'/%3E%3C/svg%3E){kind=small}
On 13 October 2026 the European Data Protection Board (EDPB) published Statement 1/2026 on smart glasses, wearable devices equipped with cameras, microphones, speakers and artificial intelligence features. The document gives preliminary guidance to users, manufacturers and service providers on how the General Data Protection Regulation (GDPR) applies to these devices.
The statement and the accompanying report
According to the EDPB press release, the statement was adopted at the Board’s latest plenary meeting; the text bears the adoption date of 13 October 2026. It describes smart glasses as wearable devices that often look like regular glasses or sunglasses and may connect to the internet, external devices or mobile applications, used for music, calls, photos, video recording, real-time translation, live streaming and augmented reality displays.
In the same press release the EDPB announced the report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses”, published on 1 October 2026 under the EDPB Support Pool of Experts (SPE) programme. The report was prepared by an external contractor, Yann Bruna, Associate Professor and sociologist at the University of Paris-Nanterre, and reflects the views of the authors, which do not necessarily represent the official position of the Board. The qualitative study was commissioned following a proposal from the French data protection authority and complements a quantitative study by the same authority.
Uses and identified risks
Among the main risks, the statement lists the recording of individuals without their knowledge, since the devices are difficult to distinguish from ordinary eyewear, the capture of background conversations in which the user is not taking part, and the possible combination with facial or voice recognition, which entails high risks in public spaces. It also points to a subtler social effect, whereby people alter their behaviour and suppress spontaneity when they may be recorded.
Particular attention is given to sensitive settings, including healthcare facilities, schools and other places where minors are present, changing rooms, pools and beaches, toilets, intimate situations and workplaces. According to the press release, the research behind the SPE report indicates that smart glasses are sometimes becoming instruments of interpersonal surveillance and evidence handling, and that they create power imbalances between those who use them and those being recorded. In the same press release the EDPB Chair, Anu Talus, stresses that children are especially at risk, whether they use the glasses or are filmed; the statement in turn calls for particular attention to the protection of children.
Roles and responsibilities in data processing
As regards roles, the statement specifies that responsibility may rest with the user, the manufacturer or the provider of linked apps and artificial intelligence services, alone or jointly. A user who employs the devices for purely personal activities generally falls under the household exemption in Article 2(2)(c) GDPR, which, according to the Board, must be narrowly construed and considered case by case, with reference to the case law of the Court of Justice of the European Union (Case C-212/13, Ryneš).
Referring to Case C-101/01, Lindqvist, and Case C-345/17, Buivids, the statement notes that the exemption does not apply where photos or videos are shared with an indefinite number of persons on a public social media account, nor to official, professional, political or other non-personal activities: in such cases the user may be a controller subject to transparency obligations. Manufacturers and service providers remain subject to the GDPR even where the user is exempt, and may not rely on users to meet their own information obligations. Any further processing must also be compatible with the original purposes, under Article 5(1)(b) and Article 6(4).
Transparency towards bystanders and legal basis
On transparency (Articles 12 and 13 GDPR), the Board observes that people who are recorded, the so-called non-users, often do not know that processing is taking place, who is carrying it out and for what purpose, and that traditional privacy notices are usually insufficient. The measures indicated, to be combined, include light indicators that are visible in many lighting conditions, with recording disabled when the indicator is covered, audio cues, voice-activation requirements, smartphone proximity notifications (never as the sole method and without tracking users), and design features that distinguish smart glasses from ordinary glasses. The Board also recommends industry-wide standards and public awareness measures.
As for the legal basis (Article 6(1) GDPR), each processing activity needs a valid basis, whose validity is likely to require a case-by-case assessment taking into account the applicable laws, the processing and its context. Where national laws on image rights require a person’s consent before their image is reproduced and publicly distributed, consent will likely be the most appropriate basis. Where the controller is the producer or the provider of a linked service, the statement observes that it would be difficult to obtain valid consent from non-users, with whom they have no relationship; in any case, consent obtained after the recording is not valid. Legitimate interest requires the three-part test (legitimate interest, necessity, no overriding rights of the data subjects) and is described as particularly hard to justify for further commercial processing and for the training of artificial intelligence systems. The right to object (Article 21(1)) must be exercisable at any time, and the processing of special categories of data also requires a condition under Article 9(2).
Other aspects: data protection by design and the ePrivacy framework
The statement refers to data protection by design and by default (Article 25 GDPR), security of processing, the use of processors and sub-processors, transfers to third countries and enhanced protection for children. It also notes that smart glasses may be regarded as terminal equipment to which the framework of Directive 2002/58/EC on privacy and electronic communications may apply, referring to its Article 5(3): this is the case in particular where sensors collecting, locally storing and processing information are embedded in the device, or where the information is by default made available to a remote server.
The technical measures encouraged include data minimisation (limiting continuous recording, live streaming and retention), blurring of bystanders, pseudonymisation or anonymisation, on-device processing, disabling persistent storage by default where real-time assistance is the main purpose, geofencing of sensitive locations and privacy frictions that slow down sharing on social networks. The statement also points to sources of law other than data protection: some uses might be prohibited under national criminal, civil or labour law and other sector-specific rules. The document notes that related devices, such as video doorbells, dash cams, body-worn cameras and voice assistants, raise similar questions.
Outlook
The press release presents the statement as initial guidance. The Board notes that further guidance may be useful, including to raise awareness among producers, users, controllers and third parties, and that it will further analyse the privacy concerns raised by smart glasses, including in connection with other video devices. Still to be defined are any industry standards for signalling that recording is under way, awareness-raising initiatives, and the way national data protection authorities will apply the principles set out to individual cases.
In dialogue with the 2030 Agenda
- Goal 9 (Industry, Innovation and Infrastructure). Smart glasses are wearable devices that combine sensors, connectivity and artificial intelligence features; the statement points to data protection by design and industry standards as reference points for their deployment.
- Goal 16 (Peace, Justice and Strong Institutions). The statement concerns the protection of privacy and of the fundamental rights of people who are recorded, the role of supervisory authorities, and the transparency and accountability rules for users, manufacturers and providers.
Sources
- EDPB, press release of 13 October 2026 on the smart glasses statement
- EDPB, Statement 1/2026 on smart glasses (document page)
- EDPB, Statement 1/2026 on smart glasses (text, PDF)
- EDPB, SPE report “The connected gaze” (document page)
- EDPB, SPE report “The connected gaze” (text, PDF)
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (EUR-Lex)
- Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 (EUR-Lex)
