EDPB Smart Glasses Statement: GDPR Applies, Indicators Fall Short

The European Data Protection Board adopted Statement 1/2026 on smart glasses at its plenary on 13 October 2026. The eight-page text says the GDPR applies to these devices, that manufacturers and AI providers cannot push transparency duties onto wearers, and that today's recording indicators leave bystanders unaware.

Information last verified on October 20, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers EU and EEA data protection law, specifically the GDPR as the European Data Protection Board reads it in Statement 1/2026. It does not state United States, United Kingdom or Canadian recording law, and it does not change any national rule on consent to record. For how consent rules differ from one country to the next, see our global guide to recording consent.

What Happened

The European Data Protection Board adopted Statement 1/2026 on smart glasses at its plenary, and the text is dated 13 October 2026. The Board brings together the national data protection authorities that enforce the GDPR, and its Chair, Anu Talus, signs the text.

The statement runs eight pages across 36 numbered paragraphs. The EDPB describes it as setting out its preliminary reflections on the privacy implications of smart glasses, with particular regard to their capacity to process personal data in ways that may be difficult for data subjects to perceive or control (para 1).

It defines smart glasses as wearable devices that often look like regular glasses or sunglasses and that carry computing capability together with features such as cameras, speakers, microphones and software, including artificial intelligence systems for purposes such as translation or object identification (para 2). They may connect to the internet, to external devices or to mobile applications, and may be operated by voice command or by input technologies such as wristbands that detect hand gestures.

The Board published the statement alongside a commissioned report titled "The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses", dated 1 October 2026 and produced under the EDPB's Support Pool of Experts programme. The EDPB's own note to editors says that document was prepared by an external contractor and that the views in it do not necessarily reflect the Board's official position.

The instrument matters here. This is a statement, not Guidelines and not an Opinion, and it creates no new obligation of its own. It is the Board's reading of law that is already in force. The EDPB closes by saying further guidance may be useful and that it will further analyse and work on the privacy concerns raised by smart glasses, including in connection with other video devices that raise similar legal questions (paras 35 and 36).

What the Law Actually Says

The starting point is paragraph 3. Where smart glasses capture, collect, record, adapt, store or otherwise process any information relating to an identified or identifiable natural person, they process personal data, and that processing is subject to the GDPR. The Board's footnote to that sentence flags the exceptions in Art. 2(2) GDPR, including processing by a natural person in the course of a purely personal or household activity.

Responsibility can land on more than one actor. The EDPB says it may arise for the user of the glasses, the producer of the device, or the provider of a linked application or service including AI systems, and that one actor may be sole controller while in other cases two or more qualify as joint controllers. The assessment turns on who determines the purposes and means of the processing (para 11), and the Board points to its own Guidelines 07/2020 on the concepts of controller and processor for that analysis.

The wearer and the household exemption

A wearer is not subject to the GDPR provided the activity is purely personal or household, outside any professional or commercial context, under the exemption in Art. 2(2)(c) GDPR (para 13). The Board's examples are narrow and concrete: sharing a photo or video with a family member or a friend only, or using the device for personal translation in a private context.

Paragraph 14 then tightens it. The exemption must be narrowly construed and assessed case by case, citing the Court of Justice's judgment in Ryneš (C-212/13). It would not apply where the photo or video is shared to an indefinite number of persons on a public social media account, which the Board supports with Lindqvist (C-101/01) and Buivids (C-345/17), nor where the glasses are used in the course of official, professional, political or other non-personal activities. In those situations the wearer qualifies as a controller or joint controller and has to comply with all GDPR obligations, transparency in particular.

That line is live litigation, not settled ground. Germany's Federal Court of Justice has referred household-exemption questions to the Court of Justice in two cases decided on 17 September 2026, one over a hidden camera in a shared kitchen (I ZR 289/25) and one over private chat messages forwarded to an employer (I ZR 256/25), and the EDPB's reading here sits on the same fault line.

Why the maker is not off the hook

Paragraph 16 records that the GDPR still applies to controllers and processors that provide the means for processing for personal or household activities, citing Recital 18, naming the producer of the glasses and the provider of a linked application or service. Paragraph 17 goes further: those actors may be independent or joint controllers where they determine, alone or jointly, the purposes and means. The Board's worked example is an AI provider analysing an image from the camera feed, in which other persons appear, in order to answer the wearer's question about their surroundings.

Then comes the sentence that does most of the work in the document:

"Where such actors are controllers, they are responsible for the compliance of their processing operations with the GDPR. Consequently, they should not rely on the users’ actions to meet their own GDPR obligations, such as transparency toward other individuals whose data might be processed when the smart glasses are being used." EDPB Statement 1/2026, para 18

Paragraph 19 adds that where such a controller further processes personal data for a new purpose, that purpose must remain compatible with the one the data was originally collected for, citing Arts. 5(1)(b) and 6(4) GDPR, with particular attention to context where the data subjects have no relationship with the controller.

Transparency toward people who are not wearing them

Transparency is where the Board says the difficulty concentrates. Compliance with the GDPR's transparency requirements, which it anchors in Arts. 12 and 13 GDPR and Recital 39, presents a major challenge with these devices, because data subjects include bystanders the Board calls non-users (para 20). Information is a precondition for exercising data subject rights at all.

The discreet form factor is the reason. Non-users may not know that data relating to them is being processed, by whom, or for what purposes, and functions such as translation or AI features may be particularly invisible to them (para 21). Traditional transparency notices, which can be used to inform the wearer and usually set out the processing, do not seem sufficient or appropriate for non-users, and the problem is sharpest where the controller is the producer or the app or AI provider, because they have no relationship with those people and are not able to contact them (para 23).

Consent, Legitimate Interests and AI Training

Any processing within the GDPR's scope needs a valid legal basis under Art. 6(1), and the Board says the validity of any chosen basis is likely to require a case-by-case assessment taking into account the local applicable laws, the specific processing and its context, and any further use of the data (para 27). Where special categories of data are involved, a footnote notes that one of the Art. 9(2) exemptions should also apply.

Consent under Art. 6(1)(a) can work where the conditions of Art. 7 are met. The Board adds a point that matters a great deal in practice: some national laws protect the right to one's image and require a person's consent for the reproduction and public distribution of that image, and in those situations consent will likely be the most appropriate legal basis (para 28). That is national law doing the heavy lifting, not the GDPR.

For producers and app or AI providers processing bystander data, consent is close to unavailable. Because they have no relationship with those people, the Board says it would be difficult to obtain the freely given, specific, informed and unambiguous consent Art. 7 requires, and it rules out curing the problem afterwards:

"Consent obtained after collection, for example following the recording, would not be valid as the legal basis must exist prior to and during any processing." EDPB Statement 1/2026, para 29

Legitimate interests under Art. 6(1)(f) is not an easy substitute. Paragraph 30 says reliance on it requires careful case-by-case analysis against data subjects' rights, freedoms and reasonable expectations, and that given the nature of the data, the context, and the current insufficient transparency that negatively affects what non-users can reasonably expect, sufficient mitigating measures are needed to strike a fair balance. The Board then singles out two uses as particularly difficult to demonstrate: further processing for commercial purposes going beyond providing the service the end-user explicitly requested, and AI training, which bystanders would not expect, especially if they are unaware of the initial collection. Even where the Art. 6(1)(f) conditions are met, controllers must still make the Art. 21(1) right to object workable at any time, which the Board concedes can prove difficult.

If you are working out where that leaves a given processing operation, our explainer on what makes consent valid under the GDPR walks through the Art. 7 conditions in detail.

The Transparency Measures the EDPB Puts Forward

Paragraph 22 is a single, unqualified sentence: the current state of the art with regard to indicators on smart glasses leaves many non-users unaware that their data is being processed. The Board states that as a finding about the technology as it ships today.

Its answer is to combine mechanisms rather than rely on one. Controllers and producers should consider a broad range of transparency measures when designing and developing smart glasses, including measures that provide in-the-moment transparency by default that processing is taking place, as well as the information the GDPR requires (para 24). A footnote adds that such measures should be impossible or difficult to disable, taking the state of the art into account, and easy for bystanders to notice in practice. The four candidates the Board lists are:

• Visual or LED indicators. Visible in many lighting conditions, noticeable enough to attract the attention of people within the field of collection, and activated long enough that they understand capture is happening. The Board suggests the signal could behave differently per function, for example prolonged activation while recording and flashing when a still is taken, and says it should not be possible to record while the indicator is covered. A footnote cautions that LEDs may be hard or impossible to notice for people with visual impairments, and that a white LED can be mistaken for a reflection or solar glare.
• Audio indicators. Audio cues and voice activation requirements, meaning the wearer has to say the command out loud, could raise bystander awareness in the way other photo and video devices already do. The Board's example is a shutter click, and its footnote points to Japan's Ordinance on the Healthy Development of Juveniles, amended in 2015, which bans muting shutter sounds on smartphones.
• Smartphone-based proximity notification. Several mobile apps already detect nearby glasses by recognising broadcast Bluetooth identifiers tied to manufacturers, though that currently reveals only presence, not whether recording is happening. The Board suggests makers could broadcast a specific signal while recording, but says such notifications should not be the sole method of providing transparency, because that excludes anyone without the app running and because a person must be free to accept or refuse the notifications, and the app must not become a way to track the people wearing the glasses.
• Design of the glasses. Beyond active indicators, other design cues could help non-users tell smart glasses from ordinary eyewear. The footnote here invokes Recital 78 GDPR, which encourages producers and service providers to account for data protection when designing products.

Where transparency rests on technical measures, the Board says they must be effective, impossible or difficult to circumvent, and updated whenever necessary (para 25). It then recommends industry-wide standards and awareness-raising campaigns so people can identify these devices and understand what processing may be happening in different situations (para 26).

Chair Anu Talus put the same point in plainer terms in the Board's press release.

"These warnings need to be reliable, hard to ignore, and always up to date. Even in public spaces, bystanders should clearly understand that someone is filming or photographing them." Anu Talus, EDPB Chair, press release of 13 October 2026

Sensitive Places, Children and Default Settings

The statement singles out contexts where use is especially sensitive: medical facilities, schools and other places where minors are present, changing rooms, swimming pools, beaches, toilets, and other private or intimate situations (para 10). Workplace use raises employee monitoring questions and also the confidentiality of the employer's own information, including trade secrets and intellectual property. In such situations, the Board says, recording or audio capture may be inappropriate or prohibited under national law or local rules.

Its footnote notes that this has already prompted some establishments to restrict smart glasses on their premises, and points to an initiative in the Free and Hanseatic City of Hamburg proposing a ban on smart glasses in public transport and swimming pools. Separately, Hamburg's data protection authority published its own report on these devices in September, and we covered its assessment of the risk a Ray-Ban Meta wearer takes on personally this month.

Children get a specific paragraph. Alongside obligations such as data protection by design and by default, security of processing, special category data, use of processors and sub-processors, and transfers outside the EU, the Board says particular attention should be paid to children, who may be less aware of the presence or implications of smart glasses and therefore more vulnerable to covert or intrusive processing (para 32). The same paragraph flags that smart glasses may in some circumstances count as terminal equipment to which the ePrivacy framework may also apply, specifically where sensors collecting, locally storing and processing images, video or sound are embedded in the device, or where that information is by default made available to a remote server.

Paragraph 33 lists technical measures the Board encourages so people retain meaningful control:

• Data minimisation, such as limiting continuous recording, live streaming or retention periods. The Board adds pointedly that a wearer should not justify continuous or indiscriminate recording of other people solely by a general or hypothetical concern for their personal safety.
• Privacy-friendly defaults, including blurring or obscuring bystanders, pseudonymisation or anonymisation before sharing or reuse, done on-device where possible. Where glasses are designed primarily for real-time assistance, the Board says persistent storage of captured audio, images or video may not be necessary and should be disabled by default unless the functionality requires it or the wearer deliberately turns it on with appropriate safeguards.
• Technical restrictions, including location-based limits such as geofencing in contexts likely to be particularly sensitive.
• Privacy frictions that slow down sharing to social media platforms.

What the Statement Does Not Do

Four limits are worth stating plainly, because coverage of a document like this tends to blur them.

It bans nothing and fines no one. The statement is a non-binding reading of existing law, and it imposes no new obligation. The Board itself frames the text as preliminary and says it will keep working on the subject (paras 1, 35 and 36).

It does not touch national recording law. Paragraph 15 says a wearer recording voice or images may be subject to other laws, some of them criminal, and paragraph 34 says uses might be prohibited under national criminal, civil or labour law and other sector-specific rules. The consequence the Board draws is narrow but real: failing to comply with those rules may, depending on the circumstances, call into question the fairness of the processing under Art. 5(1)(a) GDPR. Its footnote gives examples of conduct that can be an offence in some jurisdictions, including filming facilities with protected status, filming inside a home or a dressing room, or filming for the purpose of harassment, and notes that sharing the captured material can be a separate or additional offence.

It sets no technical standard. Having found current indicators inadequate, the Board lists options to combine and then asks industry to develop standards rather than specifying a threshold itself (paras 24 and 26).

It names no product. No manufacturer, device or app appears in the analysis; the only company name in the document is in the footnote supporting the point about AI training, which cites the Court of Justice's judgment in Meta v. Bundeskartellamt (C-252/21). The Board's closing footnote does note that other countries are discussing legislative proposals applicable to wearable recording devices, linking California Senate Bill 1130 from the 2025 to 2026 session. We did not open California's official bill register this run, so we are not characterising that measure's current status here; our separate coverage of California's SB 1130 veto sets out the position we have verified.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The centre of gravity in this statement is design, not wearer etiquette. Paragraphs 9 and 33 do speak to wearers, and the household exemption discussion decides when a wearer carries GDPR duties at all. But the operative demands land upstream, on the producer and the AI provider: indicators that are hard to disable, defaults that do not store, on-device blurring, geofencing. That allocation follows from the Board's own diagnosis in paragraph 23. If traditional notices cannot reach bystanders, and the controller has no way to contact them, then the only place transparency can actually be built is into the device.

Paragraph 22 is the document's sharpest contribution and also its clearest limitation. The Board records, as a finding about shipping hardware, that the current state of the art leaves many non-users unaware. It then declines to say what would be adequate, recommending industry-wide standards instead. A regulator stating that the current state of the art in an entire product category's privacy indicators leaves many bystanders unaware, while leaving the specification to the manufacturers of that category, is a gap anyone reading this document should notice.

The legal-basis section is where the statement bites hardest without naming anyone. Paragraphs 28 to 30 draw a line between the service the wearer asked for and everything beyond it. Consent from a bystander is treated as practically unavailable for a producer or AI provider, and retroactive consent as legally unavailable. Legitimate interests is then described as particularly difficult to demonstrate precisely for commercial reuse beyond the requested service and for AI training. Read together with paragraph 19 on purpose compatibility, that is a narrow path for anyone who wants to treat incidental bystander capture as a training input.

The deferral to national law in paragraphs 15 and 34 is the part that most affects what a reader actually faces. The GDPR analysis can come out one way and a national criminal or labour provision another, and the Board's own footnotes point to that patchwork: establishments restricting devices on their premises, Hamburg proposing a transport and pool ban, offences for filming in dressing rooms or for harassment. The practical answer to whether these devices can be worn in a given place remains local, and this statement does not change that.

Finally, the household exemption treatment deserves attention beyond smart glasses. The Board applies Ryneš, Lindqvist and Buivids to say that posting to an open account takes a wearer outside the exemption. That is a conventional reading, but the scope of Art. 2(2)(c) is the subject of the German referral noted above, which means the boundary the EDPB describes here is being tested rather than simply confirmed.

How This Affects You

If you wear smart glasses in the EU or EEA, whether the GDPR reaches you depends on what you do with the output. The Board treats sharing with family or friends and personal translation as personal or household activity, and treats posting to an indefinite public audience or using the device for work, official or political purposes as outside it (paras 13 and 14). Once you are outside it, you are a controller with the full set of obligations, transparency first.

Even where the GDPR does not reach the wearer, other law can. The statement says so twice (paras 15 and 34), and venues, employers and transport operators can restrict devices on their own terms regardless of what data protection law says.

If you are a bystander in the EU or EEA, your data subject rights may run against the manufacturer or the AI provider rather than the person in front of you. That follows from paragraphs 11 and 17 on who determines purposes and means, and from paragraph 18 on those actors owing their own transparency duty.

If you design, build or sell these devices or the applications behind them, the Board's position is that you cannot discharge your transparency obligation through the wearer, that default settings and on-device processing are part of compliance rather than product polish, and that AI training on bystander capture is the hardest case to justify.

None of this is United States law. A US reader's exposure turns on federal and state wiretap, eavesdropping and video-voyeurism statutes, which vary considerably; our page on recording with smart glasses in California shows how different that analysis looks. The EDPB statement has no effect on it.

This is general legal information, not legal advice. It covers EU and EEA data protection law under the GDPR as read by the European Data Protection Board in Statement 1/2026, and it reflects sources verified on October 20, 2026. It does not state United States, United Kingdom or Canadian law. Laws change and this story is developing; consult a lawyer qualified in your jurisdiction about your specific situation.

Related articles

• EU Data Privacy Laws: GDPR, AI Act and the 2025-2026 digital reforms
• A complete guide to what the GDPR is and who it covers
• Germany's GDPR and BDSG enforcement landscape
• The class action and recording-law questions behind the Meta smart glasses privacy dispute
• New York bans smart glasses from every state courthouse

---

Last updated: 2026-10-20. This is a developing story; details verified as of 2026-10-20.

Frequently Asked Questions

Did the EU ban smart glasses?

No. Statement 1/2026 is a preliminary, non-binding statement of how the European Data Protection Board reads the GDPR as it already stands (paras 1, 35 and 36). It prohibits no device, imposes no penalty and creates no new obligation.

Are smart glasses legal in the EU?

The statement does not make them unlawful. It says that when they process personal data they are subject to the GDPR (para 3), and that particular uses may be prohibited under national criminal, civil or labour law or sector-specific rules (paras 15 and 34). The legality of a given use turns on both layers.

Do I need consent to record people with smart glasses in Europe?

It depends on whether you are acting purely personally or within your household, and on national law. The EDPB notes that some national laws protect the right to one's image and require consent for reproducing and publicly distributing it, in which case consent will likely be the most appropriate legal basis (para 28). It also says consent taken after a recording is invalid, because the basis must exist before and during the processing (para 29).

Can a manufacturer use smart glasses footage of bystanders to train AI?

The statement names no manufacturer, but it addresses the practice directly. It says relying on Art. 6(1)(f) legitimate interests would be particularly difficult to demonstrate for AI training, and for commercial reuse beyond the service the wearer explicitly requested, because bystanders would not expect it (para 30).

Does posting smart glasses video on social media fall under the GDPR household exemption?

The EDPB says the exemption would not apply where the photo or video is shared to an indefinite number of persons on a public social media account, citing the Court of Justice judgments in Lindqvist and Buivids. In that case the wearer qualifies as a controller (para 14).

Does the EDPB statement require an LED recording light on smart glasses?

No. It lists visual or LED indicators as one of four measures controllers and producers should consider combining, says an indicator should be noticeable within the field of collection and that recording should not be possible while it is covered, and recommends that industry develop standards (paras 24 and 26). It sets no mandatory specification.

Does this change recording laws in the United States?

No. Statement 1/2026 interprets EU data protection law. Recording in the United States is governed by federal and state wiretap, eavesdropping and video-voyeurism statutes, which the EDPB has no authority over and which the statement does not address.