April 16, 2026 Electronic Frontier Foundation has filed complaints with California and New York regulators accusing Google of deceptive trade practices after it shared a user’s data with U.S. immigration authorities without prior notice. The case centres on a student whose information was handed to Immigration and Customs Enforcement following an administrative subpoena, bypassing Google’s longstanding policy of notifying users before disclosure.
The complaint stems from the experience of Amandla Thomas-Johnson, a Ph.D. student who attended a pro-Palestinian protest in 2024 while studying in the United States. In April 2025, ICE requested his account data, and Google complied the following month without notifying him in advance, removing any opportunity to challenge the request.
According to Thomas-Johnson, the disclosure came as a surprise weeks later through what appeared to be a routine email. Unlike previous cases where users were warned and able to contest subpoenas, the message confirmed that Google had already responded to a legal demand and released the data. “Google has received and responded to legal process from a law enforcement authority compelling the release of information related to your Google Account,” the notice stated.
The data requested was described as subscriber information, including IP addresses, physical address details and session activity such as timestamps and durations. While it did not include message content, the combination of these data points can create a detailed profile of a user’s movements and communications patterns. Thomas-Johnson’s legal team later obtained the subpoena, confirming the scope of the request.
Google has long maintained that it notifies users before handing over data in response to legal processes, except in limited circumstances. In this case, that safeguard was not applied. The Electronic Frontier Foundation argues that failing to provide advance notice contradicts public commitments designed to give users the chance to contest government requests.
The broader context highlights how administrative subpoenas, which do not require judicial approval in the same way as warrants, can still compel companies to release user data. Combined with large-scale data collection by technology platforms, these requests can enable detailed surveillance without direct user awareness.
For Thomas-Johnson, who left the United States after the incident, the effects extend beyond the disclosure itself. His account describes concerns about ongoing monitoring, travel risks and the difficulty of challenging decisions made across jurisdictions where corporate policies and government authority intersect.
