The EDPB tells smart-glasses makers that bystander compliance is theirs, not the wearer's
The EDPB's statement on smart glasses says producers and AI service providers can be controllers for bystanders and cannot rely on wearers to inform them. Any camera-and-AI product team should read it.
What happened
On 13 October 2026, the European Data Protection Board (EDPB) adopted a statement on smart glasses. The statement sets out what it calls preliminary reflections on the privacy implications of wearable devices that look like ordinary eyewear and combine cameras, microphones and software, including AI systems for functions such as translation or object identification. It states that where smart glasses capture or otherwise process information about an identifiable person, they process personal data and the GDPR applies.
The statement's main positions, by topic:
| Topic | EDPB position |
|---|---|
| Who is a controller | Depending on the facts, the wearer, the producer or the provider of a linked application or service, including AI systems. More than one can be a joint controller |
| Household exemption | Applies only to purely personal or household use, is construed narrowly, and does not apply when footage is shared with an indefinite audience or used in a professional context |
| Producers and providers | They should not rely on users' actions to meet their own GDPR duties, such as transparency towards bystanders |
| Transparency | Traditional notices are not sufficient for bystanders. Producers should combine mechanisms, including visual and audio indicators, which should be hard to disable |
| Consent | Difficult to obtain from bystanders the controller has no relationship with. Consent obtained after recording would not be valid |
| Legitimate interests | Needs careful case-by-case analysis, and would be particularly difficult for AI training that bystanders would not expect |
The statement describes the particular risk that these devices allow near-invisible collection of data, and that advanced microphones may record background conversations. It singles out facial or voice recognition as raising unprecedented questions and posing a high risk in public spaces. It treats medical facilities, schools and places where minors are present, changing rooms, swimming pools and toilets as especially sensitive, and says workplace use may raise employee monitoring and confidentiality concerns. It also recommends data minimisation, such as limiting continuous recording, live streaming and retention periods, and calls for industry-wide standards.
Why it matters
The compliance burden follows the product. The EDPB says producers and AI service providers may be controllers for bystanders and cannot rely on wearers to do their transparency work. Anyone who builds a product that captures other people's data on a user's behalf should expect the same logic to be applied to them.
AI features are the sensitive part. The statement notes that functions such as translation or other AI features may be particularly invisible to bystanders, and that a provider analysing an image in which other people appear can be a controller. Sending a camera feed to a model is a processing decision, not a technical detail.
There is no easy legal basis for strangers' data. Consent is hard to obtain from people you have no relationship with, and the EDPB is sceptical of legitimate interests for AI training. That makes data minimisation and retention limits the practical defence.
It is also an employer's problem. Staff wearing such devices at work create monitoring and confidentiality questions. Your information security and data protection teams should have a position before the first request.
What we would do
- List the products and pilots that capture images or sound of non-users. Include cameras, wearables, meeting tools and agents that watch screens, and note where the data goes, especially to AI services.
- Decide who the controller is for each. For your own products, work out whether you, a vendor or both determine the purposes and means, and record it. Take legal advice on any joint arrangement.
- Design for the bystander. Where people who are not users can be captured, add clear in-the-moment signals that are hard to disable, and do not assume a privacy notice will reach them.
- Minimise and limit retention. Avoid continuous recording and live streaming by default, set short retention periods and do not reuse captured data for AI training without a sound, documented basis.
- Write an acceptable-use rule for wearables at work. Say where they may not be used, such as medical, children's and private settings, and assess the data protection impact before approving any use.
- Watch for the follow-on. The statement is preliminary. Track whether the EDPB develops it into guidelines, and check national authorities' positions where you operate.
The EDPB statement is about glasses, but the principle is about any product that watches people who never agreed to be watched. Teams building such products should plan as if it applies to them.
Questions we are asked
Does this apply to us if we do not make smart glasses?
The statement is about smart glasses, and it is described as preliminary reflections, not binding rules. But its reasoning applies to any product that captures images or sound of people who are not its users and passes them to an AI service. If you build or deploy such a product, treat it as a signal of how EU regulators are likely to think.
Can we rely on consent from bystanders?
The EDPB says it would be difficult to obtain valid consent from bystanders with whom a producer or provider has no relationship, and that consent obtained after recording would not be valid. It also says legitimate interests would need careful case-by-case analysis, and would be particularly difficult for AI training that bystanders would not expect.
What about employees using them at work?
The statement says use in the workplace may raise concerns about employee monitoring and the confidentiality of the organisation's information, and that recording may be inappropriate or prohibited under national law or local rules. Decide your policy before devices arrive, take legal advice, and assess the data protection impact for any approved use.
Sources
- Statement on Smart glasses — European Data Protection Board