EDPB Smart Glasses Statement: Responsibilities of Users and Providers

On 13 October 2026, the European Data Protection Board (EDPB) adopted its Statement on Smart glasses, providing preliminary guidance on the application of the GDPR to smart glasses.

The statement clarifies the responsibilities of users, device manufacturers and providers of linked services: users are responsible for the recording and use they determine; manufacturers and AI service providers also bear corresponding responsibilities when they determine how personal data are collected, analysed and used. Users may benefit from the household exemption when using smart glasses in the course of purely personal or household activities, but companies providing related services must still fulfil their own data protection obligations.

The EDPB’s press release also introduces a study commissioned through its Support Pool of Experts (SPE), The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses. Written by sociologist Yann Bruna, the report draws on interviews with seven users and fifteen non-users to examine actual uses of smart glasses and people’s perceptions of recording. Its examples provide concrete contexts for understanding the statement; its views do not represent the EDPB’s official position.

1. Users’ responsibilities

Article 2(2)(c) GDPR excludes the processing of personal data by a natural person in the course of a purely personal or household activity. The statement gives two examples: sharing photos or videos only with family or friends, and using translation functions in a private context.

Sharing footage with an indefinite audience on a public social media account, or using smart glasses for official, professional or political activities, falls outside the household exemption. In these circumstances, users who determine what to record, for what purpose and with whom to share it must fulfil controller obligations, including having a lawful basis for processing, informing the people recorded and safeguarding their data protection rights.

The report documents several professional uses. A delivery worker told the researcher that he recorded deliveries so he could prove he had completed them when customers complained and avoid a drop in his platform rating. A bus driver used smart glasses after discussing their use with his employer, photographing vehicles that might damage the bus’s wing mirrors. Buying the device personally or recording for self-protection does not bring these professional uses within the household exemption.

Use at work also requires identifying who arranges the recording. Where a company requires employees to record maintenance work and determines the content, purpose and retention period, the company bears controller responsibility for that processing, while employees operate under its authority. Where employees record on their own initiative for their own purposes, responsibility must be assessed according to their own decisions. In the expert report, one interviewee described a colleague secretly recording strategic meetings; this differs markedly from work records arranged by the company.

Even where the household exemption applies, audio and video recording must still comply with local rules on privacy, image rights, employment relations and particular premises.

2. Manufacturers’ and AI service providers’ responsibilities

The household exemption covers users’ private activities; it does not exempt service providers from their GDPR obligations. Recital 18 GDPR specifically states that controllers and processors providing the means for processing personal data for personal or household activities remain subject to the Regulation.

Smart glasses often involve processing by several parties. After a user starts recording, a linked application may receive and store the footage, while an AI service may analyse images or sound. Assessing manufacturers’ and service providers’ responsibilities requires identifying the purposes and means each determines.

The statement gives the example of an AI service provider analysing camera images that include other people to answer a user’s question about their surroundings. Where it determines the purposes and means of that processing alone or jointly, it may be an independent or joint controller.

The expert report describes another experience: an interviewee’s friend used smart glasses to access Meta’s functions and help read his blood test report. He found it useful at the time, but later wondered where his health data had gone. Asking a friend to help read a test report may be a private activity; the service provider must nevertheless fulfil GDPR obligations according to its actual role in analysing, storing and using the personal data in the report.

Legal roles must reflect actual processing. A service provider processing data only on a controller’s instructions may be a processor; if it independently decides to use the data for its own purposes, it bears controller responsibility for that processing. Describing the arrangement as a “technical service” or “processing on behalf of another party” in a contract does not change the decisions it actually makes. A manufacturer’s role also depends on the functions concerned: merely selling a device and operating footage storage or AI analysis services involve different responsibilities.

For manufacturers and service providers acting as controllers, the statement particularly emphasises that they must fulfil their own GDPR obligations. Merely requiring wearers in user agreements to inform bystanders and ensure lawful recording does not fulfil the provider’s obligations to inform bystanders about the processing of their data.

3. Data protection obligations towards bystanders

Bystanders who are recorded have not registered with the linked application and may not know that the glasses contain cameras and microphones. Showing an in-app privacy policy only to registered users does not fulfil the obligation to inform the people recorded.

The expert report found that some users interviewed considered the absence of objections from bystanders after the indicator light came on to imply consent to recording. They also acknowledged that people unfamiliar with the device might not know what the light meant. Indicators should make people aware that the glasses are recording or performing AI processing, and allow them to find out who is processing the data and for what purpose.

The statement recommends combining visual and audio indicators to alert bystanders promptly to recording or AI processing. Visual indicators should be easy to notice in different lighting conditions and remain active long enough; recording should not remain possible when an indicator is covered. Manufacturers and controllers must also provide legally required information, including the controller’s identity, purposes and how to exercise rights, and ensure technical indicators are effective, difficult to circumvent and updated when necessary.

Beyond providing information, processing bystanders’ data requires a lawful basis. The wearer’s acceptance of service terms cannot substitute for a bystander’s consent. The statement notes that manufacturers or service providers often have no relationship with bystanders, making valid consent difficult to obtain. Consent obtained after recording cannot serve as the basis for the preceding collection.

When relying on legitimate interests, controllers must demonstrate necessity and weigh individuals’ rights and reasonable expectations. The statement particularly notes that it is difficult to establish a fair balance when data are used for commercial purposes beyond the service requested by the user, or for AI training. Bystanders who are unaware of the initial collection are even less likely to expect their images or voices to be used to train models. Controllers must also ensure they can exercise their right to object.

Further uses must comply with purpose limitation. The statement requires controllers to assess whether a new purpose is compatible with the original collection purpose, paying particular attention to the context in which bystanders have no relationship with the controller. A user’s request for one instance of real-time assistance does not itself provide a basis for the provider’s persistent storage or training use.

These requirements must be implemented in product settings. For glasses primarily providing real-time assistance, the statement recommends not storing captured audio, images or video by default; storage may be enabled where required for the function or deliberately activated by the user with appropriate safeguards. Where feasible, protective measures such as blurring or obscuring bystanders’ identifying information should first be applied on the device before sharing or reuse. Recording indicators, storage settings and subsequent uses must be implemented by those who determine the relevant functions and processing activities.

References

EDPB press release: https://www.edpb.europa.eu/news/edpb-publishes-statement-on-the-data-protection-challenges-of-smart-glasses_en; Statement on Smart glasses: https://www.edpb.europa.eu/system/files/2026-10/20261310_edpb_statement_smart-glasses_en.pdf; GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679; EDPB Guidelines 07/2020 on controller and processor concepts, version 2.1: https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf; EDPB Guidelines 3/2019 on processing personal data through video devices: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf; SPE expert research report: https://www.edpb.europa.eu/documents/support-pool-of-experts/the-connected-gaze-video-recording-surveillance-and-administering_en.