Smart glasses: the EDPB sets the GDPR rules (13/10/2026)
On 13 October 2026, the European Data Protection Board adopted its first statement on smart glasses. Here is what it changes for an SME that equips its teams with a camera, and for one that feeds those images to an AI.
In brief
On 13 October 2026, the European Data Protection Board (EDPB) adopted Statement 1/2026 on smart glasses, published the following day[1]. It is the first EU position treating camera smart glasses as a distinct high-risk category of device for the privacy of the people filmed. The text is not binding, but it sets the framework the authorities of France, Belgium, the Netherlands and Luxembourg will apply.
What the statement says, in three points
Three concrete requirements stand out. First, recording must be visible at all times: a single light is not enough — several signals are needed, impossible to disable, and the camera must switch off if the indicator is covered[1]. Second, responsibility lies with the manufacturer and the app provider, not with the person wearing the glasses[1]. Third, retroactive consent is void: you cannot film first and ask permission afterwards[1].
Why your SME is affected
You do not need to sell glasses to be concerned. An SME that equips its technicians, installers, warehouse pickers or field staff with camera glasses — remote assistance, quality control, inventory — becomes the controller of those images. The EDPB is explicit: a company cannot hide behind "the employee pressed record"[1]. Filming a customer or a passer-by without in-the-moment transparency exposes you to a complaint and an inspection, as the CNIL reminded when it closed the France Travail injunction on data security.
AI: the point that will matter most
The statement also targets model training. Reusing footage of people with no connection to the company to train an AI requires a legitimate-interest assessment, and consent obtained afterwards is worthless[1]. The technical report published in September by the Hamburg authority on Ray-Ban Meta glasses reaches the same conclusion: filming beyond the wearer's close circle is "generally" not permitted[2]. SMEs already working with AI know this uncertainty — our analysis of the EU survey on AI in SMEs puts numbers on it.
Four countries, one line
The EDPB statement is a common reference, but each country applies it through its own authority: the CNIL in France, the Belgian DPA in Belgium, the Autoriteit Persoonsgegevens in the Netherlands and the CNPD in Luxembourg. In practice, an SME deploying camera glasses must be able to answer its national authority with the same elements — transparency, legal basis, impact assessment — whether it operates in Brussels or elsewhere. For our Brussels clients, we check these points before any rollout, just as for B2B appointment setting in Brussels.
Do this week
- List every camera device worn by your teams (glasses, badges, headsets).
- Check that recording is signalled visibly and continuously.
- Ban the reuse of footage for AI training without a written assessment.
- Train your teams: filming a customer or a passer-by is never trivial.
- Document the legal basis (contract, legitimate interest) for each use.
At CyberNovaLabs.io
A camera that films badly is a legal risk, not a gadget. We help SMEs in the four countries put their tools in order, from cybersecurity and compliance to AI in business. Book a call for a quick review.
Sources
- EDPB — Statement 1/2026 on smart glasses (publiée le 14/10/2026)
- HmbBfDI (Hambourg) — Prüfbericht Ray-Ban Meta AI Glasses (10/09/2026)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 20, 2026 · 9 min readNIS2 Luxembourg: are hotels and tourism in scope?
Hospitality appears in no annex of Luxembourg's NIS2 Act. Three obligations still reach you, and one of them already decides whether your corporate contracts get renewed.
Read the article →October 19, 2026 · 8 min readNIS2 Belgium: webshops, marketplaces and the CCB register
A Belgian webshop selling its own products is almost never in scope of NIS2. A marketplace is — as an important entity that had to register with the CCB by 18 December 2024, three months ahead of everyone else. What applies, what does not, and what your customers will ask for anyway.
Read the article →October 18, 2026 · 7 min readB2B appointment setting for accounting firms and fiduciaries
Two very different briefs hide behind "I want meetings with accountants": selling to firms, or being a firm that needs clients. The first runs into a calendar set by law. The second runs into a professional code that governs both promotion and taking over a colleague's engagement. Both are covered here.
Read the article →October 17, 2026 · 8 min readNIS2 Netherlands: are estate agents and letting firms in scope?
The Dutch Cybersecurity Act has applied since 15 August 2026 to some 8,000 organisations. Real estate is not among them. What does bind you: the Wet goed verhuurderschap, client questionnaires, and the ICT provider you share.
Read the article →