The Global Network Initiative (GNI) recently virtually convened1 our members and external experts for a discussion on tech company disclosure of government restrictions and demands, and the process of subsequent notification to users. As the geopolitical and technical landscape continues to shift dramatically, we thought it would be valuable to explore the current state of transparency reporting and user notification practices. Participants discussed these practices across types of government demands, companies, and jurisdictions; the barriers and limitations to meaningful transparency; and how companies might make both of these transparency mechanisms more useful for rights advocacy.2
Speakers included representatives from international civil society organizations and different kinds of tech companies: a user-generated content platform, a communication and collaboration platform, and a telco. This piece highlights and builds on insights from the convening, including (1) a brief history of civil society advocacy for transparency reporting and user notice, (2) why both of these transparency mechanisms matter, (3) reflections on the state of current practices, (4) the interplay between mandated and voluntary reporting, and (5) high-level recommendations for how these two mechanisms could be improved.
The convening was designed around questions from GNI’s most recent assessment process. For almost 20 years, GNI has run an independent, multistakeholder process assessing member companies’ implementation of the GNI Principles on Freedom of Expression and Privacy. Additionally, the conversation built on research and conversations that GNI sponsored through the Action Coalition for Meaningful Transparency (ACT).
The digital rights field has long recommended and tracked transparency reporting and user notice practices, particularly in relation to when governments make overly broad demands of companies, as a key way to encourage both government and tech company accountability. In the context of GNI’s role to foster tech company accountability, our framework sets expectations and provides guidance for companies on establishing effective internal governance, assessing and addressing risks to rights through due diligence, conducting meaningful stakeholder engagement, and transparency about those efforts.
In 2010, Google was the first tech company to publish a transparency report, covering governmental demands for both user data and content removal. At the time, the company called the report a “Government Requests tool,” and cited its commitment to GNI as one of the factors that led to its publication.
Since then, there’s been a significant body of civil society work recommending that companies adopt and make more meaningful transparency reporting and user notice. For example, in 2015, a global coalition of civil society organizations led by Bolo Bhi, Foundation for Media Alternatives, and SMEX, asked tech companies to expand transparency reporting, particularly with greater context about the data published and clarity on the process companies follow to determine whether a request is legal or is made by a legitimate legal entity. They noted the importance of this type of context in government regimes that don’t adhere to due process and where it’s difficult to obtain this information otherwise. Additionally, more than a decade ago, the Berkman Klein Center and the Open Technology Institute developed a Transparency Toolkit on best practices for reporting specifically on U.S. government requests for user information. And in 2018, a coalition of civil society organizations and experts developed the first iteration of the Santa Clara Principles to offer guidance on both transparency reporting and user notice for transparency and accountability in content moderation.
Civil society has also tracked demands to companies. For example, since 2002, the Lumen Database (previously at the Berkman Klein Center and now at the Harvard Law School Library) has collected and analyzed requests to a range of companies to remove material from the web. As of June 2026, their database hosts over 75 million notices.
Additionally, civil society has tracked company practices. For almost 15 years, Ranking Digital Rights (RDR) has reviewed companies’ policies and practices affecting people’s rights to freedom of expression and privacy, including responses to government demands. Access Now tracks company reporting through its Transparency Reporting Index, which it plans to update within the next year. And for many years, the Electronic Frontier Foundation (EFF) conducted the Who Has Your Back campaign, which, in part, assessed how companies responded to government demands.
Over time, transparency reporting has become standard tech industry practice. Today, many tech companies voluntarily release reports that include information about government demands, though with varying degrees of specificity and detail. However, while there has been progress, many of civil society’s recommendations for making reporting more meaningful have not yet been adopted. And while a significant number of companies also notify users of government demands and associated company responses, the practice of user notice varies much more widely.
Transparency is not an end goal in itself. Instead, different forms of transparency enable varying actors to pursue a range of goals, including government and corporate accountability.
Transparency reporting tends to be most useful to civil society actors like nonprofits, journalists, and academics. For example, when a tech company reports in aggregate which governments demand overbroad content restrictions or access to user data, journalists can report on this to draw attention to it, and civil society organizations can use the data to inform their advocacy strategies. Whereas user notice is aimed at individual users, when a tech company directly notifies a user that a government has requested their data, the user is enabled to seek legal counsel and redress.
When one company uses both of these mechanisms, it enables more comprehensive accountability efforts by different types of actors. For example, a user who is notified that they are the subject of overbroad government restrictions could use the information in transparency reports to inform their legal strategy, if they pursue litigation. Or an advocacy group could seek out users who have been notified to more deeply inform its advocacy strategy.
However, across sectors, participants in this convening noted a perception that external actors seem to no longer be engaging with transparency reports as deeply or as often as they used to. For example, some companies noted that they are getting little direct outreach from civil society after transparency reports are published.
Yet, civil society participants were clear that they continue to value and rely on voluntary transparency reports in their advocacy to both governments and companies. This includes citing data from transparency reports in research, in litigation to protect user rights, and in civil society inquiries to companies. For example, in the African context, Paradigm Initiative relies on company transparency reports to assess government requests for user data in its flagship Londa research report, an annual benchmark of digital rights and inclusion across Africa. In Pakistan, Bolo Bhi regularly relies on information from company transparency reports in policy briefs on online censorship and litigation against the misuse of authority to make demands of tech companies by government actors. And in Latin America, regional CSOs and companies have shared that the “Who Has Your Back” survey (in Spanish: ¿Quién Defiende Tus Datos?) was a catalyst for increased dialogue between civil society organizations and companies in the region; it also spurred improvements in regional company transparency reporting practices.
Given this gap between perception and practice, it seems there could be a stronger feedback loop between the civil society actors that use these reports and the teams within companies that produce them. But, one reason that’s challenging is that there are increasing capacity pressures on civil society around the world – such as lack of funding, political targeting, and the increasing volume of tech policy topics and transparency materials from mandated reporting to digest. To start, even civil society more regularly informing companies that they’ve read and relied on the reports could be useful. To enable a more effective feedback loop over time, it could be useful for companies to share with civil society what kinds of information they need to strengthen the case internally for voluntary transparency reporting, so civil society can be efficient in knowing what kind of information to prioritize sharing. Finally, reporting should adapt over time based on civil society feedback to become more useful for their accountability efforts.
There are different levels of comprehensiveness in transparency reporting about government demands across industry sectors and across companies. For example, according to RDR’s’ most recent assessment of 12 telco companies, the telco sector’s related reporting is less robust than tech platform reporting, and telco transparency has gotten worse over time. RDR hypothesizes that transparency in the telco sector about government demands is complicated by the fact that many telcos are state-owned, subjecting them to national licensing regimes that can place restrictions on transparency. For telco companies that publish regular transparency, RDR positively noted that many of those companies are reporting more and clearer information about their processes for responding to government demands.
Civil society actors appreciate transparency reporting as a practice, and encourage tech companies that do not report to do so. But, they also continue to find existing reports insufficiently detailed. Suggestions for specific types of information to report included:
Sometimes companies don’t report data about a specific category of demand because they do not respond to that type of demand, and therefore have no data. For example, some telcos have a blanket policy where they do not respond to any “private” requests for data, so they do not report on that category. In such cases, indices like RDR note why data is not included and companies could make a note in their reports on why they don’t include that type of statistic.
For platform company reports, it can be unclear what counts as a “government demand.” For example, authorities sometimes flag content or accounts to platforms for the company to review under the company’s own policies and standards. Currently, this kind of circumstance is largely not captured as a government demand in transparency reporting. Yet, if the violation would not have come to the company’s attention without the prompting of the authorities, should the action be categorized as influenced by government? Many civil society experts think so and would like further clarity in reports. For example, as Farieha Aziz noted in 2020, state regulators have disproportionate resources to monitor and report content, as compared to private individuals, so “unless all government requests are categorized separately despite falling under terms of service moderation, there will be no way of determining the volume of requests by governments and regulators, which is an indicator of their priorities and a way of holding them to account for the exercise of their powers.” However, during the convening, some companies noted that there can be complexities to capturing data in these circumstances, such as reworking internal data analysis systems and complexity capturing cases when multiple types of entities flag content for review.
A critical, underacknowledged value of regularly publishing public transparency reports of government demands is that companies need to maintain effective internal systems to track the relevant data. Without the practice of reporting, companies might not be incentivized to track this data as carefully or at all. Now that there is also mandated transparency reporting in many places around the world (more on that in a following section), companies are even more incentivized to ensure that the data included in transparency reports is comprehensively tracked and accurate.
The data in transparency reporting about government demands can drive product improvements for user rights. Once this data is tracked for transparency reports, it can also serve as evidence for driving product improvements within companies. For example, one company made significant privacy-preserving changes to how they collect and retain user data partially in response to increasingly broad government demands.
Companies can only notify users when they are legally allowed to do so; many types of government demands come with a non-disclosure or “gag” order. The best practice is to notify users absent a legal order or a few limited exceptions, such as child exploitation, terrorism, or risk of imminent harm.
It’s more difficult to assess user notice practices across the industry than transparency reporting, as notice is inherently individualized and not publicly accessible. Given this, it would be valuable for the industry to explore mechanisms to make user notices – especially where accounts or content have been removed – available for researchers and civil society organizations, so they can understand the specific context.
Based on the discussion and RDR’s findings, platform companies seem to be giving users more notice (when they can) than telcos. There was discussion about whether the difference in practices across the sectors is purely structural, given that telcos have a more constrained environment with licensing requirements with governments and more demands that are gagged; or whether it is a matter of improving standard telco practices; or some combination.
Determining if and when to notify users is becoming more complex for companies given the broad landscape of legal requirements internationally, some of which preclude notice or meaningfully delay disclosure. More government authorities are making more demands of companies, often in good faith, as they investigate online harm and crime. Yet, at times, governments have broader interpretations of their authorities than companies and civil society experts do. When this is the case, the best practice is for the company to push back on the request to respect user rights. For instance, companies noted that they seek to interpret requests narrowly, seek clarification on exactly what information is needed and why, and at times share their differing legal interpretation with the authority to try to negotiate the demand.
Companies can also find it challenging to define and interpret the exceptional areas where they do not notify, like cases of possible imminent harm. For example, what counts as “imminent harm”? It can also be challenging to draw the line of how much information to provide users. If there’s an associated criminal investigation, there can be a balancing act between the user and the public’s interests. Additionally, even if there’s not a gag order, the government can at times threaten the company with obstruction of justice if they notify a user of a government demand in the midst of a criminal investigation. Many companies notify the user primarily by providing the associated legal order, assuming they can share it.
Once companies determine they can notify a user, they should ideally give the user enough time to reasonably act on the information, such as seeking legal counsel. For example, the Wikimedia Foundation commits to giving users at least ten days notice, unless they can’t reach the user or are legally prohibited from doing so. This is still a short timeframe for users, who might not know about available legal resources or be able to pay, to find appropriate counsel. For particularly overbroad or concerning government demands, companies can also choose to litigate directly or support litigation as “amici” (friends of the court).
Finally, participants discussed the concerning trend of direct access requests, in which case notice is not possible. GNI has previously described direct access as “involv[ing] legal and technical arrangements that allow government authorities to access data streams directly – that is, without having to request access from, or even notify, the service providers that collect and/or transmit the data as part of their services.”
There’s increasingly regulatorily required transparency reporting about a range of aspects. For example, the EU’s Digital Services Act has some of the most comprehensive transparency requirements, with multiple forms of reporting required, the Indian Information Technology (IT) Rules require transparency reporting, as does Japan’s Information Distribution Platform Act and the UK’s Online Safety Act. Other jurisdictions, like Norway, mandate some form of human rights due diligence with associated transparency. However, it’s less common for regulations to require transparency reporting specifically about government demands.3
In some companies, whether warranted or not, these forms of mandated transparency reporting seem to be reducing internal support for voluntary reporting, such as those about government demands. Especially for smaller companies, this can be due to genuine capacity concerns. For example, reconciling existing reporting systems with newly mandated transparency reporting requirements – which vary across jurisdictions – is complex and requires significant resources.
In other companies, mandatory reporting seems to actually be strengthening the culture of transparency.
Overall, increasing transparency is an important goal, as long as the requirements are not overly burdensome and the information shared is useful and usable by external actors. Otherwise, regulations risk creating “transparency theater”.
Detailed transparency reporting and user notice is critical for both civil society organizations and individuals to continue to advocate for user rights and government and corporate accountability in increasingly constrained environments. Without sufficient transparency to help users advocate, governments and companies are too often making opaque decisions that impact user rights.
During the convening, participants noted the need for further financial support for civil society to digest and advocate around the growing number of transparency materials, especially from mandated transparency reporting. Much of the theory of change of enabling accountability from transparency materials rests on civil society’s ability to consume information and translate it into advocacy strategies. But without dedicated resources, it’s difficult to ensure enough capacity, especially as the volume of materials increases. Dedicated funding could help enable and strengthen the connection between transparency and accountability.
We also heard interest in developing further resources and guidance to inform transparency reporting on government demands for different types of companies, services, and technologies. This is particularly relevant at this moment as frontier AI labs have begun reporting on government demands over the last few years (see OpenAI and Anthropic reports) and as all tech companies incorporate genAI into existing products in ways that could change the kinds of demands they receive. Best practices for transparency reporting by the private sector in the context of AI is also a policy focus area that has been identified through our Multistakeholder Approaches to Participation in AI Governance (MAP-AI) project and promoted through our work on government interventions in AI. For example, currently transparency reports don’t seem to currently include categories of information like whether a government tried to demand changes to training data or to AI guardrails.
Finally, participants noted the high levels of government non-disclosure requests around demands, and the need for multistakeholder engagement to enable companies to continue to report on government demands.
GNI looks forward to continuing to convene its members to discuss these themes.
—
1 As with all GNI activities, this learning call was held under GNI’s policies, including our antitrust compliance policy. The discussion was also held under the Chatham House Rule; participants are named with their consent.
2 Tech companies publish transparency reports and notify users about a broad set of issues, including in relation to company enforcement of community guidelines; however, this discussion was focused on company reporting and notification practices in the context of government demands.
3 A good practice is for governments to be transparent themselves as to the extent of surveillance they perform, such as in the Nordic countries and in a recent decision by the U.S. judiciary to start disclosing (in 2029) when wiretaps with spyware technologies are authorized. However, government disclosure is rare, which is why voluntary company reporting about government demands remains essential.