Navigating the Data Protection Challenges of Smart Glasses

The European Data Protection Board (EDPB) adopted a statement on smart glasses on 13 October 2026. As these devices become more common in various sectors, businesses must confront the privacy issues they introduce. Smart glasses carry cameras and microphones that can capture audio, video and other data in real time, and they can be difficult to distinguish from ordinary eyewear. That is the EDPB’s central worry: the people around the wearer may be recorded without knowing it.

The statement’s first point is about responsibility. A user of smart glasses is outside the GDPR only while the use is purely personal — sharing a video with family or friends, or using the glasses to translate a menu. The EDPB reads that exemption narrowly. Share footage with an indefinite audience on a public social media account, or use the glasses for professional, official or political purposes, and the user becomes a controller or joint controller with the full set of GDPR obligations, transparency first among them. Manufacturers and the providers of linked apps or AI services are controllers in their own right, and the EDPB says plainly that they cannot rely on users to meet their transparency duties towards bystanders.

Transparency is the heart of the statement. Bystanders may have no idea that their data is being processed, by whom or for what purpose; translation and AI features may be the most hidden of all. The EDPB wants in-the-moment signals that are hard to switch off — visible recording indicators that cannot be covered, audible cues, notifications to nearby phones, and designs that make smart glasses recognisable as such — alongside the information that Articles 12 to 14 of the GDPR already require.

On lawful basis, the EDPB is candid. Consent is difficult to obtain from people who have no relationship with the manufacturer or app provider, and consent gathered after the recording is not valid, because the basis must exist before and during the processing. Legitimate interests calls for a careful case-by-case balancing, and the EDPB singles out further use of footage for commercial purposes beyond the requested service, or for AI training, as particularly hard to justify.

For organisations putting smart glasses to work, the practical consequences follow. Recording in sensitive settings — medical facilities, schools, changing rooms, workplaces with confidentiality concerns — may be inappropriate or prohibited outright. Limit continuous recording, live streaming and retention; use privacy-friendly defaults such as blurring bystanders before anything is shared; and set clear rules for staff on when and where the devices may be used, with training to match. Where the use is likely to result in a high risk to individuals — systematic monitoring of a publicly accessible area is the obvious case — Article 35 of the GDPR requires a data protection impact assessment before the processing starts.

The EDPB describes this as an initial statement and says further guidance will follow. For businesses looking to use smart glasses while staying compliant, it is a call to action: stay informed as the guidance develops, and assess and update your practices as it does. An Article 37 readiness review can help organisations evaluate their current data protection measures and identify areas for improvement.

Privacy Core Services offers fixed-fee Article 37 readiness reviews to assist businesses in navigating the complexities of GDPR compliance. By addressing the challenges posed by smart glasses early, companies can innovate responsibly and keep the trust of their customers and the people they record.