Tech Firms Quietly Fight ICE Subpoenas for User Data

That refusal was never announced. It surfaced later, in court filings and a transparency report. The strongest privacy protection some users got last year was a decision made quietly by an employee they will never meet, at a company under no obligation to tell them it happened.

Key Takeaways

• ICE and DHS sent subpoenas to Google, Meta, Reddit and Discord seeking to unmask users who criticised or documented immigration enforcement, and none of those demands carried a judge's signature.
• Meta's Law Enforcement Response Team told ICE on 19 September 2025 that the agency lacked "statutory authorization," notified the affected user on 3 October 2025, and ICE withdrew the subpoenas after the ACLU went to court.
• Reddit disclosed in its transparency report for the second half of 2025 that it received three DHS subpoenas covering 11 users and objected on First Amendment grounds, after which the demands were withdrawn.
• The authority DHS cited for several of these demands was 19 U.S.C. § 1509, a Tariff Act of 1930 customs summons written for records about imported merchandise, not for social media accounts.
• Google received 28,622 subpoenas in the first half of 2025 and Meta received 14,520, and neither company breaks those totals down by requesting agency.

What Is an ICE Administrative Subpoena?

An ICE administrative subpoena is a demand for records that an agency employee signs on their own authority, with no judge, no magistrate and no grand jury anywhere in the process. Immigration subpoenas run on DHS Form I-138 under 8 CFR 287.4, which lets designated immigration officers compel records for civil or criminal investigations. The signature at the bottom belongs to the same agency doing the investigating.

Compare that to a search warrant, which requires probable cause, sworn testimony and a neutral judge who can refuse. An administrative subpoena requires an officer and a printer. The only external check is the company on the receiving end, which is why the recipient's willingness to argue is not a nice extra. It is the entire check.

There is a further twist in the subpoenas aimed at online critics. According to EFF's FOIA lawsuit against DHS and ICE, filed on 22 April 2026, the agencies leaned on 19 U.S.C. § 1509, a customs summons power from the Tariff Act of 1930 designed to settle questions about duties and imported goods. No court has ever upheld stretching it to cover a Reddit account.

Which Companies Pushed Back, and How?

Meta and Reddit both refused, and both did it privately before anyone outside knew. In the Pennsylvania case documented by EFF on 19 August 2026, Meta's Law Enforcement Response Team wrote back on 19 September 2025 saying ICE lacked statutory authorization, demanded details of the underlying investigation, and refused to move until it got them. On 3 October 2025 Meta told the targeted user. The ACLU took it to court. ICE folded.

Reddit's version reads the same. Three DHS subpoenas covering 11 users who had posted content critical of ICE, an objection on the grounds that the posts looked like protected First Amendment activity, and a quiet withdrawal.

Google is the counterexample. On 1 April 2025 it handed over records on a Cornell PhD student targeted over alleged protest attendance without giving him a chance to object first. In October 2025 it received another subpoena, this one aimed at a retiree whose offence was emailing criticism of asylum policy to a DHS official. We covered that pattern when agents spent months tracking a man who emailed ICE's own director. The variable is not the law. It is which desk the paper lands on.

Why Does DHS Keep Withdrawing These Subpoenas?

Because a withdrawal costs the agency one target, and a court ruling would cost it the whole tool. Every subpoena in this pattern that has been seriously challenged has been pulled before a judge could rule on whether the authority behind it exists.

This is not new behaviour, and the repetition is the story. In March 2017 CBP served Twitter with a summons demanding the identity behind @ALT_USCIS, an account mocking the administration's immigration policy. The statute invoked was 19 U.S.C. § 1509, the same customs provision. Twitter sued on 6 April 2017; the government withdrew the summons the following day and the case was dropped. Nine years later, same statute, same target profile, same retreat.

Most coverage frames each withdrawal as a win for the user. Read the sequence instead and it looks like a strategy: an untested authority stays usable forever, so the rational play is to drop any request that draws a lawyer and keep sending the rest. The cases that get withdrawn are the ones somebody noticed. Nobody outside DHS knows the size of the pile nobody noticed.

What This Means for Your Inbox and Your Accounts

What these subpoenas actually ask for is unglamorous: name, email address, IP address and session times. That is basic subscriber information, and it is the exact set of fields that converts a pseudonymous account into a person with an address. Your email address is the join key. It is the identifier that links your forum handle to your phone, your bank, your employer and every other service you signed up for with it.

This is a different exposure from the data broker purchases we have written about, such as ICE's $6.7 million buy of LexisNexis records to feed Palantir. Brokers sell aggregate profiles assembled from public and commercial sources. A subpoena to your provider gets something brokers cannot supply: the authoritative account record, the login IP history, and confirmation that a specific human controls a specific handle.

Google's 28,622 subpoenas across the first half of 2025 work out to roughly 158 a day, and the transparency report does not say how many came from immigration enforcement. Neither does Meta's 14,520. Whatever fraction touched people whose only activity was speech, we cannot see it, and that is a reporting choice rather than a legal constraint.

What Is EFF Asking Platforms to Do?

EFF and the ACLU of Northern California sent an open letter on 10 February 2026 to Amazon, Apple, Discord, Google, Meta, Microsoft, Reddit, Snap, TikTok and X with three demands: require a court order before handing over identifying data, notify users so they have a chance to fight, and resist gag orders that block that notice. The follow up in August 2026 added a fourth: say publicly what you already do privately, and count these demands separately in transparency reports.

None of that is legally exotic. Providers are permitted to insist on a warrant even where a subpoena might technically suffice, and courts have been moving the same direction, as when the Supreme Court required a warrant for location data. A published warrant preferred policy costs a company nothing except the convenience of quiet compliance.

What Can You Actually Do?

Pick providers by their notice policy, not their marketing. Before you trust a service with an identity you would rather not have unmasked, read its law enforcement guidelines and find the sentence about user notification. Companies that promise to tell you unless legally gagged behave differently from companies that stay silent by default.

Separate your identities. A distinct email address for organising, reporting or community watch work, never reused anywhere else, limits how far one subscriber record can travel. IP and session logs are part of the standard request, so a VPN or Tor changes what a compliant provider is able to hand over at all.

If you receive a notice, treat the clock as real. Providers typically give a short window before disclosure, and organisations including the ACLU have moved fast enough to get these demands dropped. The record so far suggests the agency backs down when someone shows up. Someone has to show up.