The European Data Protection Board has adopted statement 1/2026 on smart glasses, its first formal position on devices that look like ordinary eyewear but carry cameras, microphones and an internet connection. The statement was adopted at the Board's latest plenary in Brussels on 13 October, alongside a report titled "The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses", produced under the EDPB's Support Pool of Experts (SPE) programme. The announcement is on the EDPB website.

The EDPB describes the text as an initial statement. It offers preliminary guidance to three audiences, users, manufacturers and service providers, and is meant to raise awareness of the risks rather than settle every legal question. More detailed guidance may follow, but the Board hasn't said when, so anyone waiting for a checklist will have to make do with the principles for now.

The Board's framing is blunt. Smart glasses are becoming widely available and more frequently used, and while the EDPB acknowledges they create opportunities for communication, assistance and innovation, it says they raise significant questions for the protection of personal data and for individuals' rights and freedoms.

EDPB Chair Anu Talus put the core problem simply: "These devices look like ordinary glasses, but they include cameras and microphones and are connected to the internet. This raises serious privacy concerns, as individuals may be recorded without their knowledge." She added that the risks grow in sensitive environments, naming hospitals, schools and workplaces, and when recordings end up on social networks. Children, she said, are especially at risk, both when they wear the glasses and when they're filmed by someone else wearing them.

The statement's most useful section for practitioners is the one on shared responsibility. The EDPB's position is that a wearer's responsibility for processing personal data under the GDPR depends on how the glasses are actually used. The example the Board gives is sharing a photo or video on a public social media account. In other words, the same device can sit in very different places on the GDPR spectrum depending on whether footage stays private or gets published. The published summary stops short of listing every scenario, so the full statement and the SPE report are the places to look for the detail.

What the announcement doesn't contain is also worth noting. There are no fines, no enforcement deadlines and no named manufacturers in the published material. The Board hasn't announced any coordinated action against a specific product. This is a statement of principles and a research report, not an enforcement decision.

The SPE report's title gives a hint of its scope: video recording, surveillance and the use of recordings as evidence. That last point matters beyond privacy teams. If footage from a pair of glasses can be evidence, then who recorded it, when, and under what controls becomes a question of accountability, and accountability is an identity problem as much as a legal one.

For identity and security teams, the practical question is whether your environment can even tell that a camera just walked through the door. Badge readers don't distinguish between eyewear and recording equipment, and neither do most visitor policies. Check whether your acceptable use and bring-your-own-device policies mention wearables at all, whether recording restrictions in sensitive areas (clinical floors, data centers, HR offices) are written down and enforced rather than assumed, and whether any smart glasses that pair with corporate phones or accounts show up in your device inventory and conditional access logs. The encouraging part: most of this is a policy update and an inventory query, not a new product purchase. The acidic part: if you've never thought about it, somebody in your building already has, and they're probably wearing them.