Smart glasses: Look closely—you might be a controller, and the EDPB is watching

They look like ordinary glasses. But they come with cameras and microphones, and they are connected to the internet. During its plenary this week, the European Data Protection Board (EDPB) adopted a statement on smart glasses. It is only a preliminary statement, but it sends clear messages to users, manufacturers and service providers. In a nutshell:

• Users can be controllers. A user who shares a video on a public social media account, or uses the glasses for official, professional or political activities, is a data controller under the GDPR. 
• The household exemption still exists. Filming family and friends, or using the glasses for personal translation in a private context, falls outside the GDPR. However, criminal, civil, and labour laws as well as sector-specific rules may still apply. 
• No passing the buck. Manufacturers and providers of linked apps or services cannot transfer their own obligations to users. Any new processing must also remain compatible with the original purpose of collection. 
• Transparency is the key challenge. Bystanders often do not realise they are being recorded. The EDPB Chair calls for recording to be made obvious, for example, by bright LED lights, audio signals or smartphone notifications. These signals must be “reliable, hard to ignore, and always up to date.” 
• Sensitive environments carry higher risk. The EDPB names hospitals, schools and workplaces, as well as cases where children are involved. 
• Industry standards are encouraged. The EDPB encourages industry standards and awareness-raising measures. 

The EDPB also published an external expert report, “The connected gaze.” It describes how smart glasses can become tools for interpersonal surveillance and evidence collection.  

This is a good reminder that privacy by design is not optional for wearables. The EDPBs view continues the path we saw in social media: Users who post smart glasses recordings on social media or otherwise share them publicly are unlikely to qualify for the household exemption and may be considered data controllers subject to the GDPR’s full range of obligations.

Most of these devices now also come with AI features, so manufacturers should look at the EDPB statement together with the AI Act transparency rules that have applied since 2 August 2026. Companies that allow or provide smart glasses at work should also update their internal policies. 

Read the EDPB press release. Watch for more detailed guidance. The EDPB itself calls this an initial statement. 

A related development may be of particular interest to parents: In Austria, the Federal Administrative Court (Bundesverwaltungsgericht) just overturned the expulsion of a Viennese pupil who kept wearing Meta smart glasses in class despite a ban in the school rules and several suspensions. The court held that an exclusion from school may only be based on "concrete, established facts", and the school could not prove any actual recordings. Concerns of teachers and classmates alone were not enough. The education authority has filed an extraordinary appeal, and the Austrian Ministry of Education is now examining a general ban on smart glasses in schools. This raises a practical evidentiary question: How can teachers or schools establish that a recording was made? Further developments are expected. Read more about the decision.