A court can legally get an injunction that forces you to comply and keep your complicity secret. That's why "warrant canaries"[1] exist, a company will release a regular statement where they include a line like "We have never been forced to comply with the US federal government.". That way if it does happen they can simply remove the line from future releases to make it clear without violating an injuction.

Unfortunately this doesn't get you any sort of specificity in terms of what happened with what data or why so it's a pretty crude method. Also a court could force you to keep that canary statement active which renders the whole thing moot.

[1] https://en.wikipedia.org/wiki/Warrant_canary

You also have to prove that the lie occurred. If there is no evidence that the data exists of anything more than a hope and a prayer, then you can't prove there was a lie.

When the US intelligence community issues a warrant/national security letter, it’s sent to the company’s general counsel.

The general counsel often doesn’t share its existence with other executives, in order to allow them to honestly say “we’ve never executed a search warrant on behalf of an intelligence agency.”

This is why privacy reports reports from big companies are so important.

They imply, but don’t assure, that CEOs are actually asking “have we received any warrants” instead of remaining blissfully ignorant.

My source on this was an interview I saw with a general counsel at at FAANG. She used it as an example of information she kept from the CEO in order to prevent her from lying to investors- and thereby getting in trouble with the SEC.

I’m not certain if this applies to VPNs and ISPs in the same way.

Various police departments were apparently successful at keeping their use of Stingrays a secret for a long time, citing NDAs with the manufacturer.