Legal & Privacy Brief - February 10, 2026

Today: An Eastern District of Pennsylvania court dismissed wiretapping claims against Cigna (Adair v. Cigna Corporate Services, LLC, 2026 WL 295744), rejecting class allegations that third-party tracking pixels embedded in the insurer's website and member portal violated state wiretap law. EFF and the ACLU sent a formal letter to ten major tech platforms - Amazon, Apple, Discord, Google, Meta, Microsoft, Reddit, Snap, TikTok, and X - demanding they require court orders before responding to DHS administrative subpoenas, citing Google's failure to notify a Cornell student whose data was obtained without a warrant. Amazon Ring's new "Search Party" AI feature expands neighborhood-wide biometric scanning by default, creating fresh exposure under state biometric privacy laws for any organization with Ring cameras in employee-accessible spaces.

Litigation Updates

Adair v. Cigna Corporate Services, LLC (E.D. Pa., 2026 WL 295744)

Five plaintiffs filed a putative class action in the Eastern District of Pennsylvania alleging Cigna violated wiretapping law by embedding third-party tracking tools throughout its website and member portal, effectively monetizing insured members' behavioral data for commercial purposes. The court dismissed the claims on February 4, 2026. The ruling continues a line of federal decisions narrowing the application of state wiretapping statutes to website pixel tracking, though courts in other circuits have reached conflicting conclusions, leaving the legal landscape unresolved for organizations operating nationally.

• Compliance Action: Health insurers and any organization running authenticated portals should audit all third-party analytics tools, session replay scripts, and advertising pixels. The Cigna dismissal is jurisdiction-specific. Pennsylvania, Massachusetts, and California apply different wiretap standards, and active class actions on similar theories are pending in other federal courts. Confirm current privacy disclosures accurately describe what data is collected via tracking infrastructure.
• Source: Inside Class Actions

SN - I NO 14/23 (Polish Supreme Court)

The Polish Supreme Court dismissed a challenge by the Minister of Justice to professional regulations requiring legal counsels to maintain a client register for conflict-of-interest verification. The court held that processing client personal data for this purpose is lawful under Article 6(1)(c) GDPR because Article 15 of the Act on Legal Counsels (Ustawa o radcach prawnych) already imposes a statutory obligation to identify and avoid conflicts of interest. The regulation (§ 6) merely specifies the method for fulfilling that obligation - it does not create new processing. The court also upheld requirements (§ 5) that third parties cooperating on legal matters must commit to professional secrecy in writing. Clients receiving free legal aid must receive the same conflict-of-interest protections as privately paying clients.

• Compliance Action: Legal services firms with EU client relationships should document their conflict-of-interest intake processes and confirm the applicable statutory basis under Article 6(1)(c). Where a pre-existing legal obligation to avoid conflicts exists in statute, processing for that purpose does not require separate consent. Written confidentiality commitments from cooperating third parties should be part of standard engagement documentation.
• Source: GDPRhub

Privacy Developments

Amazon Ring "Search Party" Feature and Biometric Privacy Law Exposure

Amazon Ring debuted its "Search Party" feature in a Super Bowl ad, enabling AI-driven scanning of footage across a neighborhood's Ring cameras to identify matching subjects. The feature is enabled by default across all enrolled devices. Ring already offers "Familiar Faces," which runs facial recognition against a pre-saved list of identified individuals. Combined, these features create potential liability under state biometric privacy statutes including Illinois BIPA (740 ILCS 14/), Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code Ch. 503), and Washington's My Health MY Data Act for entities collecting biometric data without explicit written consent. In 2023, Ring settled with the FTC over the extensive access it gave employees and contractors to customer video footage without authorization.

• Compliance Action: Audit all Ring camera deployments in locations where employees, visitors, or members of the public appear on camera. If "Familiar Faces" is active, assess whether written consent and a biometric data retention schedule are in place as required by Illinois BIPA (per-violation statutory damages of $1,000-$5,000; class action exposure is substantial). To disable the "Search Party" feature: Ring app > Menu > Control Center > Search Party > Disable Search for Lost Pets. Disable the feature for each camera individually. Review whether IoT camera vendors are covered by your organization's acceptable use policy and data classification framework.
• Source: EFF Deeplinks

Federal Agencies Circumvent California ALPR Data-Sharing Restrictions

A coalition led by EFF and Imperial Valley Equity & Justice sent a formal letter to Governor Gavin Newsom and Caltrans Director Dina El-Tawansy demanding revocation of permits allowing CBP, DEA, and U.S. Border Patrol to install automated license plate readers along California border highways. California law (Cal. Penal Code §§ 1798.90-1798.90.55) prohibits state and local agencies from sharing ALPR data with federal immigration enforcement agencies. Federal agencies are bypassing this restriction by installing their own devices on public infrastructure via Caltrans permits, rather than requesting data from state or local systems. EFF researchers mapped more than 40 covert ALPRs in San Diego and Imperial counties believed to belong to federal agencies. A June 2025 public records request to Caltrans yielded permit applications from CBP and DEA confirming the practice.

• Compliance Action: No direct compliance action required for most private organizations. The policy pattern is relevant to risk assessments: federal agencies are establishing a precedent of circumventing state privacy law constraints through direct infrastructure deployment rather than data requests. Organizations assessing cross-jurisdictional data exposure should account for the possibility that federal agency surveillance infrastructure may not be constrained by state-level data-sharing restrictions.
• Source: EFF Press Release

Policy Changes

EFF and ACLU: Tech Platforms Should Require Court Orders Before Responding to DHS Subpoenas

EFF and the ACLU of Northern California sent an open letter to ten major technology platforms calling on them to resist DHS administrative subpoenas by requiring judicial intervention before producing user data. Administrative subpoenas are not approved by a judge; they carry no legal compulsion absent a court order. DHS has used these subpoenas to target users engaged in First Amendment-protected activity, including individuals who documented ICE enforcement activity in their communities and protest attendees. When challenged in court, DHS has withdrawn the subpoenas rather than defend them before a judge. In one documented case (April 1, 2025), DHS issued a subpoena to Google targeting a Cornell PhD student on a student visa. Google complied without notifying the user, despite its stated prior-notice policy. In H1 2025, Google received 28,622 and Meta received 14,520 total subpoenas of all types; DHS-specific counts are not separately reported in either company's transparency data.

• Compliance Action: Organizations that store user or employee data with third-party platforms should review vendor agreements for transparency commitments regarding government data requests. For organizations that receive government data requests directly: administrative subpoenas do not require compliance absent a court order. Consult legal counsel before responding to any DHS administrative subpoena. Review internal incident response procedures for government data requests and ensure affected individuals are notified to the extent permitted by law.
• Source: EFF Deeplinks

Compliance Takeaways

• Tracking pixel litigation is active and circuit-dependent. The Cigna dismissal in E.D. Pa. does not set national precedent. Health insurers and any organization operating authenticated portals with third-party analytics should conduct a tracking audit and confirm their privacy notices disclose the full scope of data collection. Assess exposure jurisdiction by jurisdiction.
• Default-on biometric features create BIPA exposure without a policy. Amazon Ring's "Search Party" and "Familiar Faces" features are opt-out, not opt-in. Any organization using Ring cameras in areas where employees are captured must treat this as a biometric data collection event under Illinois BIPA (740 ILCS 14/), Texas CUBI, and Washington state law. Written consent and a documented retention schedule are required before collection begins.
• Administrative subpoenas from DHS are not legally binding without a court order. Compliance officers and legal teams should confirm their government request response procedures reflect this. Require judicial authorization before producing user data in response to administrative subpoenas, and notify affected users whenever legally permissible.
• EU legal service firms: client registers are GDPR-compliant when grounded in statute. The Polish Supreme Court ruling in SN - I NO 14/23 confirms that client intake registers maintained to comply with a statutory conflict-of-interest obligation have a valid legal basis under Article 6(1)(c) GDPR. Consent is not required where the processing is necessary to fulfill an existing legal duty.
• State privacy law constraints on government data sharing can be bypassed by federal direct installation. California's ALPR sharing restrictions are being circumvented through direct federal device deployment on permitted public infrastructure. When conducting privacy impact assessments for data stored in regions with strong state privacy laws, account for this vector: state-level protections may not constrain federal surveillance infrastructure operating independently of state systems.