EFF asks California, New York to probe Google over subpoena notifications

The Electronic Frontier Foundation has asked California and New York attorneys general to investigate Google LLC for allegedly failing to follow its stated policy of notifying users when their data is subpoenaed by law enforcement. At the same time, the California Senate has advanced a bill that would make such notifications mandatory.

Foundation staff attorney F. Mario Trujillo sent letters Tuesday on behalf of Amandla Thomas-Johnson, a British citizen and doctoral student at Cornell University. According to the letters, U.S. Immigration and Customs Enforcement sent Google an administrative subpoena last April. Google complied with the subpoena in May, Trujillo wrote, and notified Thomas-Johnson that same day. This was despite a stated policy that it would notify a user "before disclosing information."

"ICE likely targeted Thomas-Johnson because he briefly attended a pro-Palestinian protest the year before. ... While ICE 'requested' that Google not notify Thomas-Johnson, the request was not enforceable or mandated by a court," Trujillo wrote.

He continued: "By breaking its promise to Thomas-Johnson, Google effectively prevented him from challenging ICE's invalid subpoena and keeping his data out of the hands of the federal government. Thomas-Johnson would have challenged the subpoena if he had been given advance notice, and he would have been successful."

The subpoena would have failed due to "facial deficiencies" and because Thomas-Johnson was targeted for speech protected by the First Amendment, he wrote. Trujillo added that "numerous other individuals" have successfully challenged similar subpoenas on these grounds.

Neither Google nor California Attorney General Rob Bonta's office responded to requests for comment.

The letter asks Bonta and New York Attorney General Letitia James to investigate "how often Google breaks its promise to users." A bill approved late Monday by the Senate Privacy, Digital Technologies, and Consumer Protection Committee would make that promise into state law. SB 957 would require tech companies to promptly notify users whose data is subpoenaed, so they have sufficient time to challenge the demand.

"Social media has become a critical tool for Californians to engage in activism, political expression, and information sharing," the bill's author, Sen. Sasha Renée Pérez, D-Pasadena, told the committee. "This is especially true now. Discussions around politics and government have been particularly prominent as communities across the state are responding to increased federal immigration enforcement."

Pérez said she is accepting amendments to the bill. New provisions would allow users 30 days to respond to or challenge a subpoena and require companies to post their policies. She cited recent news reports that the U.S. Department of Homeland Security has sent subpoenas to Google seeking identifying information about people who have posted comments critical of the agency on forums like Discord and Reddit or used the internet to track and share the locations of ICE agents.

"The government targeting people they disagree with to reveal their identities would be bad enough, but people are being put in an impossible position when they are targeted," Symphoni Barbee, a legislative advocate for ACLU California Action, told the committee. "In some of the cases that the ACLU has litigated to challenge these subpoenas, the people have been given 10 days to file a motion in federal court, which is nearly an impossible burden."

SB 957 would also allow the California Department of Justice to seek declaratory and injunctive relief against companies that violate the rules. It passed 7-1, with no formal opposition recorded.