Google data-sharing under ICE scrutiny

Google handed data to ICE without user notice, advocates allege.

The Electronic Frontier Foundation has fired off letters to the attorneys general of California and New York, asking them to open investigations into Google for deceptive trade practices over how it discloses user data to law enforcement. The claim centers on a long-held promise—Google has said it would notify billions of users before sharing personal information with authorities. That promise, the EFF argues, was not kept in a case involving Amandla Thomas-Johnson, a former Cornell PhD candidate, who says he learned ICE had accessed his university email without any prior notice.

The EFF’s appeal frames the dispute as more than a single slip-up. In a posting that outlines the complaint, the advocacy group contends the lack of notice isn’t an isolated incident and suggests a broader pattern in how major tech platforms disclose data to government agencies. While the specific mechanics of how and when data is handed over can be murky—often tied to legal processes, court orders, or government data-sharing arrangements—the central accusation is clear: the company’s public assurances to users don’t always translate into how the data is actually shared with law enforcement.

For privacy advocates, the issue cuts to the heart of trust in digital services. Users are frequently told that they’ll be alerted before their information is turned over to authorities; when that timing is missed, it undermines the premise that individuals own their data and should be informed when it leaves their hands. The EFF argues that failure to honor that notification commitment could amount to deceptive trade practices, with California and New York equipped to probe such claims under state consumer-protection authority.

Google has long maintained a public stance around transparency with law enforcement, including publishing transparency reports and outlining the kinds of requests that arrive from agencies. Yet the Verge report notes a breach of the notice promise in the Thomas-Johnson case, which the EFF says is emblematic of a wider pattern. If verified, the discrepancy could elevate calls for tougher notification requirements and stronger enforcement against tech platforms that market privacy assurances while administering data disclosures that bypass those promises.

From a practitioner’s standpoint, several tensions are worth watching. First, there’s the recurring gap between marketing-facing privacy promises and the operational realities of data-sharing workflows. Second, regulatory risk could intensify if AGs decide to treat undisclosed disclosures as deceptive practices, potentially triggering settlements or remedial orders rather than criminal penalties. Third, universities, researchers, and enterprises relying on cloud ecosystems face renewed scrutiny over who can access campus or organizational data and under what conditions—especially when government requests intersect with academic or corporate accounts. Finally, consumer behavior could shift as users demand clearer, verifiable disclosures about data-sharing practices; scrutiny on big platforms may accelerate the push for more granular, user-friendly notices.

Authorities and Google have not fully disclosed the current status of these investigations or responses, leaving a cloud of uncertainty over the next moves. The Verge’s account frames this as a test case for how aggressively state officials will police deceptive privacy promises in the data-sharing era and whether platforms will be compelled to revise their disclosures and notification timelines to align with user expectations.

What to watch next: will California and New York pursue formal investigations or settlements with enforceable remedies? How will Google publicly respond, and will it adjust notification practices or privacy disclosures to close a presumed gap between promises and practice? And will this case push other tech firms to audit their own law-enforcement disclosure timelines—before more users experience a similar surprise?