The Electronic Frontier Foundation (EFF) is asking the attorneys general of California and New York to investigate Google for deceptive trade practices, saying the tech giant fails to notify users before handing over their data to law enforcement agencies like ICE.

“For nearly a decade, Google has promised billions of users that it will notify them before disclosing their personal data to law enforcement,” the letter says. But it didn’t in the case of Amandla Thomas-Johnson, a former PhD candidate at Cornell University who says he received no notice that ICE had accessed his university email.

The EFF alleges that this isn’t an isolated incident, and that “through a hidden but systemic practice, Google has likely violated that promise numerous other times over the years.” The EFF says it has learned that Google sometimes sends data over without authorizing users “in order to save time and avoid delay with complying with a government demand.”

“This is the big question — whether they were using our [Cornell] emails to track us as well,” Thomas-Johnson told the Cornell Daily Sun.

At the time, a Google spokesperson told the Sun that its “processes for handling law enforcement subpoenas are designed to protect users’ privacy while meeting our legal obligations.” The spokesperson said Google reviews “all legal demands for legal validity, and we push back against those that are over broad or improper including objecting to some entirely.”

Google told the Sun that Thomas-Johnson’s subpoena requested basic subscriber information and didn’t include the contents of his email.

Thomas-Johnson shared records with the Sun showing that his information was accessed under federal communications law 18 USC 2703(c)(2), which “may require” communications providers to hand over users’ address, telephone number, telephone connection records “of session times and durations” and credit card or bank account number.

But the EFF maintains that administrative subpoenas like the one DHS issued for Thomas-Johnson’s are an abuse of authority and a violation of his First Amendment rights. Moreover, these subpoenas aren’t approved by a judge; companies can refuse to comply with them and face no repercussions for doing so.

“Google should commit to ending its deception and pay for its past mistakes,” the EFF said in its letters to California and New York. The organization is asking the states to investigate Google’s practices and seeks injunctive relief, which includes civil penalties of up to $2,500 per violation in California.