The European Data Protection Board (EDPB) has warned that smart glasses can capture people’s images and conversations without their knowledge, calling for stronger recording indicators and safeguards against intrusive data collection.
In a statement adopted on October 13, the board outlined preliminary guidance for manufacturers, service providers, and wearers, highlighting risks in hospitals, schools, workplaces, and situations involving children.
The EDPB, which promotes consistent application of EU data protection rules, says the devices’ resemblance to ordinary eyewear makes their cameras, microphones, and connected services particularly difficult for bystanders to detect.
Some microphones can capture background conversations involving people other than the wearer. Translation and AI assistance can also process personal information without an obvious recording taking place, while pairing the devices with facial or voice recognition raises additional surveillance concerns.
The board warns that even the perception of being recorded could lead people to change their behavior and suppress spontaneous interactions.
Recording warnings must be difficult to bypass
The statement identifies transparency as a central challenge, noting that existing indicators leave many bystanders unaware their information is being processed.
It recommends combining visible LEDs, audible signals, spoken activation commands, and distinctive designs. Indicators should remain noticeable in all lighting conditions and stay active long enough for people to understand what is happening, including when the camera captures images for AI processing.
One specific recommendation is that recording should be impossible when the indicator is covered. The board also notes that white LEDs can resemble reflections or sunlight, while visual signals alone may fail to alert people with impaired vision.
Nearby smartphone notifications could supplement these warnings, but should neither become the only notification method nor enable tracking of the glasses’ wearer.
The EDPB also encourages processing on the device where possible, obscuring bystanders’ identities, limiting retention, and introducing steps that slow down social media sharing. For devices primarily providing real-time assistance, persistent storage should be disabled by default unless necessary or deliberately activated with safeguards.
Public sharing can trigger GDPR obligations
Wearers may become data controllers when they publish recordings to public social media accounts or use smart glasses for professional, official, or political activities.
Purely personal uses, such as sharing a recording only with friends or family, may fall under the GDPR’s household exemption. However, that exemption requires a narrow, case-by-case assessment, and other laws may still restrict recording.
Manufacturers and connected service providers retain their own obligations where they determine how and why personal data is processed.
The statement flags particular difficulties in using bystanders’ data for AI training. Relying on legitimate interests requires assessing their rights and reasonable expectations, while consent obtained after collection cannot retroactively provide a lawful basis for that collection.
Wearers should explain when recording or AI processing is active, respect restrictions in sensitive settings, and limit unnecessary capture and public sharing. The board specifically cautions that a general concern about personal safety does not, by itself, justify continuously recording other people.
Leave a Reply