Under existing law voluntary disclosure of the customer's data to law enforcement doesn't appear to be illegal, if the company wants to disclose it (as opposed to having its data centers raided, which does require a warrant). At worst it'd be a violation of the privacy policy, if the privacy policy is held to be legally enforceable.

For example, Facebook has been careful to never make an explicit statement to the effect of, "we never share data with law enforcement unless we receive a warrant or subpoena". My guess is that this is because they do share data without asking for a warrant.