EDPB statement on the data protection challenges of smart glasses

Brussels, 13 October – During its latest plenary, the EDPB has adopted statement on smart glasses and published the report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses”*, developed in the context of the Support Pool of Expert (SPE) programme**.

As smart glasses become widely available and more frequently used, they raise significant questions for the protection of individuals’ personal data and rights and freedoms even if they create new opportunities for communication, assistance, and innovation.

“These devices look like ordinary glasses, but they include cameras and microphones and are connected to the internet. This raises serious privacy concerns, as individuals may be recorded without their knowledge.

The risks are even greater in sensitive environments—such as hospitals, schools, or workplaces—and when recordings are shared on social networks. And of course, children are especially at risk when using these glasses or when they are filmed.“

The EDPB’s text is an initial statement which provides preliminary guidance to users, manufacturers and service providers while increasing awareness about the risks these devices pose.

Shared responsibility

The user’s responsibility for processing personal data under the GDPR depends on the way they use their smart glasses. For example, if this involves sharing a photo or video on a public social media account, or if smart glasses are used as part of official, professional, or political activities, the user would be considered a data controller.

However, if the user shares a photo or records a video of family members or friends, or if they use the device for personal translation purposes in a private context, this would be considered a purely personal activity for which the GDPR would not apply (household exemption). In any case, even when the GDPR does not apply, the use of smart glasses may still be subject to criminal, civil, or labour law - as well as other sector-specific rules.

As data controllers, neither the producer nor the provider of a linked application or service can transfer their obligations to users. They must comply with data protection law and ensure any new data processing remains compatible with the original purpose of collection.

The importance of transparency

The EDPB highlights transparency as one of the main data protection challenges posed by smart glasses. Due to their discreet appearance and use, bystanders may be unaware that personal data relating to them is being processed, by whom, and for what purposes.

“Smart glasses should make their recording obvious – for instance with bright LED lights, audio signals or voice activation cues, privacy-friendly smartphone notifications, or unique designs. These warnings need to be reliable, hard to ignore, and always up to date.