EFF Urges Investigation Into Google for Breaking User Data Privacy Promise

For those of us living and working in the shadow of the gorges here in Ithaca, the campus of Cornell University usually feels like a sanctuary of intellectual exploration and protected speech. It is the kind of place where a five-minute appearance at a protest is seen as a standard exercise of academic freedom. But a recent and chilling revelation involving Amandla Thomas-Johnson, a former Ph.D. Candidate at Cornell, has shattered that illusion of safety. The reality is that the distance between a student protest on the Commons and a federal database in Washington D.C. Is much shorter than any of us realized, and the corporate promises we rely on to protect our privacy are proving to be alarmingly fragile.

The case of Thomas-Johnson is not just a story of aggressive immigration enforcement; it is a cautionary tale about the intersection of state power and corporate data. Thomas-Johnson, a dual British and Trinidad and Tobago citizen and a former reporter, found himself in the crosshairs of the Trump administration after briefly attending a pro-Palestinian protest in September 2024. Despite the brevity of his participation, the fallout was systemic. After the administration ramped up rhetoric against students protesting what they viewed as genocide, Thomas-Johnson was forced into hiding for three months while federal agents searched for him. Even after fleeing the U.S. And crossing into Canada at Niagara Falls, he discovered that the reach of U.S. Authorities extends far beyond physical borders—thanks to the data stored in the cloud.

The Mechanics of the Digital Dragnet

The core of this ordeal lies in a legal tool called an administrative subpoena. Unlike a standard warrant, which requires a judge’s approval and a showing of probable cause, administrative subpoenas are issued directly by federal agencies. In April 2025, Immigration and Customs Enforcement (ICE) used this mechanism to demand data from Google. While these subpoenas are legally restricted—they cannot compel a company to hand over the actual content of emails, private search histories, or real-time location data—they are devastatingly effective at “de-anonymizing” individuals through metadata.

Google fulfilled this request by handing over a trove of Thomas-Johnson’s personal and financial information. This included usernames, physical addresses, and an itemized list of services associated with his account. More invasively, Google turned over IP addresses, phone numbers, subscriber identities, and even credit card and bank account numbers linked to the account. When you piece these fragments together, you aren’t just looking at “metadata”; you are looking at a detailed surveillance profile. IP logs can approximate a person’s location, physical addresses reveal where they sleep, and session times indicate exactly when they are communicating with their support networks. For a student journalist and activist, this is a blueprint for total surveillance.

A Broken Promise of Notification

What makes this specific incident a breach of trust is Google’s own policy. For nearly a decade, Google has promised users that it would notify them before handing over their data to law enforcement in response to legal processes, including administrative subpoenas. This notification is a critical safeguard; it gives the user a window of time to hire legal counsel and challenge the subpoena in court. We know this works because it has worked for others. Momodou Taal, an associate of Thomas-Johnson, received advance notice from both Google and Facebook regarding similar requests, allowing his lawyer to successfully challenge the subpoenas and prevent the data transfer.

In Thomas-Johnson’s case, however, Google bypassed this safeguard. He didn’t receive a warning; he received a notification of a completed action. In Geneva, Switzerland, he opened an email informing him that Google had already responded to the legal process from the Department of Homeland Security. The opportunity to contest the request was gone. This failure has prompted the Electronic Frontier Foundation (EFF) to step in, filing complaints with the Attorneys General of both California and Modern York. The EFF is pushing for an investigation into whether Google engaged in deceptive trade practices by promising a notification process that it simply failed to provide when the government demanded data.

The Ripple Effect in the Finger Lakes Region

For the international student community and the activists within the Ithaca area, this creates a climate of profound uncertainty. When a tech giant can decide—silently and unilaterally—to hand over bank account numbers and physical addresses to ICE, the concept of “protected speech” becomes theoretical. The psychological toll is significant. As Thomas-Johnson noted, being investigated by the federal government leaves one wondering if they are now a “marked individual” and whether future travel to see family in the Caribbean will be fraught with heightened scrutiny.

This situation highlights a dangerous synergy between state power and corporate data stores. When federal agencies use administrative subpoenas to target individuals critical of the administration—including those managing anonymous accounts that track ICE raids—the tech companies act as the facilitators. The result is a system where algorithmic inference and corporate record-keeping are weaponized to bypass judicial oversight.

Navigating Privacy Risks in Ithaca

Given my background as an Executive Geo-Journalist focusing on the intersection of privacy and law, residents and students in the Ithaca area cannot rely solely on the “Terms of Service” of their service providers. If you are concerned that your digital footprint could be leveraged in a federal investigation or a visa dispute, you demand a proactive defense strategy. In the Finger Lakes region, there are three specific types of local professionals Make sure to engage to protect your rights.

Immigration Attorneys specializing in Administrative Law

Do not seek a general practitioner. You need a lawyer who specifically understands the nuances of student visa revocations and has a track record of challenging federal administrative subpoenas. Seem for firms that are familiar with the current rhetoric of the Department of Homeland Security and can provide immediate counsel if you are notified of a visa status change.

Digital Privacy and Cybersecurity Consultants

Beyond basic passwords, you need professionals who can help you implement robust IP masking services and encrypted communication channels. Look for consultants who can perform a “digital footprint audit” to identify what personal and financial data is linked across your various Google and Meta accounts, and who can guide you in decoupling that information.

Civil Liberties Litigators

If you believe your data has been illegally seized or that a company has breached its privacy promises, you need a litigator experienced in “deceptive trade practices” and Fourth Amendment challenges. Seek out professionals who maintain active relationships with organizations like the Electronic Frontier Foundation or the ACLU to ensure your case is aligned with national legal precedents.

Ready to find trusted professionals? Browse our complete directory of top-rated privacy,freespeech,anonymity,announcement experts in the Ithaca area today.