Privacy advocates want Google to stop handing consumer data over to ICE

The Electronic Frontier Foundation (EFF) is asking the attorneys general of California and New York to investigate Google for deceptive trade practices, saying the tech giant fails to notify users before handing over their data to law enforcement agencies like ICE.

“For nearly a decade, Google has promised billions of users that it will notify them before disclosing their personal data to law enforcement,” the letter says. But it didn’t in the case of Amandla Thomas-Johnson, a PhD candidate at Cornell University who received a notice after Google handed his data over to ICE.

The EFF alleges that this isn’t an isolated incident, and that “through a hidden but systemic practice, Google has likely violated that promise numerous other times over the years.” The EFF says it has learned that Google sometimes sends data over without authorizing users “in order to save time and avoid delay with complying with a government demand.”

Last May, Thomas-Johnson, who was involved in pro-Palestine activism on campus, found out that the Department of Homeland Security (DHS) had subpoenaed his personal email. Thomas-Johnson had left the country a month earlier because he feared deportation in light of the Trump administration’s targeting of student activists like Mahmoud Khalil, Mohsen Mahdawi, and Rümeysa Öztürk. Since Google had notified him that DHS subpoenaed his personal email, Thomas-Johnson assumed the government also sought access to his university account — but when he asked Cornell, he received no response.

“This is the big question — whether they were using our [Cornell] emails to track us as well,” Thomas-Johnson told The Cornell Daily Sun.

At the time, a Google spokesperson told the Sun that its “processes for handling law enforcement subpoenas are designed to protect users’ privacy while meeting our legal obligations.” The spokesperson said Google reviews “all legal demands for legal validity, and we push back against those that are over broad or improper including objecting to some entirely.”

Google told the Sun that Thomas-Johnson’s subpoena requested basic subscriber information and didn’t include the contents of his email.

Thomas-Johnson shared records with the Sun showing that his information was accessed under federal communications law 18 USC 2703(c)(2), which “may require” communications providers to hand over users’ address, telephone number, telephone connection records “of session times and durations,” and credit card or bank account number.

But the EFF maintains that administrative subpoenas like the one DHS issued for Thomas-Johnson’s are an abuse of authority and a violation of his First Amendment rights. Moreover, these subpoenas aren’t approved by a judge; companies can refuse to comply with them and face no repercussions for doing so.

“Google should commit to ending its deception and pay for its past mistakes,” the EFF said in its letters to California and New York. The organization is asking the states to investigate Google’s practices and seeks injunctive relief, which includes civil penalties of up to $2,500 per violation in California.

Correction, April 15th: An earlier version misstated Amandla Thomas-Johnson’s status at Cornell, and which of his emails was accessed by ICE. He is a current, not former PhD candidate, and the EFF letter concerns his personal, not university, Gmail account.