Dormant doesn’t mean harmless. The biometric pipeline discovered in Meta’s “Stella” companion app, reportedly containing multiple on-device AI models and a biometric database, according to technical analysis by the Electronic Frontier Foundation and a prior WIRED investigation, was never activated for users. It was, by Meta’s apparent framing, code that hadn’t shipped as a feature. That distinction matters less than it might seem once regulators start asking why it was there.
Meta released an app update on June 5, 2026, removing the facial recognition capability. The EFF’s Threat Lab confirmed the removal by June 8. The technical specifics, the exact model names, app version numbers, and database architecture, have been reported by EFF and WIRED but haven’t been independently confirmed from accessible sources; they should be attributed to those specific publications rather than treated as established record.
Three things make this a regulatory story, not just a tech story.
Who This Affects
First, the enforcement vector. An investigation into Meta’s smart glasses privacy implications was reportedly launched by the Texas AG’s office, per media reports. That hasn’t been confirmed against an official AG announcement and shouldn’t be characterized as a confirmed enforcement action until it is. But Texas has an active AI and biometric enforcement posture, the state’s existing Capture or Use of Biometric Identifier Act (CUBI) creates civil liability for companies that collect biometric data without consent. If the dormant code collected or processed biometric identifiers, which the EFF’s analysis reportedly suggests, CUBI creates a plausible liability hook even for capabilities that were never user-facing.
Second, the scale. Meta’s Ray-Ban smart glasses companion app has wide distribution. The widely distributed companion app represents a deployment footprint that makes the biometric discovery consequential regardless of whether the feature was active.
Third, the pattern. This isn’t the first time code functionality has preceded regulatory approval in a Meta product. The company’s history with biometric data, including the $650 million Illinois BIPA settlement in 2021, establishes a documented pattern that regulators and litigants will cite. WIRED’s original investigation that reportedly triggered the disclosure is the primary source for the technical discovery; retrieval of that article is recommended before the deep-dive on this story is produced.
What to Watch
What to watch
The Texas AG investigation status is the near-term regulatory trigger. An official announcement would confirm enforcement scope and the specific statutory basis, CUBI, DTPA, or federal analog. The broader question is whether other state AGs with active biometric enforcement programs (Illinois, Washington) treat the EFF’s technical confirmation as sufficient to open their own investigations. The FTC’s AI and biometric enforcement posture under the current administration is a secondary variable; federal interest in the story would change the compliance calculus for the entire wearable AI sector.
The real question is whether “dormant code” holds up as a legal defense. Enterprise teams deploying wearable AI should assume it won’t, and audit the technical specifications of any companion app before deployment, not after.