That's just it though, we've heard of stuff like ECHELON (which involved no warrants whatsoever) since years before this discussion would have taken place. ECPA

That's just it though, we've heard of stuff like ECHELON (which involved no warrants whatsoever) since years before this discussion would have taken place. ECPA dates to 1986! FISA dates to 1978! The insidiously loose interpretation on 4th Amendment controls for third-party communications dates back for centuries. A lot of this was just a quick Google search away, and would have been just as relevant the very year GMail was introduced. Likewise there's no theoretical reason to trust internal Google policy controls over U.S. government legal and policy controls. Even if what the author thought had been true about U.S. law actually was true, he'd still have been setting his customer up for the possibility of having their confidential data leaked (maliciously or not) or hacked into (e.g. by the always-vulnerable password reset function). That's not just a nitpick either. There have been a couple of services at work I would have liked to setup on something like Digital Ocean, Basecamp Breeze, etc. that I can't because of PII concerns. So while I'm sorry that the author made wrong assumptions I don't know what to tell him other than IANAL isn't just a five-letter acronym, and "due diligence" doesn't simply mean "hire a contractor to think about this for me".