On 7 October 2026 the Office of the Australian Information Commissioner (OAIC) opened a formal investigation into Shenzhen Qingcheng Future Technology, the China-based maker of the HeyCyan app. The app powers Kmart's A$89 Anko smart glasses and other low-cost camera glasses. The company did not answer preliminary inquiries that the OAIC began sending on 12 August 2026. Those inquiries asked how the glasses record information, who can access it and where it is stored.
The case for acting
The strongest argument for regulatory intervention is simple. Camera glasses record people who never agreed to be recorded, and the data goes through a phone app to servers the buyer cannot inspect. Privacy Commissioner Carly Kind said: "I have no assurance that it is protecting personal data of Australians as required by the Privacy Act." When a company will not say where footage is stored or who can see it, a regulator has no way to tell whether the law is being followed. Consumers cannot find out either. On those facts, a formal investigation is a reasonable response.
What the OAIC is actually using
The legal route is narrow. The investigation is Commissioner-initiated, under s 40(2) of the Privacy Act 1988, which sits in the part of the Act that covers investigations on the Commissioner's own initiative. The OAIC cites Australian Privacy Principle 1. Under APP 1.2, an entity must take reasonable steps to implement practices, procedures and systems that ensure it complies with the APPs. The OAIC's guidance says this is judged against the sensitivity and volume of the data, the potential harm, and the entity's size and resources.
This is a sensible choice. APP 1 does not ban a product category. It asks one question: does this company run a credible privacy program? That fits a regulator that cannot yet say what the app does with the data. The OAIC says it can use compulsory information-gathering notices. If it finds an interference with privacy, it can make a determination requiring the entity to stop the practice and redress loss or damage. Serious or repeated interferences can lead to civil penalty proceedings in the Federal Court.
The case also needed no new law. The Privacy Act, designed for technology-neutral application, already covers a wearable camera app. That matters for anyone worried that every new device category needs its own statute.
The retailer letters are the real lever
The OAIC also wrote to retailers of HeyCyan-based devices, including Kmart, Big W Marketplace and Amazon. Kind said she would urge responsible retailers "to consider whether it is appropriate to continue making these devices available." The letter is not an order, and the OAIC has made no finding against anyone. Kmart nevertheless removed the glasses from its shelves and website. Advocacy group GetUp and activist Gina Martin had gathered more than 55,000 signatures calling for that.
The retailer route has an obvious advantage. A company with a local presence, a brand and a reputation to protect can act in days. A Shenzhen app developer that ignores correspondence is much harder to reach. In practice, the pressure landed on the party that answered the phone.
That is also the risk. A removal driven by a regulator's public letter, before any finding, sets a precedent for informal enforcement without a decision to appeal. Retailers may reasonably pull any low-cost connected product once a regulator expresses concern, whether or not that product breaches the law. Cheap devices from small makers are the likeliest to be dropped, which could narrow consumer choice without improving privacy.
What proportionate enforcement looks like
Three principles follow from the facts so far.
- Findings should follow quickly and be public. The OAIC says it will not comment until the investigation concludes. If the app turns out to comply, retailers and buyers should be told as clearly as they were told about the concern.
- Target the party that controls the data. The obligation under APP 1 rests on the app maker, not on a shop that resells a white-label product. Retailer letters work best as a supplement to enforcement against the maker, not a replacement for it.
- Do not treat the form factor as the harm. The privacy risk comes from undisclosed storage, access and secondary use. Camera glasses sold by a transparent company with clear data flows are a different matter from the same hardware paired with an app that will not say where footage goes. Tech editor Trevor Long has argued the risk is real but not unique to glasses, and that if it is not Kmart, another brand will fill the gap.
Australia is not alone in feeling this pressure. AFP reported that Norway wants a temporary ban on smart glasses in certain public places, and that a French child welfare group received about 20 reports last month of women filmed without consent, mostly involving Meta glasses. The responses differ. Norway is looking at place-based restrictions, while Australia is using an existing data-governance duty. The Australian route is less intrusive and easier to adjust if the facts turn out differently.
What to watch
The test is what happens next. If the Commissioner uses compulsory notices and the company still stays silent, Australia will have to show that a privacy law can bind a foreign hardware supplier. If the OAIC reaches a determination, it should state which practices fell short of APP 1 and which would have satisfied it. Clear guidance of that kind would do more for the open, innovative device market than any retailer letter. Until then, the Kmart withdrawal shows that reputational pressure can move faster than the legal process, which is not a stable basis for tech governance.