NSLs are likely not the case here with Yahoo (and in fact are not the most significant privacy threat, IMHO). An NSL is a demand from the FBI, not a court order. NSLs also have unique First Amendment vulnerabilities that would help a company choosing to publicize receiving one.

A FISA court order, which can force you to do much more than NSLs, is the more significant operational threat to Internet companies. These court orders typically have "do not disclose" provisions. Willfully violating that court order will almost certainly result in contempt charges.