What Changed
- The EDPB adopted an initial statement providing preliminary guidance for smart glass users, manufacturers, and service providers regarding GDPR compliance.
- The statement clarifies that users act as data controllers when sharing content publicly or using devices professionally, while purely private context falls under the GDPR household exemption.
- The Board published an external SPE research report examining interpersonal surveillance, power imbalances, and societal acceptability of smart glasses.
The European Data Protection Board (EDPB) has adopted an initial statement addressing the privacy and data protection challenges posed by smart glasses. The statement provides preliminary regulatory guidance for manufacturers, service providers, and device users, while raising awareness about privacy risks associated with wearable devices equipped with cameras, microphones, and internet connectivity. Alongside the statement, the Board published an external research report titled "The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses," commissioned through its Support Pool of Experts (SPE) programme following a proposal from the French Data Protection Authority (DPA).
**Who Is Affected and Why It Matters**
Smart glasses create significant risks to personal data and individual rights because bystanders may be recorded without their knowledge. These risks are heightened in sensitive environments—such as hospitals, schools, and workplaces—or when recordings involve children or are shared on social media networks.
The applicability of the General Data Protection Regulation (GDPR) depends on how the device is used:
- **Data Controller Status:** Users who share photos or videos on public social media accounts, or who use smart glasses as part of official, professional, or political activities, act as data controllers under the GDPR.
- **Household Exemption:** Users who record or share media exclusively with family or friends, or use devices for personal translation in a private context, engage in purely personal activities to which the GDPR does not apply. However, criminal, civil, or labour laws may still govern such uses.
- **Producers and Service Providers:** Manufacturers and providers of linked applications cannot shift their GDPR obligations to users. They remain data controllers required to maintain compliance and ensure new data processing remains compatible with the original collection purpose.
**Key Requirements for Transparency**
To address concerns surrounding discreet recording, the EDPB emphasizes transparency. Smart glasses should feature visual or auditory signals—such as bright LED lights, audio signals, voice cues, smartphone notifications, or distinct visual designs—to clearly indicate to bystanders when filming or photographing takes place. The EDPB also encourages industry standards and awareness measures.
**Dates and Context**
The statement was adopted during an EDPB plenary on 13 October (year not provided in the source material). No entry-into-force or specific application dates are specified.
Who May Be Affected
Manufacturers, service providers, professional and personal users of smart glasses, and bystanders recorded by smart glasses across the EU.
Cross-Border Context
Applies to smart glass producers, application providers, and users subject to EU data protection laws under the GDPR.
What to check next
- Review the full text of the EDPB statement on smart glasses once made available in full.
- Read the external report 'The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses'.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.