What Changed
- The EDPB adopted a statement offering preliminary privacy guidance for smart glass users, manufacturers, and service providers.
- GDPR applicability to users was delineated, contrasting public or professional activities (data controller status) with private household use (exempt from GDPR).
- Manufacturers and service providers were designated as data controllers prohibited from shifting their statutory data protection obligations onto users.
The European Data Protection Board (EDPB) has adopted a declaration addressing the data protection risks and challenges associated with smart glasses, alongside an expert report titled 'The connected gaze: Video recording, surveillance and administering evidence in the age of smart glasses.' The initiative, proposed by the French Data Protection Authority (CNIL) under the EDPB's Support Pool of Experts program, outlines preliminary guidance for users, manufacturers, and associated service providers.
The guidance impacts smart glass manufacturers, software and service providers, and individual users across the European Union. Under the General Data Protection Regulation (GDPR), user liability depends directly on how the device is used. If an individual uses smart glasses to record or share content on public social media accounts, or within official, professional, or political contexts, that user acts as a data controller. Conversely, using smart glasses purely for private activities—such as filming family or friends or utilizing personal translation features—falls under the household exemption, excluding GDPR applicability. However, even where GDPR does not apply, national criminal, civil, labor, or sector-specific laws may still govern the use of these devices.
For manufacturers and service or application providers, the EDPB emphasizes that they are data controllers and cannot shift their GDPR obligations onto end users. They must comply with data protection legislation and ensure that any secondary data processing remains compatible with the original purpose of collection.
Transparency remains one of the primary compliance challenges due to the discreet nature of smart glasses, which often leaves third parties unaware that their personal data is being recorded or processed. The EDPB encourages sector-specific standards and public awareness campaigns to improve transparency and mitigate power imbalances stemming from interpersonal surveillance. The accompanying study highlights that varying user capacities create structural power disparities between individuals operating smart glasses and those being filmed.
Who May Be Affected
Manufacturers, application developers, and users of smart glasses, as well as third parties whose personal data is recorded or processed by smart glasses.
Cross-Border Context
Applies across the EU to foreign and domestic manufacturers, service providers, and individuals subject to EU data protection rules when deploying or using smart glasses.
What to check next
- Consult the official EDPB declaration and the full report 'The connected gaze' published on the EDPB website.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.