At its plenary on 13 October 2026, the European Data Protection Board (EDPB) adopted a statement on the data protection challenges of smart glasses, published alongside an expert report commissioned through its Support Pool of Experts at the proposal of the French CNIL. Because these devices look like ordinary glasses but carry cameras, microphones, and connectivity, people can be recorded without knowing it.
Key points
- Transparency for bystanders is the central challenge, with higher risks in hospitals, schools, and workplaces, for recordings shared on social media, and for children.
- A wearer becomes a controller when posting to a public social media account or using the glasses for professional, official, or political activity; purely personal use is likely to fall under the GDPR household exemption.
- Manufacturers and service providers are controllers in their own right, cannot shift their obligations onto users, and must make sure any further use of captured data is compatible with the original purpose.
- The EDPB recommends clear, reliable, and hard-to-ignore recording indicators, such as bright lights, sounds, and phone notifications.
Organisations that let staff use smart glasses at work, for example in field service, healthcare, retail, or security, should carry out a data protection impact assessment, set acceptable use rules covering notice to bystanders and no-recording areas, and check the vendor’s processing terms. Manufacturers should review their recording indicators and any secondary use of captured data.
Source: European Data Protection Board
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
