EU Privacy Regulators Say Smart Glasses Makers Cannot Leave Bystander Consent to Wearers

The European Data Protection Board adopted a statement on smart glasses on 13 October 2026, and its core position, as reported by MediaNama, is that makers and AI providers "should not rely on the users' actions to meet their own GDPR obligations." The Board's news page lists the item as "EDPB publishes statement on the data protection challenges of smart glasses"; the page text carries only the headline, so the detail below is MediaNama's account of the statement and a companion report titled "The Connected Gaze."

What the statement asks makers to build

The statement is non-binding but guides how EU regulators assess GDPR compliance. MediaNama reports these measures, expected by default:

Measure	What it requires
Recording LED	Visible in all lighting, lit long enough to notice, recording stops if covered
Audio cues	Shutter sounds, or spoken commands to start recording
Phone alerts	Bluetooth signals to nearby phones, but not as the only signal
Bystander faces	On-device blurring
Storage	Off by default for real-time assistant features

It also calls for geofencing to block recording in sensitive places, "privacy frictions" that slow social media sharing, and industry-wide standards for recording signals. Facial and voice recognition "poses a high risk to the rights and freedoms in public spaces."

Hamburg's measurements came first

The Hamburg Commissioner for Data Protection and Freedom of Information published a 53-page report on 10 September 2026. It found that on the Gen 1 Ray-Ban Meta the LED glows dimly during AI interactions and flashes brighter for roughly one second for a photo. On Gen 2 the LED does not light at all during AI conversations about surroundings. Outdoors or in direct sunlight it is essentially invisible on either generation.

"This light is not a reliable transparency mechanism," the report says. It also concludes that "neither consent nor legitimate interest realistically clears that bar for uninvolved bystanders" when footage feeds AI training, and that once training is enabled the wearer and Meta become joint controllers of the bystander data.

The EDPB's position on training lines up: MediaNama reports it said legitimate interest would be "particularly difficult to demonstrate," and that an AI assistant provider is responsible under the GDPR for footage it analyses.

Meta's tamper fix and where it stops

On 27 August 2026 Alex Himel, who runs Meta's wearables division, announced on Threads that the glasses now shut the camera off when someone covers the LED, according to The Next Web. An earlier update disabled the camera when the LED was drilled out of the frame.

The tamper fix addresses a different problem from the one Hamburg measured. Covering the LED is deliberate evasion; a dim or dark LED in sunlight is the design working as built. France's CNIL said in June that technical notification devices "have only a limited range and therefore appear insufficient," per The Next Web.

India has no equivalent rule

Ray-Ban Meta glasses have been sold in India since May 2025. MediaNama reports that the DPDP Act, 2023 does not apply to personal or domestic processing and does not require wearers to tell anyone they are recording. The Internet Freedom Foundation sent Meta and a creator a legal notice on 24 August over a covert Khan Market recording, seeking Rs 2.05 crore, and a second on 10 September. Amazon India still lists LED-blocking stickers.

Related coverage on this site covers a hardware implant found in a Ledger Nano X and Apple's Huxe filing.

The EDPB statement is guidance, not a fine. The first test is whether Meta changes the Gen 2 LED behaviour in AI mode, which Hamburg's report says is dark.