EDPB Issues Preliminary Guidance on Smart Glasses Privacy Risks

The European Data Protection Board adopted a statement on smart glasses on October 13, 2026. The document offers preliminary guidance on privacy risks for users, manufacturers, and service providers, aiming to increase awareness as AI-equipped wearables become more common. No public consultation was attached to the statement and it has no binding effect on any specific company.

How smart glasses process personal data

Smart glasses include cameras, microphones, and internet connectivity. They raise privacy concerns due to potential recording without knowledge. Where these devices capture, collect, record, adapt, store, or otherwise process any information relating to an identified or identifiable natural person, they process personal data and the GDPR applies.

Common uses span music, phone calls, photographs, video, real-time translation, live streaming, and augmented displays. The EDPB acknowledges legitimate benefits like navigation, event documentation, and disability aid. Risks are greater in sensitive environments like hospitals, schools, or workplaces, and increase when recordings are shared on social networks. Children are especially at risk.

User responsibility under GDPR depends on context. Sharing photos or videos on public social media or using glasses for professional or political activities may make the user a data controller. Using them for personal translation in a private context may fall under the household exemption. Even under that exemption, use may still be subject to other laws. Producers or providers of linked applications cannot transfer GDPR obligations to users.

The EDPB states that smart glasses allow near invisible or hidden collection of personal data. Advanced microphones can record background conversations. Pairing glasses with facial or voice recognition raises unprecedented questions and poses a high risk to rights and freedoms in public spaces. The statement reads in places like a Europe-wide endorsement of a recent analysis by the Hamburg data protection authority, which concluded that certain commercial glasses expose bystanders without consent.

Transparency is highlighted as a main challenge. Bystanders may be unaware their data is being processed. Smart glasses should make recording obvious via LED lights, audio signals, voice cues, smartphone notifications, or unique designs. Warnings must be reliable, hard to ignore, and always up to date. In public spaces, bystanders should clearly understand when someone is filming them. The EDPB notes that even when people recognise the device, they may still oppose being recorded, describing a subtle social effect where individuals alter behaviour due to perceived surveillance.

Background on the supporting report and EDPB expertise programme

A separate report titled "The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses" was published alongside the statement. That report was written by a digital sociologist contracted under the EDPB's Support Pool of Experts programme, following a proposal from France's data protection authority, the CNIL. The views in the report are those of the authors and do not necessarily reflect the official position of the EDPB.

The report aims to understand smart glasses usage, privacy implications, and societal acceptability. It examines user experiences and non-users' perceptions of risks, supported by real-life examples. Smart glasses are sometimes used for interpersonal surveillance and handling of evidence. Individuals' ability to use them effectively varies widely, creating power imbalances between users and those being recorded.

The Support Pool of Experts is a key initiative of the EDPB's 2024-2027 Strategy. Its main objective is to help European data protection authorities increase capacity to supervise and enforce data protection rules by developing common tools and providing access to a wide pool of experts.

Technical details and scope of the statement

The EDPB statement is eight pages long with 36 numbered paragraphs and 39 footnotes. It defines smart glasses as wearable devices which often look like regular glasses or sunglasses and incorporate computing capabilities, cameras, speakers, microphones, and software including artificial intelligence systems. They may connect to the internet or other devices and be controlled by voice or by wristbands detecting hand gestures. No manufacturer is named in the statement.

Call for transparency and industry responsibility

The EDPB urges clear recording warnings and stresses that providers cannot shift GDPR duties to users. Producers and providers must comply with data protection law and ensure new data processing is compatible with the original purpose. The statement encourages industry standards and awareness-raising measures to address the privacy challenges posed by smart glasses.