Smart glasses that record passers-by come under scrutiny from EU data protection authorities

The European Data Protection Board warns that smart glasses with cameras, microphones, and artificial intelligence services can turn seemingly ordinary activities into data processing subject to the GDPR. The EDPB calls for effective visual and audible indicators when devices record, limiting data collection, local processing whenever possible, and safeguards to prevent users from filming secretly. The mere fact that a person uses the device for personal purposes does not automatically exclude the application of European legislation.

Smart glasses that combine cameras, microphones, connectivity, and artificial intelligence services raise data protection issues different from those of an ordinary video camera, warns the European Data Protection Board. In a statement adopted on 13 October, the EDPB explains how the General Data Protection Regulation applies both to users and to companies that manufacture the devices or provide the associated services. The central message is that people within the glasses’ field of view must be able to understand when they are being recorded, and that the technology should be designed so that unnecessary or covert data collection is limited by design.

In brief

1. The EDPB calls for smart glasses to clearly indicate when they are recording, including through visual signals and, where appropriate, audible signals, so that people nearby can notice the data collection.

2. The recording indicator should not be capable of being covered or disabled without the recording function being blocked.

3. Personal use does not automatically fall within the household exemption. If images are published to an indeterminate audience or the device is used professionally, the user may become a data controller within the meaning of the GDPR.

4. Manufacturers and service providers retain their own obligations. They cannot transfer full responsibility for data protection to the person wearing the glasses.

5. The EDPB recommends data minimization, processing directly on the device whenever possible, limiting storage, masking individuals, and introducing additional steps before images are shared.

Smart glasses change one of the traditional premises of video surveillance. In the case of a camera mounted on a wall, the person being filmed can generally identify the existence of the device and, sometimes, the controller. Glasses may look almost identical to an ordinary pair, while the camera largely follows what the user sees, and the microphone may capture conversations without the participants immediately noticing.

The EDPB considers that this technological discretion increases the transparency obligation. A very small light indicator that is difficult to see or easy to cover does not, by itself, solve the problem. Signaling must be effective for people nearby, not merely formally present in the product specifications.

The Board goes further and recommends that the device’s design prevent recording when the indicator has been covered or disabled. The principle pursued is simple: the user should not be able to remove the warning addressed to those nearby while simultaneously retaining the ability to record.

This requirement forms part of a broader issue concerning data protection by design and by default. The GDPR does not require only interventions after abuse occurs. Controllers must integrate safeguards into the technology and the service configuration before processing takes place.

In the case of smart glasses, this principle may mean disabling persistent storage by default when it is not necessary, processing locally on the device instead of automatically sending all data to servers, promptly deleting information that is no longer needed, and limiting the areas or situations in which certain functions can be activated.

The EDPB also identifies masking or blurring individuals as a possible protective measure. A body-worn camera may capture a large number of people who have no connection to the user’s purpose. Reducing their identifiability can limit the impact on privacy, provided that the measure is sufficiently effective.

Another recommended safeguard concerns content sharing. If a device allows photos or recordings to be uploaded instantly to a platform, an accidental or overly simple action can turn a private capture into a publication reaching thousands of people. The EDPB suggests introducing “friction” before sharing, meaning steps that require the user to consciously confirm what they are about to publish and to whom.

One of the most important clarifications concerns the so-called household exemption under the GDPR. The Regulation does not apply to processing carried out by a natural person in the course of a purely personal or household activity. However, this exemption must be interpreted narrowly.

The fact that a person films with their own glasses does not automatically mean that every use remains private. If recordings are published online to an indeterminate audience, used in the course of professional activity, or processed for other purposes that go beyond personal life, the user may become a data controller and must comply with the applicable GDPR obligations.

The situation may differ from case to case. A photograph kept in a private album does not raise the same issues as the continuous transmission of images to a public platform, the use of glasses by an employee in dealings with customers, or the automated analysis of people encountered in public spaces.

Responsibility does not, however, lie exclusively with the person wearing the device. The glasses manufacturer, cloud service provider, application developer, or company analyzing the data may have its own legal role depending on the purposes and means it determines for the processing.

The EDPB warns against an architecture in which providers try to assume that all operations are the responsibility of the end user. If a company determines that images are uploaded to a server, how long they are retained, what they are analyzed for, or whether they are used to develop the service, its obligations must be assessed separately.

The issue becomes even more sensitive when the captured data are used by artificial intelligence systems. A pair of glasses can record faces, voices, places, conversations, and behaviors, and this information may subsequently be classified or analyzed automatically. Depending on the functionalities, seemingly mundane data may enable the deduction of much more sensitive information.

The EDPB draws particular attention to the use of legitimate interest as a basis for collecting passersby’s data to train artificial intelligence systems. Legitimate interest does not function as a general authorization. The controller must demonstrate the existence of a real and legitimate interest, the necessity of the processing, and the fact that the rights and interests of the data subjects do not prevail.

In public spaces, this assessment becomes difficult because the person being filmed may have no relationship with the service provider and may not expect their image or voice to be used to develop an AI model. Large-scale collection of passersby’s data for a purpose they cannot anticipate increases the weight of their rights in the legal assessment.

Consent raises a different issue. If a legal basis requires consent, it must exist before the relevant processing and must be freely given, specific, informed, and unambiguous. The EDPB emphasizes that obtaining a person’s agreement after their image or voice has already been collected does not retroactively make the initial collection lawful.

In practice, obtaining the consent of every passerby would be difficult for devices operating in crowded spaces. That is precisely why technology design and the choice of an appropriate legal basis become essential, and functions involving massive data collection cannot be justified solely by the fact that the product is available to consumers.

The EDPB also calls for application of the data minimization principle. Glasses should collect only the information necessary for the function being used. If a service can operate without retaining raw images or without permanently sending them to cloud infrastructure, the less intrusive architecture should be considered.

This approach is also relevant to storage duration. The technical possibility of retaining recordings permanently is not a reason for unlimited storage. Data must be retained only for as long as justified by the purpose for which they were collected.

The October statement does not introduce a new law and does not ban smart glasses in the European Union. The EDPB is the body that brings together national data protection authorities and the European Data Protection Supervisor, and the document establishes a preliminary common interpretation of the issues this technology raises in relation to the GDPR.

Practical application will depend on how each device and each service operates. A model that takes photographs only at the user’s request, one that records continuously, and one that identifies objects or people in real time may involve very different processing activities and risks.

The study “The Connected Gaze,” conducted through the EDPB’s expert program, provides additional technical context regarding these risks, but has a different status. It was prepared by external experts and does not, in itself, represent the official position of the Board. The statement adopted on 13 October is the document through which the EDPB sets out its own preliminary guidance.

As such devices move from niche products to objects worn in everyday life, the question for data protection authorities is no longer only what the person wearing the glasses can do. It also concerns what the manufacturer must do so that people nearby can see that they are being recorded, what data are collected by default, what information leaves the device, and under what conditions it may later be reused.

https://2eu.brussels/ro/news/ochelarii-inteligenti-care-filmeaza-trecatorii-intra-sub-lupa-autoritatilor-ue-pentru-protectia-datelor