The European Data Protection Board (EDPB) has adopted statement 01/2026 on smart glasses (the Statement) which sets out its preliminary reflections and guidance for users, manufacturers and service providers on the data protection implications of the technology. Alongside the statement, the EDPB published research commissioned through its Support Pool of Experts programme examining how smart glasses are being used and perceived; its findings suggest that the issues extend beyond conventional questions of GDPR compliance, with smart glasses potentially becoming tools for covert surveillance and evidence gathering. The UK government has hinted at a ban on selling the technology; the minister for safeguarding stated that “the benefits of smart glasses must be weighed against the harms they can cause. The government is already looking into options to restrict smart glasses in certain settings and restricting the sale to certain users.” This is certainly going to be an interesting area to watch from a privacy and design perspective, both in the EU and in the UK. Below we examine the key details from the EDPB statement.
Key issues
Smart glasses are becoming increasingly mainstream. Fitted with cameras, microphones and in some cases, AI-enabled functionality, they can offer everything from real-time translation and navigation to accessibility tools and hands-free recording. From a privacy perspective smart glasses pose significant issues; unlike holding up a smartphone to take a photograph or video, it may not be apparent that a person wearing smart glasses is recording at all for example. Where smart glasses capture, collect, record, adapt, store, or otherwise process any information relating to an identified or identifiable person, they process personal data, and the processing is therefore subject to the GDPR (noting that exceptions might apply). The EDPB considers the risks particularly acute in sensitive environments such as hospitals, schools and workplaces, private situations, as well as where children are involved or recordings are subsequently shared on social media. The accompanying EDPB research found that smart glasses can become instruments of interpersonal surveillance and evidence gathering and identified potential power imbalances between people who know how to use the technology effectively and those being recorded. This matters because the privacy implications are not confined to what happens to data after it has been collected.
Who is responsible?
Responsibility under the GDPR will depend on how the glasses are being used. The Statement indicates that depending on the circumstances, responsibility for processing personal data through smart glasses may arise for different actors, including the user of the smart glasses, the producer of the device, or the provider of a linked application or service (including AI systems). In some cases, one actor may act as sole controller; in others, two or more actors may qualify as joint controllers. The assessment will depend on who determines the purposes and means of the processing and the qualification of the user under the GDPR depends on their use of the smart glasses. An individual taking photographs or videos of family and friends, or using the glasses for personal translation in a private setting, may fall within the household exemption in Article 2(2)(c) GDPR however that exemption is limited. A wearer may themselves become a controller if, for example, footage is published on a public social media account or the glasses are used for professional, official or political purposes. Manufacturers and providers of linked apps or services may themselves be controllers and cannot simply transfer their GDPR obligations to users; they must consider whether any subsequent processing remains compatible with the purposes for which the information was originally collected. This is important where data captured through the glasses is not simply used to provide the functionality requested by the wearer, but is retained or reused for another purpose.
Transparency requirements
Compliance with the transparency requirements of the GDPR presents a major challenge in the context of smart glasses, and the EDPB states that transparency is essential to make data subjects, whether they are users or bystanders (also referred to as ‘non-users’), aware that their personal data is being processed, and to what extent. Such information is a necessary precondition for individuals to be able to exercise their rights as data subjects. A conventional privacy notice has obvious limitations where a passer-by does not even know that a device is processing their personal data. The EDPB suggests smart glasses could incorporate visible lights, audio signals, voice-activation cues, smartphone notifications or distinctive design features to make recording apparent. Whenever compliance with the transparency requirements of the GDPR relies on technical measures, it is necessary to ensure that they are effective, impossible or difficult to circumvent, and updated whenever necessary. The EDPB recommends the development of industry-wide standards and awareness raising campaigns to ensure that individuals identify smart glasses and understand what type of data processing may be occurring in different situations. Transparency should therefore be built into product-design and manufacturers will need to think about whether people can actually tell when a device is recording and whether indicators can readily be switched off or circumvented.
A lawful basis
Any processing within the scope of the GDPR must have a valid legal basis under Article 6(1) GDPR. Given the complexities and variations of data processing via smart glasses, the validity of any chosen legal basis is likely to require a case-by-case assessment taking into account the local applicable laws, the specific processing and its context, and any further use of the data. Making recording visible does not make it lawful, consent may be difficult to obtain from every individual captured by smart glasses and, crucially, obtaining consent after someone has already been recorded cannot retrospectively legitimise that processing. Legitimate interests may offer an alternative in some circumstances (assessed on a case by case basis) however considering the nature of the data, the context of the processing and the current insufficient transparency, which negatively impacts the reasonable expectations of non-users, sufficient mitigating measures would need to be put in place in order to achieve a fair balance between the interests involved. This would be particularly difficult to demonstrate for further processing for commercial purposes that go beyond providing the service explicitly requested by the end-user, or for AI training, which bystanders wouldn’t expect, especially if they are not aware of the initial data collection.
What about personal use?
The GDPR will not always apply; the household exemption may cover genuinely personal uses, such as sharing photographs or videos privately with friends or family. However, publishing footage to an indefinite audience on a public social media account is a different matter, as is using smart glasses in a professional or official capacity. Even where the GDPR does not apply, other legal regimes may. Depending on the circumstances, civil, criminal, employment and sector-specific laws may remain relevant. The ePrivacy rules may also apply where smart glasses constitute terminal equipment. The EDPB notes that the GDPR will still apply to device manufacturers and providers of linked applications or services (including AI systems), even where the user benefits from the household exemption.
What does this mean for businesses?
The EDPB's statement is preliminary guidance rather than a new set of rules, however it does indicate the direction of regulatory thinking. For manufacturers and providers of smart glasses, apps and related services, compliance needs to begin with the design of the product. That is likely to mean considering:
- Transparency: can people readily tell when the device is recording or otherwise processing their data?
- Data minimisation: does the device need to collect all the information it captures, and does that information need to leave the device?
- Purpose limitation: will data subsequently be used for analytics, product development or AI training?
- Lawful basis: what justifies the processing of information about people who have no relationship with the provider?
- Privacy by design: are recording indicators enabled by default and difficult to disable?
- Sensitive settings: are additional restrictions appropriate in workplaces, schools, healthcare environments or other locations where there may be particular privacy expectations?
- Children: could children either use the product or be captured by it, and what additional protections are required?
The EDPB is not seeking to prevent the development of smart glasses; it acknowledges the considerable opportunities they offer for communication, assistance and innovation. It is clear the privacy aspect must be carefully considered, and for organisations developing or deploying the technology, the practical message is that transparency needs to be built into the product. The EDPB has stated that it will further analyse and work on the privacy concerns raised by smart glasses, including in connection with other video devices which raise similar legal questions – we will monitor this area for development. From a UK perspective, this is certainly an area which will be under scrutiny and we will monitor the government and any legislative response.
