New York AGs to probe Google’s notice breach
• ICE subpoena on Thomas‑Johnson fulfilled without prior user notification
• Google’s “simultaneous notice” sidesteps promised advance warning
• State AGs can pursue deceptive‑practice claims and restitution
• Case underscores privacy stakes of undisclosed law‑enforcement data requests

Pulse Analysis

Google has long advertised a user‑notification clause in its privacy policy, stating that it will email account holders before disclosing personal information to government agencies. That promise, first codified in 2017, was designed to give individuals a chance to contest overbroad subpoenas and protect First Amendment activity. The Electronic Frontier Foundation’s recent complaints allege that Google routinely violates this clause, citing the May 2025 ICE subpoena against Amandla Thomas‑Johnson, a Ph.D. candidate whose data was handed over without any advance alert. By framing the issue as deceptive trade practice, the EFF seeks to trigger state‑level enforcement that could force Google to amend its compliance procedures.

The practice the complaints label “simultaneous notice” occurs when Google meets a government deadline and sends the user‑notification email on the same day the data is transferred. While technically satisfying the policy’s language, the approach defeats the practical purpose of giving users time to seek legal remedies. This loophole raises questions about corporate accountability in the face of secretive law‑enforcement demands, especially from agencies like ICE that have been accused of targeting protected speech. If upheld, the allegations could set a precedent compelling other tech firms—Apple, Meta, Amazon—to reassess their own notice mechanisms.

State attorneys general in California and New York possess broad powers to curb deceptive business conduct and can seek monetary penalties or injunctive relief. A successful investigation could compel Google to publish transparent reporting on notice compliance and to establish an independent audit of past disclosures. Beyond litigation, the case fuels the ongoing policy debate over “law‑enforcement transparency” versus national‑security secrecy, a balance that legislators in Washington are beginning to address through proposed data‑request reforms. For privacy‑focused businesses and users alike, the outcome will signal how rigorously corporate promises to protect data are enforced in the digital age.