Smart glasses: the EDPB clarifies who controls your data

On 13 October 2026 the EDPB adopted its first statement on smart glasses — but the headline isn't a ban, it's a map of responsibility: depending on how you use them, the data controller can be the user, the device manufacturer, or the provider of the connected app. And none of the three can offload their obligations onto the other two.

What happened

During its latest plenary, the European Data Protection Board adopted a statement on smart glasses and published, alongside it, the report «The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses», commissioned under the Support Pool of Experts (SPE) programme following a proposal from the French DPA (CNIL). The EDPB's 13 October press release describes the text as an «initial statement»: preliminary guidance for users, manufacturers and service providers, not a binding act or formal guidelines. The stated goal is to raise awareness of the risks posed by devices that look like ordinary glasses but incorporate cameras, microphones and software — in some cases AI features for translation or object recognition — and can record without the people around noticing.

Shared responsibility, not shared at random

When the user becomes the controller

The EDPB precisely circumscribes the cases in which someone wearing smart glasses becomes a data controller under the GDPR: if they share a photo or video on a public social media account, or if they use the device as part of official, professional or political activities. In these scenarios, the user takes on all the obligations set out by the GDPR, transparency included.

When the household exemption applies

Outside those cases, the exemption for personal or household activities applies: sharing a photo or video only with family members or friends, or using the device for personal translation in a private context, doesn't trigger the GDPR. The EDPB notes, however, that this exemption must be narrowly construed and assessed case by case — and that, even where the GDPR doesn't apply, criminal, civil or labour law considerations may still be in play.

Manufacturers and providers: controllers that can't delegate

The sharpest passage in the statement concerns whoever sits upstream of the user. The device manufacturer and the provider of the connected app or service — including AI features, for example when they analyse the camera feed to answer a question about the surrounding environment — can be independent controllers or joint controllers when they determine, alone or together, the purposes and means of the processing. In these cases, according to the EDPB's 13 October press release, they cannot transfer their obligations to users: they must comply with data protection law in their own right, transparency included, even toward people who are filmed and have no direct relationship with them. Any new processing of the data collected must also remain compatible with the original purpose of collection.

The real issue: transparency toward people who don't use the device

The most operational part of the statement concerns bystanders — people who are filmed but don't wear the smart glasses and often don't know they're being recorded, by whom, or for what purpose. The EDPB notes that traditional privacy notices, designed for users, aren't enough to reach people who simply happen to be within the field of view, especially when the controller is the manufacturer or provider and has no contact with those people at all.

To close the gap, the EDPB lists a combination of possible measures: bright LED lights, audio signals or voice activation cues, privacy-friendly smartphone notifications, and device designs that make them distinguishable from ordinary glasses — warnings that, according to the EDPB's 13 October press release, need to be reliable, hard to ignore, and always up to date. This is a point worth reading precisely: the EDPB Chair, Anu Talus, frames it as a recommendation («smart glasses shouldmake their recording obvious»), not as a binding legal requirement already in force. For anyone designing these devices or the connected apps, it's still the clearest signal of where regulatory attention is heading: it's worth treating it as a design requirement from now, rather than waiting for it to become hard law.

The SPE report is not the EDPB's position

The statement is accompanied by the report «The connected gaze», developed by an external contractor with digital sociology expertise and based on real interviews with users and non-users of smart glasses. It's useful material for understanding perceptions and power imbalances between those who record and those who are recorded, but the EDPB states explicitly in its note to editors: the document was not produced by the EDPB, it was prepared by an external contractor as part of the SPE programme, and the views expressed don't necessarily reflect the Board's official position. For anyone writing or reporting on this topic, it's a distinction worth keeping: the report is a research contribution, the statement is the EDPB's position.

What to check right now

• Map, for every product or AI feature linked to smart glasses, which of the three roles (user, manufacturer, provider) acts as controller in that specific use case.
• Don't assume that user consent or responsibility also covers the manufacturer's and provider's obligations: the statement explicitly rules this out.
• Consider a visible or audible recording indicator, or a proximity notification, even though it remains a recommendation rather than a binding requirement today.
• Keep a clear line, in your own compliance documentation, between what is an established GDPR obligation and what is an EDPB recommendation not yet codified into law.

Conclusion

The 13 October statement doesn't ban anything and doesn't introduce a new legal obligation: it's preliminary guidance that clearly signals where supervisory attention will concentrate — shared but non-delegable responsibility, transparency toward people who never chose to be filmed. Anyone building wearables or connected AI services would do well to map their controller roles today, before today's recommendation becomes tomorrow's enforcement.

Sources

• EDPB — EDPB publishes statement on the data protection challenges of smart glasses — press release of 13 October 2026
• EDPB — Statement of the EDPB on smart glasses — the statement itself
• EDPB SPE — The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses