A Cornell Ph.D. student briefly attended a pro-Palestinian protest at a campus career fair in September 2024. Months later, Homeland Security Investigations, the intelligence arm of ICE, subpoenaed Google for data tied to his account. Google complied before warning him, according to reporting from The Intercept, the student's own EFF account, and an EFF complaint summary.

The student is Amandla Thomas-Johnson. The Intercept reports that he and fellow Cornell graduate student Momodou Taal went into hiding after the Trump administration began targeting international students who had spoken out about Israel's war on Gaza. Thomas-Johnson later described federal agents coming to his home, a friend being detained at the Tampa airport and questioned about his whereabouts, and eventually fleeing the United States.

The timeline matters here. The Intercept reported that HSI sent the subpoena to Google on March 31, 2025. EFF says Google received it in April, complied on May 8, and only then sent Thomas-Johnson an email saying it had already responded to law enforcement process. That was not notice in any meaningful sense. It was a receipt after the handoff was complete.

He never got a chance to challenge it. The data was already gone.

Here's why this matters: Google has promised users for nearly a decade that “when we receive a request from a government agency, we send an email to the user account before disclosing information.” That promise exists for a reason. Advance notice gives you a chance to go to court, to challenge the subpoena, to argue that the request is overbroad or politically motivated. When users get that chance, it works. The Intercept reported that Google and Meta gave Taal advance notice of subpoenas for his accounts, and ICE later withdrew them.

In Thomas-Johnson's case, Google skipped the notice. The subpoena landed, Google sat on it for over a month, and then complied without a word until the data was already in ICE's hands.

ICE didn't need a warrant for this. An administrative subpoena is an investigative tool that federal agencies can issue without a judge's approval, without probable cause, and without any judicial oversight. ICE invoked 8 USC 1225, a provision that gives immigration officers broad authority to demand documents “relating to the privilege of any person to enter, reenter, reside in, or pass through the United States.” One study found ICE uses this same authority hundreds of times each year to demand data from tech companies.

Here's the thing: companies are not legally required to comply with administrative subpoenas. There is no penalty for refusing. If Google had said no, ICE's only option would have been to drop it or go to court, where ICE would have needed to justify the request to a judge. When companies push back, the government often backs down. The ACLU helped anonymous Instagram users fight off similar DHS subpoenas in California and Pennsylvania that sought to unmask accounts tracking ICE raids. DHS withdrew both.

Google's outside counsel told the Electronic Frontier Foundation that the company has an internal practice called “simultaneous notice,” where it complies with a subpoena and notifies the user on the same day when a government deadline approaches. The EFF's response was blunt: this is not notice. This is a receipt after the fact. And through this hidden practice, Google has likely broken its promise to users “numerous other times over the years.”

On April 15, the EFF filed formal complaints with the California and New York attorneys general, asking them to investigate Google for deceptive trade practices. The legal theory is straightforward: Google publicly promised users advance notice before handing their data to law enforcement. It didn't deliver. The FTC's Cambridge Analytica case established that misleading users about data practices constitutes deceptive trade practices. California law provides for civil penalties of up to $2,500 per violation.

Google's spokesperson offered the usual corporate non-answer: “Our processes for handling law enforcement subpoenas are designed to protect users' privacy while meeting our legal obligations.” Read that again. It says nothing. The question isn't whether Google's processes are “designed” to protect privacy. The question is whether they actually protect anyone. In Thomas-Johnson's case, they didn't. Google had over a month between receiving the subpoena and complying. It chose not to use that time to warn him.

Some will argue that Google was just following the law, that it had no choice. That's false. Companies refuse administrative subpoenas regularly. Apple fought the FBI in federal court rather than build a backdoor into a mass shooter's iPhone, and the government backed down rather than face a ruling against it. Meta gave Taal advance notice of his subpoena, which is exactly what gave him time to fight it and win. Google could have done the same for Thomas-Johnson. It chose not to.

The ICE subpoena was broader than the data Google says it ultimately produced. The Intercept, which obtained a copy of the subpoena, reported that ICE asked for Thomas-Johnson's name, address, IP addresses, phone numbers, session times and durations, the list of Google services tied to the account, and even credit card and bank account numbers. Google's attorney later said the company produced only “basic subscriber information,” not message contents, communications metadata, or location information. Even that narrower category can still be invasive. As Thomas-Johnson wrote for EFF, subscriber records can expose where you sleep, when you were online, and who the government thinks it needs to find next.

This case is not really about one student. It's about the pipeline. The federal government doesn't need to hack your devices or break your encryption when companies like Google will simply hand your data over on request. ICE sends an administrative subpoena, no judge required. Google receives it, doesn't notify you, and ships the data. The entire apparatus of constitutional protection, the Fourth Amendment, the requirement for warrants and probable cause, gets bypassed because a corporation decided to comply rather than push back.

And it's working exactly as designed. Thomas-Johnson is now in Dakar, Senegal, wondering if he's “a marked individual.” Other international students are watching what happened to him and deciding whether it's worth attending a protest, writing an email, posting online. The surveillance state doesn't need to monitor everyone. It just needs to make enough examples that everyone else self-censors.

Google built a $2 trillion empire on collecting data about billions of people. It promised to tell you before handing that data to the government. It broke that promise, not because it was legally forced to, but because choosing to comply was easier than choosing to fight. The people who pay for that choice are the ones with the most to lose: students, activists, immigrants, anyone whose political speech makes them a target.

The EFF is asking state attorneys general to investigate. That's the right call. But the deeper fix is structural. As long as tech companies are allowed to hoard detailed data about billions of people and hand it over to law enforcement through judge-free administrative processes, this will keep happening. Advance notice is a floor, not a ceiling. The real question is why Google has all this data to hand over in the first place, and why a federal agency can demand it without ever seeing a judge.