The European Data Protection Board today adopted a statement on smart glasses that places the burden of informing bystanders on the companies that build the devices and run the AI services behind them, rather than on the people wearing them. The eight-page document, signed by EDPB Chair Anu Talus and dated October 13, 2026, says consent from non-users is difficult to obtain, that legitimate interests would be "particularly difficult to demonstrate" for AI training, and that current recording indicators leave many bystanders unaware they are being captured.

In Short

Europe's privacy regulators said the companies making camera glasses, and the companies running the AI inside them, are responsible for telling strangers when they are being filmed or analysed. That matters because people walking past someone wearing the glasses usually cannot tell anything is being recorded, and they never agreed to it. The regulators suggested brighter lights, sounds, phone alerts and design changes, and said using bystanders' images to train AI or for other commercial purposes will be very hard to justify under EU law.

What the statement covers

The document is short by EDPB standards: 36 numbered paragraphs and 39 footnotes across eight A4 pages. It describes itself as the board's "preliminary reflections on the privacy implications of smart glasses," and it is a statement, not a set of guidelines. There is no public consultation attached and no binding effect on any specific company. No manufacturer is named anywhere in the text.

Alongside the statement, the board published a separate report titled "The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses." According to the EDPB, it was written by a digital sociologist contracted under its Support Pool of Experts programme, following a proposal from France's CNIL, and does not necessarily reflect the board's official position.

Its definition is broad. According to the EDPB, smart glasses are "wearable devices which often look like regular glasses or sunglasses, and which incorporate computing capabilities and features such as cameras, speakers, microphones, and software or applications, including artificial intelligence systems for various purposes (e.g. translation or object identification)." The board adds that they may connect to the internet, phones or other devices, and may be controlled by voice or by "wristbands detecting hand gestures" - a description that matches the EMG Neural Band Meta ships with its Ray-Ban Display glasses, which Meta opened to developers through two SDK paths in May 2026.

The legal starting point is simple. Where the glasses "capture, collect, record, adapt, store, or otherwise process any information relating to an identified or identifiable natural person, they process personal data," and the GDPR applies, according to the statement. Everything else in the document follows from who carries the obligations that flow from that.

Why glasses are treated differently from phones

The EDPB lists the common uses: music, phone calls, photographs, video, real-time translation, live streaming, and "augmented" displays. It also acknowledges legitimate benefits, citing navigation, documentation of events, and "disability aid (for example by providing audio assistance and real-time hazard awareness)."

The problem, in the board's view, is form factor. "Unlike many other recording devices, they allow a near invisible or hidden collection, storage, and other forms of processing of personal data since they can be difficult to distinguish from ordinary eyewear," the statement says. It flags "advanced microphones, which can record background conversations to which the user is not participating," and warns that pairing the glasses with facial or voice recognition "raises unprecedented questions regarding societal choices and poses a high risk to the rights and freedoms in public spaces."

That reference to facial recognition is not hypothetical in the current market. The Hamburg data protection authority's 53-page technical report, published on September 10, 2026, found face-related database tables in the Meta AI app that were empty, and noted that the EFF and WIRED had reported in June 2026 that a recognition feature had briefly existed before Meta patched it. The Hamburg regulator concluded that Ray-Ban Meta glasses expose bystanders without consent, and today's statement reads in places like a Europe-wide endorsement of that analysis.

The EDPB goes further than data protection. Even when people recognise the device, they "may still oppose being filmed or recorded," and the statement describes a "subtle social effect, where individuals alter their behaviour, suppress spontaneity, and conform to social norms perceived to be more socially acceptable due to their perceived threat of unvetted surveillance." It names sensitive settings where recording may be "inappropriate, or prohibited under national law or local rules": medical facilities, schools, changing rooms, swimming pools, beaches, toilets and workplaces, where trade secrets and employee monitoring are at stake. A footnote points to a proposal in Hamburg to ban smart glasses on public transport and in swimming pools.

Three possible controllers

The most consequential section concerns responsibility. According to the EDPB, three types of actor may be controllers: the user, "the producer of the device, or the provider of a linked application or service (including AI systems)." Depending on who decides the purposes and means of processing, one of them may act alone or two or more may be joint controllers.

The wearer

For individuals, the household exemption in Article 2(2)(c) GDPR still matters. A wearer who shares a photo with a friend, or uses translation privately, is outside the regulation. But the EDPB says the exemption "must, however, be narrowly construed," citing the Court of Justice rulings in Ryneš (C-212/13), Lindqvist (C-101/01) and Buivids (C-345/17). Posting footage "to an indefinite number of persons on a public social media account," or using the glasses in "official, professional, political or other non-personal activities," turns the wearer into a controller with full transparency duties.

That has direct implications for creators who film content with glasses and publish it on Instagram, TikTok or YouTube. Under the statement's reading, a public account is enough to take a wearer outside the personal-use exception.

The manufacturer and the AI provider

The statement then closes a door that device makers might otherwise have used. Recital 18 GDPR already says the regulation applies to companies that "provide the means for processing personal data for such personal or household activities," and the EDPB applies that directly: the glasses producer and the provider of linked AI services remain subject to the GDPR even when the wearer is exempt.

The board gives a concrete example. A manufacturer or AI provider is a controller "when the provider of the AI functionalities of the smart glasses processes personal data in order to provide the user with an answer about its surroundings, for example by analysing an image from the glasses' camera feed in which other persons appear."

The key sentence follows: such controllers "should not rely on the users' actions to meet their own GDPR obligations, such as transparency toward other individuals whose data might be processed when the smart glasses are being used." In practice, a terms-of-service clause asking wearers to inform people around them does not discharge the company's own duties.

Further use of the data is also constrained. Where controllers process data for a new purpose, it must be compatible with the original one, and "particular attention should be given to the context in which the personal data was collected, especially when the data subjects have no relationship with the controller."

The transparency gap

The EDPB describes transparency as "a major challenge" for smart glasses, and its assessment of the current market is blunt: "The current state of the art with regards to indicators on smart glasses leave many non-users unaware that their data is being processed."

Standard privacy notices do not solve this. According to the statement, they "do not seem sufficient or appropriate to inform non-users," particularly where the manufacturer or AI provider has "no relationship with these persons and are not able to contact them." Some functions, such as translation and AI features, "may also be particularly invisible to bystanders."

The board instead asks for a combination of measures that provide "by default in-the-moment transparency." A footnote adds that these measures "should be impossible or difficult to disable (taking into account the state of the art) and easy for bystanders to notice in practice." Four categories are listed.

Visual indicators

LEDs must be "visible in many lighting conditions," noticeable enough "to attract the attention of individuals within the field of collection," and active long enough for people to understand that the glasses are recording "or capturing images/video for processing by an AI assistant." The EDPB suggests different patterns for different functions, such as prolonged light for recording and flashing for a photo, and says "it should not be possible to record information when the indicator is covered."

A footnote raises two points manufacturers may not have considered. LEDs "might be difficult or impossible to notice for individuals who are visually impaired," and "a white LED generally could be mistaken for a reflection or solar glare."

Both points are relevant to existing hardware. Meta changed its second-generation glasses in July 2026 so that the camera stops working if the capture LED is destroyed, extending an earlier safeguard that only covered tape or a finger over the light. That LED is white. The Hamburg report noted that the first-generation light glows dimly during AI interactions and that the second-generation light stays off during them - exactly the AI-processing scenario the EDPB now says indicators must cover.

Audio indicators

The EDPB suggests shutter-style sounds and voice activation, where the wearer must "dictate the command out loud." It cites Japan's Ordinance on the Healthy Development of Juveniles, which according to the statement "even bans the muting of shutter sounds on smartphones" since an amendment in 2015.

Phone-based proximity alerts

Several apps already detect nearby smart glasses through broadcast Bluetooth identifiers tied to manufacturers. The EDPB says manufacturers "could also consider sending specific signals when devices are recording." It attaches three conditions: such alerts cannot be the only method, because that would exclude people without the app; individuals must be able to accept or refuse notifications; and the app must not enable "the tracking of the smart glasses' users."

Design

Finally, the statement suggests "other clues in the design of the glasses" to help people tell smart glasses from ordinary eyewear, with reference to the data protection by design principle in Recital 78 GDPR.

Whatever mix is chosen, technical measures must be "effective, impossible or difficult to circumvent, and updated whenever necessary," according to the EDPB. The board also "recommends the development of industry-wide standards and awareness raising campaigns."

Section 3.3 is the part with the clearest commercial consequences.

Consent under Article 6(1)(a) may work in some cases, and the EDPB notes that national image-rights laws may make it "the most appropriate legal basis" for publishing someone's picture. But where the manufacturer or AI provider processes data on non-users "with whom they have no relationship, it would be difficult to obtain their freely given, specific, informed and unambiguous consent." Retrospective permission is ruled out: "Consent obtained after collection, for example following the recording, would not be valid as the legal basis must exist prior to and during any processing."

On legitimate interest under Article 6(1)(f), the statement points to "the current insufficient transparency, which negatively impacts the reasonable expectations of non-users." The balance would be "particularly difficult to demonstrate for further processing for commercial purposes that go beyond providing the service explicitly requested by the end-user, or for AI training, which bystanders wouldn't expect, especially if they are not aware of the initial data collection."

A footnote sharpens the point: "meeting transparency requirements does not, in itself, mean that data subjects can reasonably expect the processing, particularly for further processing such as AI training." In other words, a brighter LED would not automatically make AI training on bystander images lawful.

Even where legitimate interest holds, controllers must ensure "all data subjects are able to object at any time" under Article 21(1), "which can prove difficult in many cases." For a person filmed on a street by a stranger, there is no obvious channel for objecting to anyone.

The statement cites EDPB Opinion 28/2024 on AI models, adopted on December 18, 2024, and paragraph 123 of the Court of Justice's Meta v Bundeskartellamt ruling (C-252/21). The 2024 opinion established a three-step legitimate interest test for AI development, and EDPB Guidelines 1/2024 on Article 6(1)(f), adopted on October 8, 2024, set out the same three cumulative conditions referenced in today's footnote. An EDPB case digest published in March 2026 found that controllers most often fail that test on reasonable expectations, frequently because of poor transparency - the same weakness the board now identifies in smart glasses.

Other obligations, including ePrivacy

The EDPB lists further duties without analysing them: data protection by design and by default, security, special category data, processor contracts, international transfers and children's protection. On children, it says they "may be less aware of the presence or implications of smart glasses and therefore more vulnerable to covert or intrusive processing."

One paragraph extends the analysis beyond the GDPR. In some circumstances, the glasses "may be regarded as terminal equipment to which the ePrivacy framework may also be applicable," specifically "when sensors collecting, locally storing and processing information (e.g. images, videos or sound) are embedded in the device, or where the information is by default made available to a remote server." The board cites its Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, which PPC Land first covered in December 2023. Article 5(3) is the rule behind cookie consent banners. Applying it to wearable sensors would bring device storage and access on glasses into the same consent framework that governs tracking on websites and apps.

The board also encourages additional technical measures:

  • Data minimisation, including limits on continuous recording, live streaming and retention. The EDPB says "a user should not justify their continuous or indiscriminate recording of other individuals solely by a general or hypothetical concern for their personal safety."
  • Privacy-friendly defaults, such as blurring bystander identities, and pseudonymisation or anonymisation before sharing or re-use, with processing "on-device" where possible. Where glasses are mainly for real-time assistance, "persistent storage of captured audio, images, or video may not be necessary and should therefore be disabled by default."
  • Geofencing in sensitive locations.
  • "Privacy frictions" that slow down sharing on social media platforms.

The last paragraph before the conclusion notes that breaching criminal, civil, labour or sector rules may "call into question the fairness of the processing" under Article 5(1)(a) GDPR, linking local bans to GDPR compliance.

The sources the EDPB relied on

The statement draws heavily on work published this year. It cites the G7 data protection authorities' "Compendium of Approaches on Smart Glasses" from June 2026, the International Working Group on Data Protection in Technology's working paper on extended reality dated June 16, 2026, and a September 24, 2026 press release from Germany's Datenschutzkonferenz, the conference of federal and state data protection authorities. It also references guidance from Sweden's IMY on smart glasses and the Irish Data Protection Commission's January 2020 guidance on body-worn and action cameras.

Body cameras offer the closest legal precedent. In December 2025, the Court of Justice ruled that people recorded by body cameras must be informed at the time of collection, treating observation-based capture as direct collection under Article 13 GDPR. Today's statement does not cite that judgment, but its demand for "in-the-moment transparency" sits close to the same logic.

The final footnote points outside Europe, to California Senate Bill 1130. The bill, introduced on February 17, 2026, would criminalise disabling a wearable device's recording indicator, as well as selling technology designed to do so.

The text shows some signs of being finalised quickly. Paragraph 24 contains a stray "17.as well" where a footnote marker runs into the sentence, and the footnote on the Hamburg ban proposal is unnumbered. Neither affects the substance.

A lawyer questions the board's remit

Criticism arrived within hours. Peter Craddock, a Brussels data protection lawyer who joined Osborne Clarke as a partner in September 2026, questioned on LinkedIn whether the EDPB had acted within its mandate. "OK, how is 'social acceptability' part of data protection authorities' remit?" he wrote, describing the sociological report as "not on data protection aspects but only on social acceptability of smart glasses."

Craddock called the move "inherently political" and said it "raises significant questions as to the EDPB's compliance with its own missions under Art 70 #GDPR and I would not be surprised if someone challenges this as a misappropriation of EU funds." Article 70 lists the board's tasks, which centre on examining questions on the application of the GDPR and issuing guidelines, recommendations and best practices. No challenge had been filed when he posted, and he did not say he would bring one.

His second objection concerns the statement itself. In July 2025, the board adopted its Helsinki Statement on enhanced clarity, support and engagement, which Craddock quoted: "the EDPB will strengthen its dialogue with stakeholders, holding proactive and early engagement to identify areas where further support and clarification is required, and providing the opportunity for stakeholders to flag possible inconsistencies and give feedback." The smart glasses statement, he wrote, was published "without such engagement," and is "neither Guidelines nor an Opinion yet already makes a number of judgement calls and legal assessments." The examples are easy to find in the text: the narrow reading of the household exemption, the finding that post-recording consent is invalid, and the possible application of the ePrivacy rules. None went through public consultation.

Craddock also argued that the board's past statements concerned legislative files, or in one case transfers to Russia, and "never as far as I can recall about an actual technology." There is at least one partial counterexample. In February 2025, the EDPB adopted Statement 1/2025, setting out ten principles for age assurance methods such as age estimation and verification. His broader question still stands: "have 'statements' become an avenue for the EDPB to avoid stakeholder dialogue while still influencing the way in which supervisory authorities across the EU handle certain topics?"

The statement's own closing paragraph uses language close to Helsinki's, noting "the importance of providing timely and concise guidance that is accessible, easy to understand, and practical." And the social effects Craddock objects to are not confined to the report: paragraph 8 of the statement describes people who "alter their behaviour, suppress spontaneity, and conform to social norms" because of perceived surveillance. The board's position is that such expectations bear on transparency and the legitimate interest balance. Craddock's is that a data protection regulator has no business commissioning sociology to support it.

His criticism follows a consistent line. In April 2026 he faulted the board's first DPIA template, itself a Helsinki deliverable, and in September he argued that an EDPB letter to the Commission conflicted with its own anonymisation guidelines. In each case the complaint has been about the predictability of EDPB output rather than any single conclusion.

Why this matters for marketers and platforms

Smart glasses sit at the junction of three issues PPC Land has followed closely: AI training on personal data, the reach of the ePrivacy rules, and the advertising value of camera-equipped devices.

When Meta added real-time AI features to Ray-Ban Meta glasses in September 2024, PPC Land examined how the glasses could feed visual and attention data into advertising, from tracking which outdoor ads wearers look at to personalised out-of-home placements. Those scenarios were speculative, and Meta has not announced them. But today's statement narrows the legal room for any such use where bystanders are involved. "Further processing for commercial purposes that go beyond providing the service explicitly requested by the end-user" is precisely the category the EDPB says is hardest to justify under legitimate interests. A footnote also cites the EDPB's Guidelines 8/2020 on the targeting of social media users alongside behavioural analysis and profiling.

The AI training point lands as EU lawmakers are rewriting the rules. The Commission's Digital Omnibus proposed a new Article 88c making legitimate interest available for AI development. In February 2026, the EDPB and EDPS questioned whether that clause was needed at all, and in September a Council compromise draft dropped the Commission's unconditional right to object. Today's statement makes clear that, on the regulators' reading, a legal basis that might exist on paper still depends on bystanders being able to object - something the board says "can prove difficult in many cases."

Ireland adds another dimension. Meta's lead supervisory authority is the Irish Data Protection Commission, and Meta pledged 15,000 Ray-Ban Meta glasses to Vision Ireland in August 2026 for blind and visually impaired adults. The EDPB itself recognises disability aid as a legitimate use. Yet its footnote on visually impaired people being unable to see LEDs illustrates how difficult it is to design one indicator for every person on both sides of the lens.

What the statement does not do is equally important. It sets no deadline, imposes no ban and does not say any current product is unlawful. The EDPB says "further guidance may be useful" and that it "will further analyse and work on the privacy concerns raised by smart glasses, including in connection with other video devices which raise similar legal questions." For manufacturers, that suggests formal guidelines could follow. For national authorities, the statement offers a shared reference point for complaints and investigations that, as Hamburg has shown, are already under way.

Timeline

Summary

Who: The European Data Protection Board, the body of EU and EEA data protection authorities chaired by Anu Talus. The statement addresses smart glasses manufacturers, providers of linked apps and AI services, and wearers. No company is named.

What: An eight-page statement setting out the board's preliminary view that manufacturers and AI providers are controllers who cannot rely on wearers to meet GDPR duties, that current recording indicators leave many bystanders unaware, that bystander consent is difficult to obtain, and that legitimate interest would be particularly difficult to demonstrate for commercial further processing or AI training. It lists visual, audio, phone-based and design measures and says ePrivacy rules may also apply.

When: Adopted today, October 13, 2026. Peter Craddock of Osborne Clarke questioned the board's remit and process on LinkedIn the same day.

Where: The European Union and the European Economic Area, wherever smart glasses process personal data of identifiable people.

Why: Smart glasses can record people almost invisibly, and AI features can analyse bystanders who have no relationship with the device maker. The EDPB says this creates major transparency and legal-basis problems, and it intends to do further work on smart glasses and similar video devices.