Smart glasses offer innovative applications, whether it be helping someone find their way, translating a conversation in real time, promoting independence for people with reduced mobility (visual or hearing impairment), guiding a technician during a service call, or facilitating remote medical consultations. However, they must be used in a way that respects the right to privacy and the protection of personal data.
What are smart glasses?
Smart glasses are fitted with built-in cameras and look similar to ordinary glasses (standard glasses, sunglasses or even prescription glasses). They may incorporate various technologies such as a microphone, speakers, Bluetooth or Wi-Fi connectivity, a voice assistant and sometimes even features that utilise artificial intelligence (AI) systems.
These glasses, which connect to smartphones, therefore offer a wide range of features such as taking photos or videos, navigation or internet searches, instant translation, answering phone calls or sending messages. Thanks to artificial intelligence, smart glasses can answer the user’s questions via a chatbot, describe their surroundings (e.g. ‘Can you identify this building?’), recognise objects or text (such as signs, menus, etc.), or even assist them with certain everyday tasks (e.g. ‘What’s the next step on my route?’). To provide these features, the AI system can process information collected via sensors built into the glasses, such as the camera or microphone, in order to analyse visual or audio elements of the user’s surroundings.
However, all of these advanced features involve the processing of a large amount of data, including personal data (Article 4 of the General Data Protection Regulation (‘GDPR’)). Depending on the model and how they are used, smart glasses may, in particular, record voice, capture images and videos of the surroundings – including people in the vicinity – process location data via GPS or the mobile phone to which they are connected, as well as information relating to usage patterns (places visited, times of use, content viewed, etc.).
In future, some smart glasses may incorporate facial recognition features and thus process biometric data. In practical terms, simply looking at a person would be enough for the glasses to identify them and display information such as their name or social media profiles directly in the user’s field of vision. Whilst this technology is not yet available on models intended for the general public, it already raises significant privacy concerns. Biometric data is particularly sensitive. The GDPR, amongst other legal texts governing the use of facial recognition, affords it enhanced protection, and its processing is, in principle, prohibited (GDPR, Art. 9).
Why do smart glasses raise so many questions?
The use of smart glasses raises important issues regarding privacy and the protection of personal data, particularly with regard to informing data subjects and obtaining their consent.
Unlike a smartphone, smart glasses can be used more discreetly, making their use less noticeable to those nearby. As a result, they may not realise that they are being filmed, photographed or recorded, or may not be aware, where applicable, that the information collected will be analysed by an AI system. This low visibility therefore makes it difficult to inform data subjects and, more broadly, to ensure they can effectively exercise their rights regarding the protection of personal data.
Whilst some models have an indicator light to show that recording is in progress, this signal can, however, be difficult to see depending on the lighting conditions and viewing angle. Furthermore, this indicator light does not always show all the features activated by the glasses. This issue is all the more significant given that people in the user’s immediate vicinity may not even be aware that the smart glasses exist. In any case, the mere presence of an indicator light is not sufficient to guarantee compliance with the principle of transparency and the information obligations set out in Articles 12 and 13 of the GDPR. Individuals who may be filmed or recorded should be clearly informed about the collection of their data and the uses to which it may be put.
This issue is all the more important given that the images, videos or audio recordings captured by these devices may subsequently be stored, disseminated, shared or modified without the consent of the individuals concerned. They may also be used to feed artificial intelligence tools capable of generating falsified content, such as deepfakes.
Beyond the initial collection, another key issue concerns the data’s journey once it has been captured. Indeed, some of the information collected is not necessarily processed on the glasses themselves and may be transmitted to an online storage service (‘the cloud’) for storage, synchronisation or the necessary analysis and responses relating to certain features. This aspect often escapes the user’s attention and raises important questions: Where is the data stored? Who can access it? Can it be reused for other purposes?
Finally, as with any connected device, these glasses may also be vulnerable to hacking or even theft. Such situations could compromise the confidentiality of the data collected. The protection and security of these devices are also a key concern to prevent sensitive information from being misused.
More broadly, the widespread adoption of smart glasses could transform our relationship with public spaces. The development of their data-capture and analysis capabilities could encourage the normalisation of virtually invisible and omnipresent surveillance, raising major questions regarding the balance between technological innovation and individual freedoms. These issues, however, require ethical and societal consideration that goes beyond the legal framework of privacy and personal data protection alone.
Are there any regulations governing the use of smart glasses?
At present, the sale and possession of smart glasses are not generally prohibited.
However, as with a conventional CCTV system, the use of smart glasses is subject to the GDPR when they are used to collect and/or process personal data, in particular by filming or recording identifiable individuals.
In such cases, the principles of the GDPR must be complied with. This involves, in particular, having a lawful basis for processing (for example, consent or legitimate interest), complying with the principles of fairness and transparency, limiting the collection to only the data necessary, not retaining data for longer than necessary, and implementing appropriate security measures to protect it.
The GDPR does, however, provide for an exception and does not apply where smart glasses are used in the context of strictly personal or domestic activities (GDPR, Art. 2). Thus, the use of a camera or smart glasses in a private family context (for example, at home or on one’s own property) does not, in principle, fall within the scope of the GDPR.
However, this exception only applies as long as the images or recordings remain strictly within the private sphere. Once they are made public, particularly on social media, or where the use of smart glasses goes beyond a personal context – for example, when they are used to film passers-by in public spaces, employees or customers – the processing of data is likely to fall within the scope of the GDPR. The obligations set out in this Regulation then become fully applicable to anyone using smart glasses. In practice, a member of the public who, for example, wishes to record footage on public roads could therefore face serious difficulties in demonstrating that their use is based on a valid legal basis within the meaning of the GDPR.
Irrespective of the GDPR, users must also comply with the rules relating to privacy and the right to one’s own image, as well as any internal rules that may apply in certain locations. Such rules may prohibit or regulate the use of these devices, particularly in businesses, public swimming pools or beaches, wellness areas, healthcare facilities or educational establishments.
In a public place, as in a private one, everyone has the right to control the use of their image. In this respect, image rights are a key consideration when using smart glasses, particularly as certain models also allow users to livestream images on social media with just a few simple steps. However, in principle, most photography or broadcasting of images requires the prior consent of any person appearing within the camera’s field of view. As a reminder, case law distinguishes between targeted and non-targeted photographs. Targeted photographs are those in which a person is the main subject, appearing alone, in the foreground or striking a pose (even within a group). Non-targeted photographs capture the general atmosphere without featuring one or more people as the main subject. Consent (even implied) is required for targeted photographs. Generally speaking, striking a pose – whether individually or in a group – may be regarded as implied consent to being photographed. For non-targeted photographs, it is usually sufficient simply to inform the people concerned. Respecting the right to one’s own image can therefore prove particularly difficult to ensure when using a recording system such as smart glasses. In the event of a breach, the individuals concerned are entitled to bring an action for damages and/or an action for an injunction before the civil courts if they consider that the photographs and recordings in question infringe their right to one’s own image. This right belongs exclusively to the individuals who actually appear in the photographs or videos.
Privacy, for its part, is guaranteed by the Charter of Fundamental Rights of the European Union (Article 7) and, in Luxembourg, by the Constitution (Article 20), as well as by the Act of 11 August 1982,[1] which enshrines everyone’s right to respect for their private life. Thus, the use of smart glasses to capture or record, without their consent, the image or voice of a person in a place not accessible to the public may constitute a criminal offence. Those who commit such offences face a prison sentence of between eight days and one year and/or a fine of between 251 and 5,000 euros (Act of 11 August 1982, Art. 2).
Our recommendations for users of smart glasses
Whatever their features, smart glasses should be used with caution. A few simple habits can help you both protect your personal data and respect the privacy of those around you.
Do not record a person’s image or voice without their knowledge
Particular attention must be paid to privacy and the various applicable rules when you are considering recording, photographing or filming identifiable individuals. The mere fact that an indicator light is switched on on your glasses does not guarantee that the individuals concerned have been provided with clear, effective and sufficient information.
Before capturing, broadcasting or sharing an image of an identifiable person, ensure that they are aware of this and check that you are authorised to do so. If in doubt, err on the side of caution and avoid any use that could infringe on another person’s privacy.
Please respect places where filming, recording and broadcasting are prohibited or inappropriate
Before using your smart glasses, check whether the venue has any signs, regulations or guidelines regarding filming, photography or recording.
Please also comply with any rules laid down by the venue manager or, at your workplace, by your employer. The use of smart glasses in a professional context must, in fact, be consistent with the company’s internal policies.
In all cases, exercise discretion and common sense in sensitive areas (schools, hospitals, government offices, businesses, courts, changing rooms, toilets, sports halls, swimming pools, beaches, wellness areas, etc.).
Configure the privacy settings for your smart glasses (and, where applicable, the associated app)
Before using your smart glasses, familiarise yourself with the key terms and conditions governing the processing of your personal data and check the privacy settings provided by the manufacturer. Pay particular attention to features that involve the recording of data, its transfer to the cloud or the use of artificial intelligence.
Only enable features that are suited to your needs and, where possible, opt for settings that limit the collection, sharing and transfer of your personal data.
Regularly update your smart glasses (and, where applicable, the associated app)
Updates ensure you benefit from the latest security patches and, where applicable, improvements relating to data protection and privacy.
You should also protect access to your smart glasses and the associated app using a strong password or another means of authentication (PIN, biometrics, etc.). Remember to disconnect old devices, such as a mobile phone you no longer use, to prevent unauthorised access to your data.
In the event of loss or theft, change the password for your associated account promptly and, where available, use the tools to remotely secure or delete your data.
Please ensure you do not keep photos, videos or other data recorded with your smart glasses for longer than necessary
By deleting photos, videos and other unnecessary information, you minimise the risks associated with retaining your personal data for too long.
If your content is synchronised with an online service, please also check that it has been deleted from the associated account.
Before selling, giving away or recycling your smart glasses, remember to delete your personal data and reset the device.
[1] Act of 11 August 1982 on the protection of privacy (Mem. A86 of 12 October 1982).