On 13 October 2026 the European Data Protection Board adopted a statement on smart glasses. Its central point is that makers, and the providers of the apps and AI services tied to the glasses, should not rely on wearers' actions to meet their own GDPR obligations. The statement is non-binding, but it signals how EU regulators will assess these products.
The strongest case for the EDPB's position
The regulator's logic is easy to defend. A bystander on a train or in a clinic waiting room has no relationship with the wearer, no notice and no practical way to object. Under the GDPR, the household exemption covers processing in the course of a "purely personal or household activity", but Recital 18 also says controllers or processors that provide the means for such processing stay within the Regulation's scope. A company that builds the camera, runs the cloud and operates the AI model is therefore not a bystander to the wearer's personal use of the device. If an assistant analyses footage that contains other people, the EDPB says, the company providing that assistant is responsible for the data.
The EDPB also found that existing indicators "leave many non-users unaware" that their data is being processed. One small LED can be mistaken for a reflection, and it can be covered. A design that depends on the wearer's good conduct does not protect the people who bear the risk.
What the statement asks for
As reported by MediaNama, the EDPB wants makers to combine several recording signals, enabled by default and "impossible or difficult to disable":
- LEDs visible in all lighting conditions and lit long enough to notice, with recording that stops when the light is covered.
- Audio cues, such as a shutter sound or a spoken command to start recording.
- Bluetooth alerts to nearby phones, though not as the only signal.
The statement also recommends geofencing of sensitive places and blurring bystanders' faces on the device, before footage leaves the glasses. It suggests storage off by default for real-time assistant features, and "privacy frictions" that slow sharing to social media. On AI training, the EDPB says using bystander footage would be "particularly difficult to demonstrate" as a legitimate interest, because bystanders would not expect it. It adds that makers cannot obtain valid consent from people they have no relationship with.
The statement does not abolish the household exemption. Private recording of family and friends stays within it, though regulators should read it narrowly. Wearers become responsible when they post footage to a public account or use the glasses for professional or political work. The EDPB also said that a general or hypothetical concern for personal safety cannot justify continuous, indiscriminate recording.
Where proportionality should guide implementation
The pro-innovation reading is that the EDPB has mostly chosen design duties over bans. That is the right instinct, and it fits the GDPR's own principle of data protection by design and by default. Hardware signals and on-device blurring are testable, can be standardised, and let the product exist. The EDPB itself called for industry-wide standards on the signals, and regulators should hold to that. A tangle of national interpretations of what counts as a sufficient LED would fragment the single market and favour the largest manufacturers, who can absorb compliance engineering.
Two recommendations deserve scrutiny before they harden into enforcement expectations.
Geofencing. Blocking recording in sensitive places sounds simple, but it requires the glasses to know where they are and to hold a list of what is sensitive. That list is a new data-collection and governance problem. It will contain errors, and it can block lawful uses: a journalist documenting a hospital protest, or a visually impaired user who relies on an assistant to describe their surroundings. Geofences should be narrow, transparent and overridable by the wearer in documented circumstances, with the override logged locally and not sent to the maker.
AI training. The statement's scepticism toward training on bystander footage is well founded as a default. But the line that matters is between training on raw, identifiable footage and training on material that has been blurred on the device before it leaves. Regulators should say plainly that the second route is open, because a flat prohibition would push the work to jurisdictions with no such safeguards.
Regulators should also avoid treating the wearer as irrelevant. The statement keeps wearer responsibility for public posting and professional use, and enforcement should keep that division. Chasing manufacturers for every misuse would invite over-restriction of legitimate features such as accessibility tools.
The wider lesson
The EDPB's approach is already being tested outside Europe. MediaNama reports that in India, where Meta has sold Ray-Ban glasses since May 2025, the Digital Personal Data Protection Act, 2023 does not cover personal or domestic processing. The Internet Freedom Foundation has sent Meta legal notices, one on 24 August seeking Rs 2.05 crore and a second on 10 September, arguing that the manufacturer is liable. No Indian court has ruled on that question. The comparison shows what clear regulatory guidance does: it tells makers what to build before disputes arrive, instead of leaving bystanders to litigate case by case.
The EDPB statement gives manufacturers a concrete design brief. The test of whether it is proportionate will be whether national regulators enforce one shared standard for signals and blurring, and whether they leave room for accessibility and journalism.