The European Data Protection Board has adopted a preliminary statement on how the GDPR applies to smart glasses

Key takeaways

• The statement is preliminary. The Board says it "will further analyse and work on the privacy concerns raised by smart glasses".
• Whether a wearer is a controller depends on use. Sharing to an indefinite audience, or professional, official or political use, falls outside the household exemption.
• Producers and providers of linked services that are controllers "should not rely on the users' actions to meet their own GDPR obligations".
• The statement says legitimate interests would be particularly difficult to demonstrate for AI training on bystander data.

What is the EDPB statement on smart glasses, and is it binding?

It is Statement 1/2026, adopted on 13 October 2026 and published with a news release the same day. The EDPB's release calls it "an initial statement which provides preliminary guidance to users, manufacturers and service providers". The statement opens by saying it sets out the Board's preliminary reflections on the privacy implications of smart glasses. It closes by saying further guidance may be useful and that the Board will analyse the issue further, including other video devices. Neither the statement nor the release mentions a sanction, a deadline or a transition period.

The statement defines smart glasses as wearable devices that often look like regular glasses and incorporate cameras, speakers, microphones and software, "including artificial intelligence systems for various purposes (e.g. translation or object identification)". Where they process information about an identifiable person, the processing is subject to the GDPR, with the exceptions in Article 2(2) such as purely personal or household activity. A second document, the expert report "The connected gaze", was prepared by an external contractor under the Support Pool of Experts programme. The EDPB states that its views do not necessarily reflect the Board's official position, so this article relies on the statement for the Board's position. For another EDPB instrument on AI and personal data, see our summary of the EDPB web scraping guidelines.

When does a smart glasses wearer become a controller?

It depends on how the glasses are used. The statement says the household exemption applies when the user's actions are in the course of a purely personal or household activity, outside any professional or commercial context. Its examples are sharing a photo or video with a family member or a friend only, or using the device for personal translation in a private context.

The exemption "must, however, be narrowly construed" and assessed case by case. The statement says it would not apply if footage is shared with an indefinite number of persons on a public social media account, or if the glasses are used in official, professional, political or other non-personal activities. In those cases the wearer would qualify as a controller or joint controller and has to comply with the GDPR, notably on transparency. Even where the GDPR does not apply, the statement notes that other laws, for example criminal law, may. It also lists sensitive settings such as medical facilities, schools and other places where minors are present, changing rooms, toilets, and workplaces, where recording or audio capture may be inappropriate or prohibited under national law or local rules.

What does it say about producers, AI providers and bystander transparency?

The GDPR still applies to the producer of the glasses and to the provider of a linked application or service, including AI systems, even when the wearer's own use is personal. The statement says they may be independent or joint controllers where they determine the purposes and means of processing, and gives the example of an AI provider that analyses an image from the camera feed in which other persons appear. It adds that they "should not rely on the users' actions to meet their own GDPR obligations, such as transparency toward other individuals". The EDPB news release puts the same point as "neither the producer nor the provider of a linked application or service can transfer their obligations to users".

On transparency, the statement calls compliance "a major challenge" and says traditional notices do not seem sufficient for people who are not users. It says controllers and producers "should consider combining a broad range of transparency mechanisms", and lists LED or visual indicators, audio indicators and voice activation, smartphone-based proximity notification, and design cues. It says smartphone notifications should not be the sole method. The EDPB Chair is quoted in the release as saying "Smart glasses should make their recording obvious". The statement also encourages industry-wide standards and awareness campaigns.

What does the statement say about legal basis, AI training and data minimisation?

Any processing within the GDPR needs a valid Article 6(1) legal basis, and the statement says validity is likely to need case-by-case assessment. Where a producer or provider processes data about non-users with whom it has no relationship, it says "it would be difficult to obtain their freely given, specific, informed and unambiguous consent", and consent obtained after a recording would not be valid. For legitimate interests, it says the current insufficient transparency affects bystanders' reasonable expectations, and that a fair balance would be "particularly difficult to demonstrate" for commercial further processing beyond the service the end-user requested, or for AI training.

The statement encourages technical measures that it says could mitigate risk: limits on continuous recording, live streaming and retention, blurring or obscuring bystanders before sharing, on-device processing where possible, geofencing in sensitive contexts, and "privacy frictions" that slow sharing on social media. It says that for glasses designed primarily for real-time assistance, persistent storage of captured audio, images or video may not be necessary and should be disabled by default, unless required for the intended functionality or deliberately activated by the user, subject to appropriate safeguards. It also flags the protection of children and notes that the ePrivacy framework may apply in some circumstances.

What should employers, lawyers and device vendors do now?

Treat the statement as a benchmark, not an obligation. The statement creates no new binding requirements and describes how existing GDPR duties apply, so the steps below are our suggestions.

• Employers, schools and healthcare operators: decide whether smart glasses are allowed on site, and say so in a written policy, since the statement flags use in the workplace and in medical and school settings as sensitive.
• Law firms and professionals: if staff wear glasses with cameras or microphones in client meetings, treat that as professional use and check confidentiality and consent first.
• Vendors and AI service providers: map who is a controller for camera and microphone data, including bystanders, and document how recording is made obvious and whether any footage is reused for AI training.
• Everyone: watch for further EDPB work, because the Board says it will continue to analyse the issue.

Key dates at a glance

What we did not verify

What we opened on 2026-10-25: the EDPB news release, the EDPB statement page, the statement PDF (all 36 numbered paragraphs and footnotes), and the first pages of the expert report PDF.

What we did not open: the full expert report beyond its opening pages, the G7 data protection authorities compendium and the national guidance the statement cites, and any national authority reaction. We did not verify any follow-up work programme or timetable.

What we refuse to claim: that the statement is a binding guideline or creates new duties, that any fine or deadline applies, or that the Board adopted the expert report's findings. The date is the adoption date printed on the statement.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Norway Datatilsynet guidance on AI smart glasses
• Hamburg data protection authority final report on Ray-Ban Meta AI glasses
• Dutch AP warning on camera glasses and AI assistants
• EDPB guidelines on web scraping for generative AI