EDPB publishes its first guide on smart glasses privacy

The European Data Protection Board (EDPB) has taken a significant step by publishing a specific statement on smart glasses on October 13, 2026. This document is not a binding directive, but a preliminary guide aimed at clarifying how the GDPR applies to devices that combine cameras, microphones, and internet connectivity in a format as everyday as sunglasses.

The relevance of this announcement lies in the fact that it is the first time the European supervisory body has addressed in detail the privacy risks associated with this type of wearables. EDPB President Anu Talus warned that these devices can record people without their knowledge, a risk that is amplified in sensitive environments such as hospitals, schools, or workplaces.

To avoid ambiguities, the EDPB defines smart glasses as portable devices that often resemble regular or sunglasses, but incorporate computing capabilities and functions such as cameras, speakers, microphones, and artificial intelligence systems for translation or object identification. They can connect to the cloud or mobile applications to expand their functionalities.

The document establishes that when these glasses capture, collect, or store information relating to an identified or identifiable person, they are processing personal data. Therefore, the processing is subject to GDPR rules, unless it involves purely domestic or personal activities, such as recording family members in a private context.

One of the most critical points of the statement is the distinction between when a user is considered a data controller and when they are not. The EDPB points out that responsibility depends on how the device is used. If a user shares a photo or video on a public social network, or uses the glasses for professional or political activities, they assume the role of data controller.

In contrast, if the recording is limited to an intimate circle or used for personal translation in a private context, the household exemption of the GDPR applies. This distinction is vital for users to understand that their behavior in sharing content determines their level of legal obligation and protection towards third parties.

The EDPB focuses on sensitive environments, where the vulnerability of data subjects is greater. In hospitals, educational centers, or workspaces, the presence of hidden cameras in glasses can compromise the confidentiality of patients, students, or employees. The document warns that risks are even greater when recordings are shared on social networks, exposing people to non-consensual surveillance.

Furthermore, the special vulnerability of minors is highlighted, both when they use these devices and when they are recorded by others. The ability of glasses to stream live or store videos in the cloud without clear signaling of recording poses significant challenges for child protection in the digital era.

Although the statement is also addressed to users, it has a direct impact on manufacturers and service providers. The EDPB urges the industry to integrate privacy by design, ensuring that recording functions are visible and that third-party users are clearly informed. Transparency in the use of AI for real-time data processing is an implicit requirement in this new guide.

This motion aligns with 2026 trends, where artificial intelligence and edge data processing are redefining business models for advertising and tracking. Regulatory pressure is not only focused on software but extends to consumer hardware that acts as a vector for massive data collection.

This statement is part of a series of EDPB actions during 2026, including public consultations on anonymization and web scraping in the context of generative AI. The body is working to update its guidelines in the face of rapid technological evolution, seeking to maintain the balance between innovation and the protection of fundamental rights.

For organizations, the recommendation is clear: audit the use of portable devices in their security and privacy policies. The lack of evidence of a specific product announcement by a brand does not prevent the regulation from applying to the entire category. Passive surveillance through consumer hardware is now a tangible legal risk that must be actively managed by companies.