Legal & Privacy Brief - February 13, 2026

Today: EPIC and EFF both formally called on the FTC and state Attorneys General to halt Meta's plan to deploy real-time facial recognition in its Ray-Ban smart glasses, citing Section 5 authority and state biometric privacy laws. A federal insurance coverage dispute between Travelers Casualty, Philadelphia Indemnity, and Blackbaud tests whether commercial cyber policies cover ransomware-related breach costs at a major nonprofit SaaS provider. Two new European GDPR decisions, VG Osnabrück (Case 7 A 6/24, Germany) and OGS Zagreb (Case Pn-877/2023-29, Croatia), add to the growing national court record on data protection enforcement across EU member states.

Privacy Developments

Meta Ray-Ban Smart Glasses Facial Recognition Plan

EPIC filed a letter with the Federal Trade Commission and state Attorneys General urging immediate investigation and preventive action against Meta's plan to add facial recognition capabilities to its Ray-Ban Meta smart glasses. The Electronic Frontier Foundation separately published a call for Meta to abandon the initiative, citing a leaked internal Meta strategic document. That document stated that the product could be launched "during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns." Privacy advocates characterize this framing as a deliberate strategy to exploit reduced regulatory attention rather than address the underlying privacy risks. If deployed at scale, the technology would enable real-time identification of individuals in public spaces through consumer eyewear, without the knowledge or consent of those being identified. Unlike stationary cameras, consumer-worn facial recognition devices cannot be avoided through location or behavioral choices, creating a qualitatively different surveillance risk for the general public.

The FTC has authority under Section 5 of the FTC Act to act against unfair or deceptive data practices, and EPIC's petition invokes prior FTC enforcement against Meta's 2012 and 2019 consent orders. State AGs in California, Illinois, and Texas have independent authority under CCPA, BIPA (740 ILCS 14), and the Texas Capture or Use of Biometric Identifier Act to investigate and enjoin biometric data collection practices prior to product launch. EPIC's petition positions this as a pre-enforcement opportunity, not a post-deployment complaint.

• Compliance Action: Organizations with employees or facilities in Illinois, Washington, Texas, or other biometric privacy law jurisdictions should assess whether smart device policies and vendor procurement standards address facial recognition and biometric data collection. BIPA (740 ILCS 14/15) requires written consent and a published retention policy before any biometric data is collected. Review your acceptable use policy for wearable devices in the workplace, particularly in areas where non-consenting third parties may be present. If your organization is a Meta customer or uses Meta Business Suite tools, monitor your vendor agreements for changes to data collection scope.
• Sources: EPIC News | EFF Deeplinks

VG Osnabrück - Case 7 A 6/24 (Germany)

The Administrative Court of Osnabrück (Verwaltungsgericht Osnabrück) issued a ruling on January 13, 2026 in Case 7 A 6/24, ECLI:DE::2026:0113.7A6.24.00. The case arises under German administrative law in a GDPR-related dispute and is documented in the Lower Saxony official legal database (NI-VORIS). German administrative courts handle GDPR claims where public authorities or administrative bodies are parties, or where data subjects challenge official decisions affecting their personal data rights under GDPR Articles 15-22. This ruling contributes to the Lower Saxony regional body of GDPR case law, which supplements BfDI (Federal Data Protection Commissioner) enforcement.

• Source: GDPRhub

OGS Zagreb - Case Pn-877/2023-29 (Croatia)

The Municipal Civil Court in Zagreb (Općinski građanski sud u Zagrebu) issued a ruling in Case Pn-877/2023-29, a civil matter involving GDPR claims. Filed in 2023 and adjudicated through the Zagreb civil court system, this case reflects Croatia's approach to data subject rights enforcement in private-party disputes. Croatia's civil courts hold concurrent jurisdiction alongside the Croatian Personal Data Protection Agency (AZOP) for GDPR-based civil damages claims. Civil court decisions in EU member states can establish damages precedent that differs from DPA administrative fines, and plaintiffs increasingly pursue civil routes to recover non-material damages under GDPR Article 82.

• Source: GDPRhub

Litigation Updates

Travelers Casualty and Surety Co. of America and Philadelphia Indemnity Insurance Co. v. Blackbaud, Inc.

Travelers Casualty and Surety Company of America and Philadelphia Indemnity Insurance Company brought suit against Blackbaud, Inc., a software application and data hosting provider serving nonprofits, in connection with Blackbaud's major data breach. Blackbaud's 2020 ransomware incident compromised donor, beneficiary, and financial data across thousands of nonprofit, higher education, and healthcare clients. The breach triggered multi-state regulatory enforcement, FTC scrutiny, and a multidistrict class action. This federal case now tests whether commercial insurance policies underwritten by Travelers and Philadelphia Indemnity cover Blackbaud's breach-related costs, a coverage dispute that turns on policy language around cyber events, notice obligations, and the scope of covered losses.

Insurance coverage disputes following major data incidents have become a significant secondary litigation front. Courts have split on whether standard commercial general liability (CGL) policies cover data breach costs, and cyber-specific policy language is often contested on exclusions for unencrypted data, late notice, and criminal acts. For Blackbaud's nonprofit clients, the outcome has indirect relevance: if Blackbaud's insurer prevails on a coverage exclusion, the costs of regulatory defense, class action settlements, and breach notifications may fall entirely on Blackbaud's balance sheet, affecting the company's ability to fund remediation and notify remaining affected parties.

• Compliance Action: Verify that your own cyber insurance policy provides first-party coverage for costs arising from a vendor breach, not just incidents originating within your own systems. Vendor contracts should require SaaS providers to carry specified minimum cyber liability limits, name your organization as an additional insured, and include indemnification obligations for breach-related regulatory fines and third-party claims. Blackbaud clients with outstanding class action participation questions should consult with outside counsel to confirm whether the federal MDL docket is still accepting opt-ins.
• Source: CourtListener RECAP

Compliance Takeaways

• Biometric data governance is a pre-deployment obligation, not a post-launch fix. BIPA (740 ILCS 14/15), the Texas CUBI Act, and Washington's My Health MY Data Act all require written consent and a published retention-destruction schedule before any biometric data is collected, regardless of whether the collector is Meta or your own organization. Audit current use of biometric access controls, facial recognition attendance systems, and any smart device policies that touch public spaces. The EPIC petition establishes a clear enforcement theory the FTC can act on without new rulemaking.
• Vendor cyber insurance gaps represent first-party exposure. The Blackbaud insurance litigation illustrates that a vendor's policy may not cover your organization's losses from that vendor's breach. Require vendors handling sensitive constituent or employee data to provide certificates of insurance specifying coverage type, limits, and whether your organization qualifies as an additional insured. Add breach cost indemnification and regulatory fine coverage to vendor contract templates before renewal cycles.
• GDPR civil court enforcement is accelerating in parallel with DPA actions. The VG Osnabrück and OGS Zagreb rulings reflect the expanding judicial track for GDPR enforcement. Data subjects in EU member states increasingly pursue civil damages under GDPR Article 82 alongside, or instead of, DPA complaints. Organizations processing personal data in Germany or Croatia should confirm their records of processing activities (ROPA) are current, since civil courts can compel production of ROPA documentation in discovery.
• Internal strategic documents are discovery targets. The leaked Meta document cited in EFF's analysis is a reminder that internal planning documents assessing regulatory risk are not privileged. Compliance officers should counsel product and strategy teams against framing regulatory risk mitigation in terms of exploiting enforcement gaps or reduced oversight. Such documents surface in regulatory investigations and civil litigation and create independent reputational and legal exposure.
• Track FTC posture on AI-enabled surveillance devices. EPIC's formal petition to both the FTC and state AGs is a leading indicator of regulatory attention. FTC Section 5 enforcement on facial recognition has precedent in the FTC's prior Meta consent orders and in enforcement against Clearview AI and other facial recognition vendors. Update your privacy program risk register to include AI-enabled biometric surveillance under third-party vendor and product assessment criteria.