The 60-second summary
On 13 October 2026, the EDPB adopted an initial smart-glasses statement. It addresses discreet recording, bystander transparency and responsibility across users, manufacturers and linked services. A user's household exemption does not remove providers' own obligations. The statement calls for effective, difficult-to-circumvent transparency measures and case-specific legal-basis assessment. It is preliminary guidance on existing law, not a blanket ban or new compliance deadline.
Timeline that matters
13 October 2026
Existing obligations
21 October 2026
What changed
A new EDPB statement provides preliminary guidance for smart-glasses processing.It connects user/controller roles, linked services and bystander information.The announcement distinguishes the Board's statement from an accompanying external expert report, whose views are not necessarily the Board's position.
Who should care
Smart-glasses manufacturers and connected-app providersAI and wearable product teamsEmployers and professional users deploying wearable capturePrivacy, procurement and sensitive-data discovery teams
Why this matters for global organisations.
Wearable capture can move bystander voices, images and sensitive context into apps and AI workflows. Design understandable notices at the moment of capture, map derived data and verify provider controls before deployment.
13 actions to start now
- Inventory proposed devices, capture functions and linked services.
- Map image, audio, metadata and AI-derived output paths.
- Identify sensitive context and unintended background capture.
- Document role allocation from actual decisions about purposes and means.
- Assess the intended professional or personal use with counsel.
- Review legal bases before collecting data and reassess secondary uses.
- Test bystander cues in realistic lighting, noise and accessibility conditions.
- Check whether capture remains possible when indicators are obscured or disabled.
- Review defaults and limit unnecessary capture and retention.
- Assess provider settings for reuse, AI training, subprocessors and transfers.
- Rehearse access and objection requests with representative scenarios.
- Complete a proportionate risk assessment and determine whether a DPIA is required.
- Retain design tests, approvals and supplier evidence; revisit after feature changes.
Evidence worth retaining
- Device/function and data-flow inventory
- Controller/processor and legal-scope assessment
- Bystander notice and indicator test results
- Retention, access and feature-setting records
- Supplier assurance and secondary-use review
- Risk/DPIA decision and deployment approvals
- Rights-request tests and change history
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Who determines purposes and means at each capture and processing stage?
- Does the proposed use fall outside the narrowly construed household exemption?
- How can bystanders understand processing and exercise rights in practice?
- What supports any proposed reuse or model training?
- Which additional rules apply in sensitive settings?
Official sources
- EDPB statement announcement, 13 October 2026
- EDPB adopted statement, 13 October 2026 — PDF
- EDPB statement publication record
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.