So which is easier? Law Enforcement going after Google for the data or LE going after the site itself for the data on customers?
Seems like it would be easier for LE to threaten a small pharmacy versus a big corp like google.
Seems like it would be easier for LE to threaten a small pharmacy versus a big corp like google.
Not in general in this scenario. Google has made exceptions in the past (generally around an emergency with threat to life involved), but they're reluctant to make such exceptions for even federal LEO. State-level LEO, which is who would be making these requests, has far less leverage over Google; they could make it harder for Google to do business in their state, but (a) the states we're talking about are doing that already, so Google cares less about a lever that's already being pulled and (b) the states don't have higher authority to appeal to (what are they gonna do, try to make a Supreme Court case out of noncompliance with... A warrantless data request?).
They review, question, narrow, and reject requests for user info. They also notify users unless prevented by a court.
https://policies.google.com/terms/information-requests?hl=en