EDPB publishes statement on smart glasses
The European Data Protection Board (EDPB) has published Statement 1/2026 on smart glasses. The statement addresses the privacy and data protection issues that may arise when people use glasses equipped with cameras, microphones, connectivity features, artificial intelligence, and other sensors.
Smart glasses can record images, video, sound, location data, and other information about people in their surroundings. In many cases, individuals who are recorded may not realize that a recording is taking place. This creates important questions under the General Data Protection Regulation (GDPR), particularly concerning transparency, lawfulness, data minimization, and the rights of individuals whose personal data is collected.
The EDPB highlights that organizations using smart glasses must identify the applicable legal basis before processing personal data. Depending on the circumstances, this may include consent, a legal obligation, a public task, or the legitimate interests of an organization. The selected legal basis must reflect the actual purpose and context of the processing. Recording people in public or workplace settings does not automatically make the processing lawful.
The statement also draws attention to transparency obligations. Controllers should provide clear and accessible information about what data is collected, why it is collected, how long it is retained, and who may receive it. Because smart glasses can make recording difficult to detect, controllers may need to use several methods of informing individuals, such as visible indicators, notices, spoken information, or other appropriate measures.
Data protection by design and by default is another important issue. Smart-glass providers and users should consider privacy safeguards before the technology is deployed. Possible measures include disabling recording by default, using visible recording signals, limiting data collection, applying short retention periods, restricting access, protecting data through encryption, and preventing unnecessary cloud transfers.
The use of artificial intelligence may create additional risks. Smart glasses can analyze faces, voices, movements, surroundings, or conversations in real time. Such processing may involve profiling or the processing of biometric data, which can be subject to stricter GDPR requirements. Organizations should assess whether a data protection impact assessment is required and should document their decisions.
The EDPB’s statement is relevant to technology companies, employers, public authorities, retailers, event organizers, and other organizations considering smart glasses. Before introducing the technology, they should assess the purposes of use, identify the controller and processor roles, examine international data transfers, establish retention rules, and prepare procedures for handling data subject requests.
The statement confirms that smart glasses should not be treated as ordinary consumer electronics from a privacy perspective. Their ability to capture and analyze information continuously or discreetly can affect people who have no direct relationship with the device operator. A careful GDPR assessment is therefore necessary before the technology is used in public, professional, or private environments.
