A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement.

That is the message from the ACLU, EFF, and other civil liberties and trade groups who filed a friend-of-the-court brief in a sealed case in the U.S. Court of Appeals for the District of Columbia.

The case involves the government’s investigation of an anonymous Reddit user who commented on a post about an immigration officer in Minnesota. The Department of Homeland Security (DHS) first issued an administrative subpoena to Reddit to unmask the user. When the user challenged the subpoena in court on free speech and statutory grounds (as many others have), DHS withdrew it. But then the government obtained a separate grand jury subpoena—a subpoena issued by a prosecutor to gather evidence to present to a grand jury before any criminal charges are filed—for much of the same information. The user then challenged the grand jury subpoena too, and the case is currently being appealed.

The right to speak anonymously is essential. It preserves privacy and shields critics from government retaliation. In the past year, the Department of Justice (DOJ) has issued grand jury subpoenas to social media companies for their users’ personal data. This is frequently done for improper purposes and without really showing that social media users have committed any crime. These subpoenas have the effect of intimidating and chilling critics, as immigration authorities have engaged in invasive, unconstitutional, and sometimes violent conduct.

As the amicus brief makes clear, courts should not defer to the government’s claims regarding the legitimacy of using grand jury subpoenas to unmask internet users. Instead, the subpoenas must receive proper First Amendment scrutiny. Like many other types of legal processes, grand jury subpoenas are issued by federal officials without prior court approval. And they too can be abused to harass or retaliate against people critical of the government.

The amicus brief was filed in early September and recently unsealed. The brief was signed by the American Civil Liberties Union of DC, EFF, the Center for Individual Rights, the Foundation for Individual Rights and Expression, the Cato Institute, and NetChoice.

It is notable that NetChoice signed the amicus brief. It is a trade group that represents many companies who have received similar subpoenas including Reddit, Google, Meta, PayPal, among others. EFF has called on these companies to do more to defend their users’ speech and privacy rights in the face of these subpoenas.

In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two provisions of the Privacy Act—one restricting disclosure of personal records between agencies and another requiring agencies to protect the security and confidentiality of records.

Since the case was filed, many DOGE agents have left the government and OPM has rescinded their database access. However, OPM should still clean up the cybersecurity mess it created. The court will decide the remedy at a later date.

"By virtue of the Court’s summary judgment ruling, OPM’s decision to grant DOGE Agents broad access to its systems of recordings containing [personally identifiable information (PII)] has been held unlawful," Judge Denise Cote wrote.

"The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII," she added.

OPM maintains databases of highly sensitive personal information about tens of millions of federal employees, retirees, and job applicants. Starting in January 2025, OPM disclosed data to the U.S. DOGE Service, initially led by Elon Musk. This disclosure violates the federal Privacy Act of 1974, a watershed anti-surveillance statute that prevents the federal government from abusing our personal information.

EFF sued OPM and DOGE because this data disclosure violates the Privacy Act. We represent unions of federal employees – the American Federation of Government Employees and the Association of Administrative Law Judges – and individual employees. We seek injunctive and declaratory relief. We filed in the U.S. District Court for the Southern District of New York.

Our co-counsel are Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC.

Donate to EFF

Support Privacy & Government Accountability

In the past two years, the federal government has unlawfully consolidated data exposing our private information. 

This consolidation has been chaotic but generally came in three rolling waves: It started with DOGE, moved to agency-to-agency data sharing with ICE, and then attempted data-driven purges of state voter rolls.

We all deserve to live in a world where the data we use to pay our taxes, receive benefits, and vote is not combined and weaponized against us. The amalgamation of data leads to mistakes, abuses, and a lack of trust in institutions meant to protect us. Overall, it can chill our participation in society. This is particularly true for groups disfavored by this administration—especially immigrants and protesters.

Congress highlighted similar abuses—including the creation of enemies lists and snooping on activists and federal employees—following the McCarthy and Watergate eras. And the increasing use of computers to magnify those harms led Congress to pass a slate of protections like the federal Privacy Act of 1974.

The good news is that many people have stepped forward to resist the federal government’s unprecedented and unlawful data consolidations. Many groups, including EFF, have filed lawsuits to enforce our data privacy laws, and many states have, too. Legislators at the federal and state levels have worked to expose and oppose these surveillance programs. And many people have protested for their right to data privacy.

Existing data privacy protections have been essential in the past two years, but they can be improved. This should include: narrowing loopholes and increasing enforcement in existing laws, limiting the government’s purchase of data on the commercial market, and passing a comprehensive consumer privacy law.

Data Consolidation by DOGE

Starting on January 20, 2025, President Trump created DOGE—essentially renaming an existing agency originally meant to modernize government technology. Rather than engage in modernization, DOGE quickly obtained high-level access to sensitive databases across the government that store millions of people’s personal records—including at the Office of Personnel Management (OPM), the Social Security Administration, and the Treasury Department.

DOGE was staffed with people with little government or cybersecurity knowledge and who often had conflicts of interest. DOGE’s early aim was not always clear, aside from gaining “prompt access to all unclassified agency records” and the “sharing and consolidation” of those records.

The result? The indiscriminate firing of government employees and the decimation of important agencies that focused on consumer protection and foreign aid. It also resulted in clear misuses of data. For example, while working with DOGE at the Social Security Administration, one individual signed an outside agreement with an advocacy group with the aim of using SSA data to find evidence of alleged voter fraud and “overturn election results in certain States.”

DOGE’s data access and consolidation violated the federal Privacy Act, which limits the sharing and consolidation of government databases. Many groups stepped in to sue. For example, EFF and our co-counsel at Lex Lumina LLC and Democracy Defenders Fund, on behalf of two public employee unions (AFGE and AALJ), sued the OPM for unlawfully disclosing federal workers’ information to DOGE. After EFF and others secured early victories, the government sought to end the lawsuits by firing many DOGE agents and removing their access to records. A great deal of damage remains in need of a judicial remedy.

Data Consolidation by the Department of Homeland Security (DHS)

Even as DOGE’s influence diminished, federal agencies have attempted to share, compare, and seize large databases, in order to target immigrants. In some cases, they have succeeded. This happened with tax records at the IRS, Medicaid data from the Department of Health and Human Services (HHS), and public housing data from the Department of Housing and Urban Development. The Department of Agriculture also sought to collect databases regarding Supplemental Nutrition Assistance Programs (SNAP) from states.

Many groups have filed lawsuits to block this anti-immigrant-motivated data consolidation, alleging it violates privacy protection laws. EFF filed amicus briefs in support of two of these lawsuits: Centro de Trabajadores v. Bessent, which concerns IRS data; and California v. HHS, which concerns Medicaid data (and where we teamed up with EPIC and Protect Democracy). Most recently, states have stepped up to challenge the federal government’s attempted seizure, for immigration enforcement purposes, of state commercial driver’s license data held by the American Association of Motor Vehicle Administrators, a non-profit organization.

This data consolidation for immigration enforcement has also included government purchase of commercial products. This includes ICE’s purchase of commercial location data without a warrant, and its interest in “Big Data and Ad Tech providers.” ICE also has contracts with companies like Palantir, which help organize all the datasets the agency collects.

Data Consolidation for Voter Purges

The right to vote is fundamental to every democracy. That’s why EFF has long advocated for cybersecurity in voting systems, to make sure every vote is properly counted.

Voter purges are a longstanding threat to the right to vote. State and local officials regularly delete people from the voter registration rolls, often for bad reasons and without adequate notice. This has a disparate impact against people of color.

Now the federal government is trying to purge voters, too. To do so, it has consolidated our data in three ways. First, it is using an old data system called SAVE for a new purpose: checking voter eligibility. Second, it has seized voter information from states. Third, it has created a federal list of eligible voters.

As a direct result, people with a right to vote will be purged from voter rolls because of erroneous data. Others will be intimidated from voting or registering. And all registered voters suffer a violation of their data privacy rights: information collected for one purpose is being used against them for another purpose.

Expansion of SAVE

Since 1986, the federal government has operated SAVE, which stands for Systematic Alien Verification for Entitlements. It is not a database, but it facilitates easy access to databases. It is used to determine whether immigrants and naturalized citizens are eligible for various government benefits, such as food stamps.

In 2025, the federal government started using SAVE for a new purpose: checking voters’ eligibility. Further, SAVE now provides access to new databases and allows bulk searches. More than 60 million voters have been run through SAVE, and 21,000 were flagged as potential noncitizens who are ineligible to vote. Erroneous flags have caused purges of lawful voters – such as Anthony Nell.

A case called League of Women Voters v. DHS challenges this expansion of SAVE. The plaintiffs are represented by CREW, Democracy Forward, the Fair Elections Center, and EPIC. A federal judge held this program unlawful and set it aside. DHS appealed and asked for a stay of this order, and a federal appellate court denied the stay. Unfortunately, the U.S. Supreme Court granted the stay, exercising its controversial “shadow docket” authority by a six-to-three vote.

Federal employees in DHS’s “Fraud Detection and National Security Unit,” which ordinarily investigates alleged immigration fraud, have been re-assigned to examine voter eligibility. A whistleblower alleges that employees have been directed to go to state election agency websites, enter some of a voter’s personal information, and thereby access more of it. This may violate state laws requiring a person, before accessing a voter’s information, to attest they are that voter or have that voter’s authorization.

Federal Seizure of States’ Voter Information

Since 2025, the federal government has demanded that at least 48 states hand over their voter information. At least 16 states have complied. The federal government is running this information through SAVE, searching for voters to purge.

The federal government has sued 30 states for refusing to comply. So far, courts have dismissed 25 of these suits. There’s also a lawsuit against this data grab, titled Common Cause v. DOJ, brought by CREW, Protect Democracy, and the ACLU.

The New Federal Voter Eligibility List

In March 2026, President Trump issued an executive order requiring DHS to create a list of people who are U.S. citizens, aged 18 or older, and residents of the state. The order also requires DOJ to prosecute anyone, including state and local officials, who provides a ballot to a person who is not eligible to vote in federal elections.

In California v. Trump, 24 states allege that this executive order violates the Constitution’s separation of powers. A federal judge enjoined this program, and an appellate court denied a stay. But the U.S. Supreme Court by a six-to-three vote granted a stay, which allows the program to move forward. (By a seven-to-two vote, the Court denied a stay of an injunction against a different part of the same executive order, which concerned mail-in ballots.) Another legal challenge, titled EPIC v. USCIS, alleges that the new federal voter eligibility list violates the Privacy Act as well as the separation of powers.

Next Steps

It is encouraging to see so many people, groups, and states step forward to protect our data privacy from these unlawful waves of federal data consolidations. Still, more work remains. For example:

• The Privacy Act of 1974 has proven a critical bulwark. But after a half century, it could use a refresh. For example, Congress should close its loopholes and expand its enforceability.
• Law enforcement agencies must be prohibited from avoiding the Constitution’s warrant requirement by buying our personal data from brokers. For example, Congress should pass the “Fourth Amendment Is Not For Sale Act.”
• We need a comprehensive consumer data privacy law, among other reasons to reduce the flood of our personal data that corporations provide to law enforcement agencies. Legislators should check out EFF’s “privacy first” framework.

In the meantime, there’s no time like the present to practice surveillance self-defense, like using strong passwords and disabling your phone’s ad identification.

 

Immigration and Customs Enforcement (ICE) has conducted unlawful investigations into dozens of individuals who have documented ICE activities in their communities, social media users who criticized the government, and international students who attended a protest.

A favored tool in these speech chilling investigations are administrative subpoenas sent to technology companies, requesting basic subscriber data about their users. For example, from 2018 to 2020, ICE sent nearly 500 administrative subpoenas to Meta, Google, and Twitter (now X), according to documents obtained by Just Futures Law. In just the second half of 2025, the Department of Homeland Security (DHS) sent 21 administrative subpoenas to Reddit, according to its Transparency Report.

While some subpoenas are routine, ICE has been forced to withdraw others after users challenged them in court or companies pushed back. These challenged subpoenas exceeded the agency's statutory authority and violated users' First Amendment rights.

Below is a non-comprehensive list of DHS subpoenas that we gathered going back to 2025, looking at public reporting and court cases. This is likely an undercount. The full scope is hard to pin down because these subpoenas typically only come to light when a user is given notice and challenges them in court, or when a company documents them in a transparency report (so far, only Reddit appears to break out specific numbers on DHS subpoenas). In addition, DHS has been slow to respond to our Freedom of Information Act requests and lawsuits seeking records that would show how many administrative subpoenas ICE has sent to social media companies since 2025.

If you know of other subpoenas that are not on this list, please reach out to info@eff.org. While the government has abused the subpoena process in other areas, particularly to hospitals, this list focuses on DHS and ICE subpoenas to technology companies for user data. 

DATE ISSUED (and link to subpoena)	TARGETED COMPANY	INDIVIDUAL USER TARGETED	OUTCOME
3/17/25	Facebook	Momodou Taal, international student who attended pro-Palestinian protest	Withdrawn
3/23/25	Google	Momodou Taal, international student who attended pro-Palestinian protest	Withdrawn
4/1/25	Google	Amandla Thomas-Johnson, international student who attended pro-Palestinian protest	Google disclosed data to ICE on 5/8/25
9/4/25	Meta	6 accounts in Southern California that documented immigration activity, including LB_Protest, Long Beach Rapid Response Network, and Stopice.net	Withdrawn after court challenge on 11/24/25
9/11/25*	Meta (Instagram)	Pennsylvania account called "MontCo Community Watch" that documented immigration activity	Withdrawn after court challenge on 1/16/26
9/11/25*	Meta (Facebook)	Pennsylvania account called "MontCo Community Watch" that documented immigration activity	Withdrawn after court challenge on 1/16/26
10/30/25	Google	Retired Philadelphia user who emailed criticism to U.S. prosecutor	Withdrawn after court challenge on 2/5/26
2/4/26*	Google	Social media user who regularly posts criticism of the President	Subpoena challenged in Court
2/19/26*	Reddit	"Tired_Thumb," user who posted about ICE officer	Withdraw after court challenge on 3/27/26; replaced with grand jury subpoena
2/27/26*	X	"podslurp,” who posted publicly available address information about ICE officer	Withdrawn May 2026; replaced with grand jury subpoena
3/7/26	PayPal/Venmo	"Voices of Racial Justice," a racial justice organization in Minnesota	PayPal/Venmo disclosed data 3/20/26
4/3/26*	Google (YouTube)	@TheDonLemonShow, GeorgiaFort, @DemocracyNow, and seven other accounts that reported on protest at Minnesota church	Google Objected 4/7/26
4/12/26*	T-Mobile	Minnesota journalist Georgia Fort and others	T-Mobile disclosed data on 4/12/26
First half of 2025	Reddit	Reddit account	Subpoena withdrawn after questions from Reddit
Second half of 2025	Reddit	11 Reddit accounts that posted content "critical of ICE actions"	3 subpoenas withdrawn after Reddit objected

* = denotes summonses issued under 19 U.S.C. 1509, an authority that has been abused in the past, according to DHS's inspector general.

In a handful of known cases, large social media companies have privately pushed back against Immigration and Customs Enforcement (ICE) subpoenas when the agency tried to unmask anonymous users who tracked immigration activities or criticized the government.

As ICE engages in a pattern of illegal and chilling investigations, any resistance is welcome. But social media companies can do more. When companies receive these unlawful subpoenas, they should be clear with the public that they will not hand over the data unless a court compels them to do so. In addition, companies themselves can take the government to court to challenge these unlawful subpoenas on behalf of their users.

ICE has sent hundreds of subpoenas to large technology companies like Google, Meta, and Reddit.

Publicly challenging these unlawful subpoenas in court has the dual purpose of protecting individual users who may lack the resources or know-how to challenge a subpoena on their own, while also discouraging ICE from issuing similarly unlawful subpoenas in the future.

Companies have a responsibility to protect the privacy of their users. That responsibility does not end simply because companies wish to avoid the ire of this administration—which has sought to chill other powerful institutions like news outlets, law firms, universities, and non-profits.

ICE Has Issued Many Unlawful Subpoenas

ICE has sent hundreds of subpoenas to large technology companies like Google, Meta, and Reddit seeking basic subscriber information like name, email address, IP address, and session times.

Some of these subpoenas have targeted people who engaged in protected activity—like tracking immigration actions, criticizing the government, or attending a protest. People have a First Amendment right to document law enforcement activities and criticize the government online, without retaliatory government investigations. This right has become more important as immigration agents have engaged in invasive, unconstitutional, and sometimes violent conduct.

In a handful of cases, users themselves have successfully pushed back. After receiving notice of these subpoenas, users have challenged them in court, relying on pro-bono lawyers from groups like the ACLU or Civil Liberties Defense Center. Companies have been largely absent from these court proceedings.

Private Pushback from Meta and Reddit

While not appearing in court, companies like Meta and Reddit have sometimes pushed back behind the scenes.

For example, on September 11, 2025, ICE sent administrative subpoenas to Meta seeking to unmask users who ran Instagram and Facebook accounts that tracked immigration activity in Pennsylvania. On September 19, 2025, Meta’s Law Enforcement Response Team told ICE that the agency did not have the “statutory authorization” to seek the records. It asked for more detail about the investigation and said “Meta will take no further action with respect to this summons until it receives this information.” Later, Meta informed ICE that it planned to notify the users about the subpoenas, since no gag order had been obtained. The government disclosed this information in one of EFF’s Freedom of Information Act lawsuits against ICE and other agencies.

On October 3, 2025, Meta notified the user about the subpoena. Despite its private pushback, Meta told the users it would comply with the subpoenas unless they mounted a court challenge within 10 days—which they did with the help of the ACLU. Ultimately, ICE withdrew the subpoenas when it became likely that ICE would lose the case in court.

In another example, Reddit documented its pushback in a transparency report released a few months ago. Reddit reported that in the second half of 2025, the company received three Department of Homeland Security (DHS) subpoenas seeking account information from 11 users who posted content critical of ICE. In the report, the company stated that “Reddit objected to these legal demands because the users appeared to be engaged in protected activity under the First Amendment, and law enforcement withdrew their requests.” The company reported that most other DHS subpoenas it received appeared to be routine.

A Tech Company Model for Public Resistance

EFF’s demand that technology companies do more to protect their users is not unprecedented. Twitter (now X) did so successfully in the first Trump administration.

On April 6 2017, Twitter went to court to challenge a DHS subpoena that sought to unmask a Twitter account named “@ALT_USCIS,” which frequently criticized the administration’s immigration policies. Twitter challenged the subpoena on both statutory and First Amendment grounds. A day later, DHS withdrew the subpoena and Twitter dismissed the case. The incident led to an inspector general investigation, which criticized a tactic that DHS is still engaged in.

In other circumstances, companies have also gone to court to protect their users and shield themselves from burdensome legal process. In 2013, Microsoft challenged a search warrant for the content of emails stored on servers outside the United States. In 2015, Apple challenged a court order to break the security of its iPhone during an investigation into the San Bernardino shootings. And in 2007, Yahoo challenged the constitutionality of government requests at the Foreign Intelligence Surveillance Court.

“We will launch during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns.”-Meta Internal Document on face recognition software for smart glasses, 2025

It’s unsurprising that a company would plan to release yet another privacy-invasive product. What is surprising is that they think we aren’t watching. You can help us keep them in check.

JOIN EFF

Meta isn't the only company actively eroding your privacy. We found that Google has broken its promise to some users to inform them about government surveillance. And Palantir is completely failing to live up to its purported human rights commitments.

Corporations bear responsibility for violating user trust and human rights, and EFF is holding them accountable with your support.

Watching the Watchers

We're suing DHS and ICE to reveal their efforts to unmask online critics, creating privacy-enhancing free software, and pushing for stronger privacy laws for everyone. This is all thanks to over 30,000 EFF members—a community you can join today.

We’ve seen collective action rein in companies and bring them back on track to protect users. With you by our side, we can do it again.

Join EFF today and be part of the community making this work possible.

The federal SECURE Data Act is not a serious consumer privacy bill, and its provisions—if enacted—would be a retreat from already insufficient state protections.

Republicans on the House Energy and Commerce Committee released a draft of the bill late last month without bipartisan support. The bill is weaker than congressional proposals in prior years, as well as most of the 21 state consumer privacy laws already on the books.

The bill could wipe out hundreds of  state privacy protections.

Most troubling for EFF: the bill would preempt dozens, if not hundreds, of state laws that regulate related topics, and it would not allow consumers to sue to protect their own rights (commonly called a private right of action). And it comes nowhere close to banning online behavioral advertising—a practice that fuels technology companies’ always increasing hunt for personal data.

The bill also suffers from many other flaws including weak opt-out defaults, inadequate data minimization requirements, and large definitional loopholes for companies.

Key Provisions

The bill would give consumers some rights to take action to control their personal data— like access, correction, deletion, and limited portability. These rights have become standard in all data privacy proposals in recent years.

The bill would also require companies to obtain your consent before processing your sensitive data, or using any of your personal data for a previously undisclosed purpose. Absent your consent, a company couldn’t do these things.

Further, the bill would allow you to opt out of (1) targeted third-party advertising, (2) the sale of your personal data, and (3) profiling of you that has a legal, healthcare, housing, or employment effect. Unfortunately, a company could keep doing these invasive things to you, unless you opted out.

The bill would also require data brokers that make at least 50 percent of their profits from the sale of personal data to register in a public database maintained by the Federal Trade Commission (FTC).

Preemption of Too Many State Laws

Federal privacy laws should allow states to build ever stronger rights on top of the federal floor. Many federal privacy laws allow this, including the Health Insurance Portability and Accountability Act, the Video Privacy Protection Act, and the Electronic Communications Privacy Act.

The SECURE Data Act would not do that. Instead, it would wipe out dozens, if not hundreds, of existing state privacy protections. Section 15 of the bill would preempt any “law, rule, regulation, requirement, standard, or other provision [that] relates to the provisions of this Act.” This would kill the 21 state consumer privacy laws passed in the past few years. These state bills aren’t strong enough, but they are still better than this federal proposal. For example, California maintains a data broker deletion tool and requires companies to comply with automatic opt-out signals—including one that is built into EFF’s Privacy Badger.

Because the SECURE Data Act has provisions that relate to data privacy and security, it could preempt all 50 state data breach laws and many others. It could also preempt state laws related to specific pieces of sensitive data, like bans on the sale of biometric or location information. Some states like California have constitutional provisions that protect an individual’s right to privacy, which can be enforced against companies. That constitutional provision, as well as state privacy torts, could also be in danger if this bill passed.

No Private Enforcement, A New Cure Period, and Vague Security Powers

Strong consumer privacy laws should allow consumers to take companies to court to defend their own rights. This is essential because regulators do not have the resources to catch every violation, and federal consumer enforcement agencies have been gutted during the current administration.

The SECURE Data Act does not have a private right of action. The FTC, along with state attorneys general, have primary enforcement authority. The law also gives companies 45 days to “cure” any violation with no penalty after they are caught.

Moreover, Section 8 of the bill creates a vaguely defined self-regulatory scheme in which companies can apply to be audited by an “independent organization” that will apply a “code of conduct.” Following this code of conduct would give companies a presumption that they are complying with the law. This provision is an implicit acknowledgement that the bill does not provide regulators with any new resources to enforce new protections.

Section 9 of the bill would give the Secretary of Commerce broad power to “take any action necessary and appropriate to support the international flow of personal data,” including assessing “security interests of the United States.” The scope of this amorphous provision is unclear, but it likely does not belong in a consumer protection bill.

Weak Privacy Defaults

Your online privacy should not depend on whether you have the time, patience, and knowledge to navigate a website and turn off invasive tracking. Good privacy laws build in data minimization requirements—meaning there should be a default standard that prevents companies from processing your data for purposes that are not needed to provide you with the service you asked for.

The SECURE Data Act puts the burden on you to opt out of invasive company practices, like targeted third-party advertising, the sale of your personal data, and profiling. The bill at least requires companies to obtain your consent before processing your sensitive data (like selling your precise location). These consent requirements, however, are often an invitation for companies to trick you into clicking a button to give away your rights in hard-to-read policies. Indeed, few people would knowingly agree to let a company sell their personal data to a broker who turns around and sells it to the government.

Section 3 of the bill uses the term “data minimization,” but it is done in name only. The provision does not limit a company’s processing of data to only what is necessary to provide the customer with the good or service they asked for. Instead, the provision limits processing of data to only what a company “disclosed to the customer”—meaning if it is in the confusing privacy policy that nobody reads, it is okay.

And the bill would not even allow you to restrict certain uses of your data. As companies seek more data for AI systems, many internet users do not want their private personal data to be used to train those models. However, the bill makes clear that “nothing in this Act may be construed to restrict” a company from collecting, using, or retaining your data to “develop” or “improve” a new technology.

Other Flawed Definitions and Loopholes

The bill has numerous loopholes that technology companies would exploit if the bill were to become law. Below is just a sampling:

• Government contractors: Under Section 13(b)(2), government contractors are exempt from the bill, which could be wrongly interpreted to exempt certain data brokers from sale restrictions when those sales are made to the government. This type of exemption could benefit surveillance companies like Clearview AI, which previously argued it was exempt from Illinois’ strict biometric law using a similar contractor exception. This is likely not the authors’ intention, since the definition of sale includes those made “to a government entity.”
  Sale definition: The definition in Section 16(28) is defined too narrowly. A sale should mean any exchange for monetary “or other valuable” consideration, as in some other privacy laws.
• Biometric information definition: The definition in Section 16(4) excludes data generated from a photo or video, and the definition excludes face scans not meant to “identify a specific individual.” This could be wrongly interpreted to allow biometric identification from security camera footage, or biometric use for sentiment or demographic analysis.
• Personal data definition: The definition in Section 16(21) exempts “de-identified data” from the definition of personal data, which could allow companies to do anything with de-identified data because that data is not protected by the law. The problem with de-identified data is that many times it is not.
• Deletion requests: With regard to data that a company obtained from a third-party, Section 2(d)(5) would treat a consumer’s deletion request merely as an opt-out request. And even if a customer requested deletion, a company might be able to retain the data for research purposes under section 11(a)(9)(A).
• Profiling definition: Under the definition in Section 16(25), companies could profile so long as the profiling is not “solely automated.” The flimsiest human review would exempt highly automated profiling.

Congress is long overdue to enact a strong comprehensive consumer data privacy law, and we have sketched what it should look like. But the SECURE Data Act is woefully inadequate. In fact, it would cause even more corporate surveillance of our personal information, by wiping out state laws that are more protective than this federal bill. Even worse, this bill would block state legislatures from protecting their residents from the privacy threats of tomorrow that are unforeseeable today. 

The New York Times reported that Meta is considering adding face recognition technology to its smart glasses. According to an internal Meta document, the company may launch the product “during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns.” 

This is a bad idea that Meta should abandon. If adopted and released to the public, it would violate the privacy rights of millions of people and cost the company billions of dollars in legal battles.   

Your biometric data, such as your faceprint, are some of the most sensitive pieces of data that a company can collect. Associated risks include mass surveillance, data breach, and discrimination. Adding this technology to glasses on the street also raises safety concerns.  

 This kind of face recognition feature would require the company to collect a faceprint from every person who steps into view of the camera-equipped glasses to find a match. Meta cannot possibly obtain consent from everyone—especially bystanders who are not Meta users.  

Dozens of state laws consider biometric information to be sensitive and require companies to implement strict protections to collect and process it, including affirmative consent.  

Meta Should Know the Privacy and Legal Risks  

Meta should already know the privacy risks of face recognition technology, after abandoning related technology and paying nearly $7 billion in settlements a few years ago.  

In November 2021, Meta announced that it would shut down its tool that scanned the face of every person in photos posted on the platform. At the time, Meta also announced that it would delete more than a billion face templates. 

Two years before that in July 2019, Facebook settled a sweeping privacy investigation with the Federal Trade Commission for $5 billion. This included allegations that Facebook’s face recognition settings were confusing and deceptive. At the time, the company agreed to obtain consent before running face recognition on users in the future.   

In March 2021, the company agreed to a $650 million class action settlement brought by Illinois consumers under the state's strong biometric privacy law. 

And most recently, in July 2024, Meta agreed to pay $1.4 billion to settle claims that its defunct face recognition system violated Texas law.  

 Privacy Advocates Will Continue to Focus our Resources on Meta  

 Meta’s conclusion that it can avoid scrutiny by releasing a privacy invasive product during a time of political crisis is craven and morally bankrupt. It is also dead wrong.  

Now more than ever, people have seen the real-world risk of invasive technology. The public has recoiled at masked immigration agents roving cities with phones equipped with a face recognition app called Mobile Fortify. And Amazon Ring just experienced a huge backlash when people realized that a feature marketed for finding lost dogs could one day be repurposed for mass biometric surveillance.  

The public will continue to resist these privacy invasive features. And EFF, other civil liberties groups, and plaintiffs’ attorneys will be here to help. We urge privacy regulators and attorneys general to step up to investigate as well.  

We are calling on technology companies like Meta and Google to stand up for their users by resisting the Department of Homeland Security's (DHS) lawless administrative subpoenas for user data. 

In the past year, DHS has consistently targeted people engaged in First Amendment activity. Among other things, the agency has issued subpoenas to technology companies to unmask or locate people who have documented ICE's activities in their community, criticized the government, or attended protests.   

These subpoenas are unlawful, and the government knows it. When a handful of users challenged a few of them in court with the help of ACLU affiliates in Northern California and Pennsylvania, DHS withdrew them rather than waiting for a decision. 

These subpoenas are unlawful, and the government knows it.

But it is difficult for the average user to fight back on their own. Quashing a subpoena is a fast-moving process that requires lawyers and resources. Not everyone can afford a lawyer on a moment’s notice, and non-profits and pro-bono attorneys have already been stretched to near capacity during the Trump administration.  

 That is why we, joined by the ACLU of Northern California, have asked several large tech platforms to do more to protect their users, including: 

1.  Insist on court intervention and an order before complying with a DHS subpoena, because the agency has already proved that its legal process is often unlawful and unconstitutional;  
2. Give users as much notice as possible when they are the target of a subpoena, so the user can seek help. While many companies have already made this promise, there are high-profile examples of it not happening—ultimately stripping users of their day in court;  
3. Resist gag orders that would prevent companies from notifying their users that they are a target of a subpoena. 

 We sent the letter to Amazon, Apple, Discord, Google, Meta, Microsoft, Reddit, SNAP, TikTok, and X.  

Recipients are not legally compelled to comply with administrative subpoenas absent a court order 

 An administrative subpoena is an investigative tool available to federal agencies like DHS. Many times, these are sent to technology companies to obtain user data. A subpoena cannot be used to obtain the content of communications, but they have been used to try and obtain some basic subscriber information like name, address, IP address, length of service, and session times.  

Unlike a search warrant, an administrative subpoena is not approved by a judge. If a technology company refuses to comply, an agency’s only recourse is to drop it or go to court and try to convince a judge that the request is lawful. That is what we are asking companies to do—simply require court intervention and not obey in advance. 

It is unclear how many administrative subpoenas DHS has issued in the past year. Subpoenas can come from many places—including civil courts, grand juries, criminal trials, and administrative agencies like DHS. Altogether, Google received 28,622 and Meta received 14,520 subpoenas in the first half of 2025, according to their transparency reports. The numbers are not broken out by type.   

DHS is abusing its authority to issue subpoenas 

In the past year, DHS has used these subpoenas to target protected speech. The following are just a few of the known examples. 

On April 1, 2025, DHS sent a subpoena to Google in an attempt to locate a Cornell PhD student in the United States on a student visa. The student was likely targeted because of his brief attendance at a protest the year before. Google complied with the subpoena without giving the student an opportunity to challenge it. While Google promises to give users prior notice, it sometimes breaks that promise to avoid delay. This must stop.   

In September 2025, DHS sent a subpoena and summons to Meta to try to unmask anonymous users behind Instagram accounts that tracked ICE activity in communities in California and Pennsylvania. The users—with the help of the ACLU and its state affiliates— challenged the subpoenas in court, and DHS withdrew the subpoenas before a court could make a ruling. In the Pennsylvania case, DHS tried to use legal authority that its own inspector general had already criticized in a lengthy report.  

In October 2025, DHS sent Google a subpoena demanding information about a retiree who criticized the agency’s policies. The retiree had sent an email asking the agency to use common sense and decency in a high-profile asylum case. In a shocking turn, federal agents later appeared on that person’s doorstep. The ACLU is currently challenging the subpoena.  

Read the full letter here