All news
EDPB / EDPS October 13, 2026 5 min

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

Statement adopted in plenary and announced on 13 October 2026, with the report 'The connected gaze': shared responsibility, the household exemption and transparency as the main challenge

TL;DR

On 13 October 2026 the EDPB published a statement on smart glasses, together with the report 'The connected gaze'. Three messages: anyone using the glasses for professional, official or political activities, or posting videos on a public account, is a controller; manufacturers and providers of linked apps remain controllers and cannot transfer their obligations to users; transparency towards the people filmed is the main challenge. It is an initial statement: further guidance is expected.

What the EDPB adopted

At its latest plenary the European Data Protection Board adopted a statement with preliminary guidance for users, manufacturers and service providers. Chair Anu Talus stressed that the risks are higher in sensitive settings such as hospitals, schools and workplaces, when recordings end up on social networks, and for children, both when they use the glasses and when they are filmed.

Who is the controller

  • The USER is a controller when sharing photos or videos on a public social media account or using the glasses in official, professional or political activities.
  • Filming family or friends, or using translation in a private context, is a purely personal activity: the GDPR does not apply (household exemption). Criminal, civil, labour and sector-specific law still apply.
  • The MANUFACTURER and the PROVIDER of the linked app or service cannot transfer their obligations to users: they must comply with the GDPR and ensure any new processing is compatible with the original purpose.

Transparency: the main problem

Because they look discreet, smart glasses can film people who do not know it. The EDPB asks for recording to be obvious: bright LED lights, audio or voice cues, privacy-friendly smartphone notifications, distinctive designs. Warnings must be reliable, hard to ignore and always up to date, including in public spaces. The Board also encourages industry standards and awareness-raising.

What it means for the DPO

One: check whether the organisation uses, or plans to use, smart glasses or other wearables with a camera, including devices brought in by staff. Two: if use is professional, the organisation is the controller: it needs a record entry, a legal basis, a notice and, in most cases, a DPIA. Three: set written rules for sensitive areas (wards, changing rooms, meeting rooms, front desks) and for personal devices. Four: for employees, national rules on remote monitoring also apply.

The report 'The connected gaze', commissioned by the EDPB on a proposal from the CNIL and written by a digital sociologist, describes how the glasses sometimes become tools of interpersonal surveillance and evidence-gathering, with power imbalances between those who record and those recorded. It is the work of external experts and does not express the Board's official position.

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min
EDPB / EDPS
5steps to decide whether to fine

EDPB Guidelines 04/2026: five steps to decide whether an authority should fine

The European Board has adopted guidelines on when a supervisory authority should impose an administrative fine and when it can stop at a reprimand, an order or a ban. Five steps, fourteen examples, and a clear rule: if the infringement is not minor, a fine is the norm.

Sep 21, 2026New 5 min