Some Tech Companies Have Privately Pushed Back On ICE Subpoenas. They Should All Do More.

Some Tech Companies Have Privately Pushed Back On ICE Subpoenas. They Should All Do More. from the protect-the-rights-of-your-users dept In a handful of known cases, large social media companies have privately pushed back against Immigration and Customs Enforcement (ICE) subpoenas when the agency tried to unmask anonymous users who tracked immigration activities or criticized the government. As ICE engages in a pattern of illegal and chilling investigations, any resistance is welcome. But social media companies can do more. When companies receive these unlawful subpoenas, they should be clear with the public that they will not hand over the data unless a court compels them to do so. In addition, companies themselves can take the government to court to challenge these unlawful subpoenas on behalf of their users. Publicly challenging these unlawful subpoenas in court has the dual purpose of protecting individual users who may lack the resources or know-how to challenge a subpoena on their own, while also discouraging ICE from issuing similarly unlawful subpoenas in the future. Companies have a responsibility to protect the privacy of their users. That responsibility does not end simply because companies wish to avoid the ire of this administration—which has sought to chill other powerful institutions like news outlets, law firms, universities, and non-profits. ICE Has Issued Many Unlawful Subpoenas ICE has sent hundreds of subpoenas to large technology companies like Google, Meta, and Reddit seeking basic subscriber information like name, email address, IP address, and session times. Some of these subpoenas have targeted people who engaged in protected activity—like tracking immigration actions, criticizing the government, or attending a protest. People have a First Amendment right to document law enforcement activities and criticize the government online, without retaliatory government investigations. This right has become more important as immigration agents have engaged in invasive, unconstitutional, and sometimes violent conduct. In a handful of cases, users themselves have successfully pushed back. After receiving notice of these subpoenas, users have challenged them in court, relying on pro-bono lawyers from groups like the ACLU or Civil Liberties Defense Center. Companies have been largely absent from these court proceedings. Private Pushback from Meta and Reddit While not appearing in court, companies like Meta and Reddit have sometimes pushed back behind the scenes. For example, on September 11, 2025, ICE sent administrative subpoenas to Meta seeking to unmask users who ran Instagram and Facebook accounts that tracked immigration activity in Pennsylvania. On September 19, 2025, Meta’s Law Enforcement Response Team told ICE that the agency did not have the “statutory authorization” to seek the records. It asked for more detail about the investigation and said “Meta will take no further action with respect to this summons until it receives this information.” Later, Meta informed ICE that it planned to notify the users about the subpoenas, since no gag order had been obtained. The government disclosed this information in one of EFF’s Freedom of Information Act lawsuits against ICE and other agencies. On October 3, 2025, Meta notified the user about the subpoena. Despite its private pushback, Meta told the users it would comply with the subpoenas unless they mounted a court challenge within 10 days—which they did with the help of the ACLU. Ultimately, ICE withdrew the subpoenas when it became likely that ICE would lose the case in court. In another example, Reddit documented its pushback in a transparency report released a few months ago. Reddit reported that in the second half of 2025, the company received three Department of Homeland Security (DHS) subpoenas seeking account information from 11 users who posted content critical of ICE. In the report, the company stated that “Reddit objected to these legal demands because the users appeared to be engaged in protected activity under the First Amendment, and law enforcement withdrew their requests.” The company reported that most other DHS subpoenas it received appeared to be routine. A Tech Company Model for Public Resistance EFF’s demand that technology companies do more to protect their users is not unprecedented. Twitter (now X) did so successfully in the first Trump administration. On April 6 2017, Twitter went to court to challenge a DHS subpoena that sought to unmask a Twitter account named “@ALT_USCIS,” which frequently criticized the administration’s immigration policies. Twitter challenged the subpoena on both statutory and First Amendment grounds. A day later, DHS withdrew the subpoena and Twitter dismissed the case. The incident led to an inspector general investigation, which criticized a tactic that DHS is still engaged in. In other circumstances, companies have also gone to court to protect their users and shield themselves from burdensome legal process. In 2013, Microsoft challenged a search warrant for the content of emails stored on servers outside the United States. In 2015, Apple challenged a court order to break the security of its iPhone during an investigation into the San Bernardino shootings. And in 2007, Yahoo challenged the constitutionality of government requests at the Foreign Intelligence Surveillance Court. Republished from the EFF’s Deeplinks blog. Filed Under: ice, privacy, subpoenas Companies: meta, reddit, twitter, x Comments on “Some Tech Companies Have Privately Pushed Back On ICE Subpoenas. They Should All Do More.” Takeaway: Decentralize, disintermediate, anonymize, and encrypt. Why do these juicy subpoena-targets even exist? Why do people use them when opposing a dictatorship!? When opposing a dictatorship, why don’t people anonymize their Net connections? 35 years after PGP was invented, why are any non-public communications not E2EE? Note: Any non-public data that Techdirt has about me is even less useful to track me than whatever I’ve openly posted in public. My activity here is fully protected by the First Amendment; however, for my own safety against unconstitutional and/or otherwise illegal actions, when I comment here, I assume and act as if the U.S. government has full access to Techdirt’s logs. I am not on social media. And if you email me, I will request that you install GnuPG; if necessary, I will offer to tutor you. Thanks to the ACLU for fighting these ridiculous subpoenas, and thanks to the EFF for FOIAing information about them. Re: Answers from an AC's POV... While I appreciate that you were howling at clouds with your post, I would like to say: thank you for offering to tutor me in the use of GPG. But how are you at convincing all of my friends, relatives, and random associates to do the same? E2EE requires two things, neither of which are present: the technical acumen to choose, configure, and use E2EE solutions, and second, for everyone you communicate with to do the same. The first is easy, if you’ve a will to do so. The second is hard. Re: Re: Howling at “the Cloud” that people should encrypt their email, Part 2^252 + 27742317777372353535851937790883648493. Anyone who can expℓain the title gets a modular cookie. 🙂 You’re welcome. I’m serious. Impure email address is at the top; GPG key can be downloaded at the bottom. I’m willing to spend nontrivial time and effort teaching how to use the latter. It’s activism. I care about this. That’s your job! Hey, what can I say? I started banging my head against this particular wall when I was a teenager. From sheer frustration, I did give up on it for some years; that was stupid of me. Now, how does “dissident under a repressive regime” sound? Nowadays, everyone who is not a MAGA cultist has a strong incentive to encrypt every email with hybrid post-quantum encryption—which GnuPG has (and, incidentally, Proton does not). For decades, GnuPG has been used by democracy activists in some of the most oppressive countries in the world. WTF are Americans waiting for? For many reasons, some of which should be obvious, good security hygiene is to encrypt everything—not to pick and choose messages which “need security”.