Connected glasses are bringing a familiar privacy question into a less familiar setting: what happens when a camera looks like an ordinary pair of spectacles? The EDPB’s (European Data Protection Board’s) statement of 13 October 2026, alongside recent CNIL (Commission Nationale de l’Informatique et des Libertés – the French data protection authority) publications and events, signals growing regulatory attention to the people being recorded – and to the responsibilities of manufacturers, service providers and wearers.
What the EDPB’s statement says
The EDPB’s initial statement provides preliminary guidance rather than a new legal regime. It explains that responsibility depends on who determines the purposes and means of processing. A wearer’s purely personal or household activity may fall outside the scope of the GDPR (General Data Protection Regulation), but public social media sharing and professional use can make the wearer a controller. Manufacturers and linked service providers remain responsible for their own processing and cannot transfer those obligations to users. Other laws may apply even where the household exemption does.
The statement also addresses the lawful basis for processing. Consent obtained after recording cannot retrospectively legitimise collection. Legitimate interests require a careful assessment, particularly where people in the vicinity been recorded would not expect commercial reuse or AI training. Transparency needs effective safeguards: recording indicators should resist circumvention and smartphone notifications should not be the only warning.
The EDPB’s position also received attention in the Belgian press. In a report published by RTL Info with AFP on 13 October 2026, EDPB Chair Anu Talus called for smart glasses to make recording clearly apparent to people nearby. She identified possible safeguards including prominent lights, audible signals, voice commands, privacy-preserving smartphone notifications and a distinctive design. Her comments underline the statement’s practical emphasis: people should be able to recognise when glasses are capturing their image or voice.
Italy’s data protection authority, the Garante, reinforced these points in a 14 October communication, highlighting measures such as limiting continuous recording and retention, obscuring faces, restricting use in sensitive locations and introducing friction before social media sharing.
CNIL: survey, warning and events
The CNIL’s recent work helps explain the concern. Its LINC (Laboratoire d’innovation numérique) survey, published on 11 May 2026, involved 2,128 adults surveyed in January. Eighty-one per cent considered the risk of photographs and videos being taken without consent greater with connected glasses than with smartphones. Nearly nine in ten would find being recorded without being informed disturbing.
In its accompanying call for vigilance, the CNIL warned about discreet capture and the normalisation of everyday surveillance. It announced work on compliance, European cooperation and engagement with other competent public authorities. Its practical recommendations include informing nearby people, switching capture off when unnecessary, avoiding unexpected recording environments and respecting image rights before publication.
Two CNIL events developed the discussion. Privacy Research Day on 24 June 2026, organised alongside the G7 privacy authorities’ meeting, connected researchers and regulators. The Rencontres Informatique & Libertés on 29 September, whose replay was published on 9 October, included a dedicated roundtable asking whether connected glasses represent a change of paradigm for regulation, with contributions from industry, research and the EDPB secretariat.
A further publication, ‘The connected gaze’, examines interpersonal surveillance, evidence gathering and power imbalances between wearers and those observed. Published through the EDPB’s Support Pool of Experts programme, it complements CNIL’s quantitative research.
Earlier warnings and other regulators
Regulatory concern predates the latest AI features. In September 2021, Ireland’s DPC (Data Protection Commission), working with Italy’s Garante, questioned whether the small recording light on Facebook View/Ray-Ban glasses effectively informed people in the vicinity that they were being recorded. The DPC said it had not been shown comprehensive field testing demonstrating the light’s effectiveness.
More recently, the Dutch Autoriteit Persoonsgegevens has published dedicated camera-glasses guidance and advised against using them as everyday spectacles, given their privacy risks.
A blog post published by the ICO (Information Commission’s Office) on 17 September adds an accessibility perspective. While condemning intrusive uses, it recognises benefits for visually impaired people and people living with dementia. It also questions reliance on visual warnings that some people in the vicinity being recorded cannot perceive.
Its message is that privacy safeguards and accessible transparency need to develop alongside product capabilities. This is published regulatory commentary, rather than an enforcement decision.
The limits of recording indicators
That raises a significant question: how can smart glasses remain available to wearers with an impairment, who benefit from them, while still protecting the privacy rights of those nearby? It is doubtful that anyone wearing the glasses can consistently protect those within range from unwanted recording. The EDPB suggests recording indicators, audible signals and similar safeguards, but how can they be enforced if the wearer can turn them off? An infringement of privacy rights would come to light only if the violation was caught or reported, and it is not clear how anyone could demonstrate sufficient evidence to support a claim for redress.
There is also the question of whether smart glasses are suitable for general consumers. Given their privacy risks, restricting them to professional use might be explored. Manufacturers could also offer different models for the general public and professionals. While manufacturers of the devices might not relish limits on sales, it might prove a viable way to contain improper usage and privacy violations.
Deployment, data flows and regulation
For organisations considering deployment, the practical implication is to assess the full journey from capture to storage, sharing and AI reuse. The emerging regulatory expectations make bystander awareness, clear responsibility and limits on collection central questions before these devices become part of operations.
A data controller will benefit from a detailed flow map of data collection that distinguishes data types and the lifecycle of each type of data. For instance, captured images and video may need to show a data flow with elevated security measures. Audio clips or sound bites may require less stringent security if the audio clips cannot distinguish identifiable personal data.
Conversely, recorded calls might require security and notification of recording safeguards. These are filters smart glasses models should undergo to appropriately comply with privacy laws and prevent infringement of the public’s rights.
Innovative devices like smart glasses will need to be assessed against data protection regulations. Not every new device will be named in legislation, but each device’s functionality will need to be applied against the relevant requirements before wider commercial distribution.
Perhaps it becomes a question of weighing personal rights and freedoms against the steady influx of technology. Arguably, there is no benefit to limiting innovation purely for its own sake, but individuals’ rights and privacy are a justifiable first consideration before implementing all of a device’s capabilities.
From this perspective, this is purely an evaluation of risk vs reward: where a risk is unacceptable, there must be remediation or a means to reduce it. Likewise, with smart glasses, the reward from their functionality is clear, but privacy legislation is potentially a route to provide an appropriate level of public assurance.