EDPB urges clearer privacy signals on smart glasses

The European Data Protection Board wants people near smart glasses to be able to tell when the devices are recording or capturing images for an AI assistant. In a statement adopted on October 13, 2026, it sets out preliminary guidance on transparency and the responsibilities of wearers, manufacturers and connected service providers under existing data protection law.

An AI request about the wearer's surroundings can involve images of people who never chose to use the service. Those bystanders need information about the processing too.

The big change

• What changed: Europe's data protection board has set out how existing privacy responsibilities apply to glasses that bring cameras, microphones and AI services into shared spaces. The guidance addresses both the person wearing them and the companies processing data.
• Why it matters: A bystander cannot exercise privacy rights without knowing that their data is being captured and who is using it. Giving the wearer information in an app leaves that other person uninformed.
• What to watch: The board recommends industry standards for recognizable, reliable signals. Their design needs to cover AI capture as well as ordinary recording, and work for people who have no companion app.

Private use and provider responsibility

The EDPB's announcement explains a boundary for wearers. Sharing a photograph only with family or friends, or using translation privately, can fall within the GDPR's household exemption. That exemption is narrow and depends on the circumstances.

Sharing footage with an indefinite audience through a public social account, or using glasses for professional, official or political activities, falls outside that exemption in the board's examples. The wearer then takes on responsibilities as a controller or joint controller: the person or organization deciding why and how personal data is processed.

Providers have their own obligations when they control processing, even where the wearer's activity is private. They cannot transfer those obligations to the wearer. A user's personal reason for wearing the glasses does not settle a service's responsibilities toward bystanders.

AI capture can be hard to notice

The full statement specifically discusses an AI provider analysing a camera image containing other people to answer a question about the wearer's surroundings. It also identifies translation and AI features as processing that may be particularly invisible to bystanders.

For visual indicators, the board calls for signals noticeable across lighting conditions, active long enough to be understood, and designed so recording cannot continue when they are covered. Sound, spoken activation and a recognizable device design can add information. Smartphone notifications should not be the only warning, because people may have no relevant app running.

The statement separately says processing subject to the GDPR needs a valid legal basis. Making capture visible does not, by itself, provide that basis.

Sensitive places and national rules

The board's announcement names hospitals, schools and workplaces as sensitive settings, and draws attention to children's vulnerability. Other national or sector rules can apply even where a wearer's activity falls outside the GDPR.

Sweden's privacy authority, IMY, makes the everyday distinction in its smart-glasses guidance: filming in public can be permitted while still being inappropriate. It warns that microphones may capture background conversations unintentionally and that some venues may restrict use. Its specific examples of criminal offences concern Swedish law.

BIG CHANGE's earlier reporting on Norway's planned restriction in selected places covers a separate legislative proposal. The EDPB's October 13 statement gives preliminary guidance on existing responsibilities; it creates no general European ban on wearing smart glasses.