Summary
- EDPB warns that smart glasses can record people without meaningful awareness.
- Professional or public sharing may place GDPR controller obligations on the wearer.
- Manufacturers and app providers retain their own responsibilities for lawful processing.
The European Data Protection Board has warned that increasingly unobtrusive smart glasses are creating new challenges for privacy and data protection, particularly where cameras, microphones and internet connectivity allow people to be recorded without their knowledge. Adopted on 13 October, the statement addresses the responsibilities of users, manufacturers and application providers under existing data protection law.
Although wearable cameras are not new, incorporating them into glasses changes how readily the surrounding public can identify recording. A person entering a workplace, hospital or classroom may see an ordinary-looking pair of spectacles and have little indication that images, sound or contextual information are being collected. The EDPB’s accompanying work on surveillance and evidence handling places those observations within the existing General Data Protection Regulation framework.
The board draws a distinction between private use and activity falling within data protection law. A person making a family video or using translation features privately may come within the household exemption, depending on the circumstances. Public posting of footage, professional recording or official use can instead make the wearer a controller responsible for establishing a lawful basis, providing appropriate information and observing other GDPR duties. The fact that a camera is wearable does not remove those obligations.
Responsibility can also sit elsewhere in the technical chain. A hardware manufacturer, application developer or cloud service provider that determines how information is processed cannot transfer its own legal duties to the wearer. Functions such as synchronisation, facial identification, voice recognition and analysis of recordings may entail separate purposes and separate decisions about retention and access. That division becomes particularly relevant when captured material is transmitted automatically to an online account or processed to deliver an AI-assisted service.
Transparency is central to the EDPB’s initial position. Conventional privacy notices are difficult to deliver to people passing briefly through a camera’s field of view. The board therefore points to recording signals that are obvious and reliable, including conspicuous lights and audio cues. Such warnings do not, by themselves, establish that processing is lawful, but their absence makes it harder for bystanders to understand what is happening and exercise rights where applicable.
Sensitive settings raise further issues. A recording in a hospital may disclose health information, while images taken in a workplace could capture employees whose ability to refuse recording is constrained by their employment circumstances. Schools add particular concerns involving children. Organisations introducing smart glasses for maintenance, remote assistance or staff training will need to distinguish operationally necessary recording from incidental collection and consider how footage might reach third-party platforms.
Recording transparency and information security involve different controls. A conspicuous recording light could alert people nearby but does not establish who receives the recording, how long it is retained or whether it is used to train another service. Those questions arise when a device automatically copies media to a linked account, enables remote access or processes ambient sound in order to answer a prompt. Each extra purpose can require a different assessment of necessity and access permissions.
In a workplace deployment, for example, an engineer using glasses to receive remote instructions may capture colleagues and visitors who are unrelated to the repair. A product designer might minimise this by narrowing the field of view or limiting retention, but the EDPB has not prescribed one universal technical solution. The obligations vary with purpose and context. It is also possible for multiple organisations to take different controller or processor roles over the same flow of information. An employer commissioning recording, an application company designing analysis and a storage provider handling footage cannot assume that the wearer alone is accountable. Those operational relationships need to be assessed at deployment, alongside the data collected and purposes for which it is retained.
The EDPB has issued an initial statement rather than binding new legislation. It is not a blanket ban on smart glasses, and it does not conclude that every use is subject to the GDPR. Existing rules on employment, criminal matters and civil privacy may also apply where the household exemption does. Further guidance and the underlying expert report will inform how regulators approach increasingly capable connected wearables.
