AI wearables
Germany / EU
Supervisory report
10 September 2026
Hamburg says the smart glasses wearer becomes a controller, and a joint controller with Meta while AI training runs
On 10 September 2026 the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) published a technical and data protection examination of the Ray-Ban Meta AI glasses, a consumer device that combines a camera, microphones, speakers and an AI assistant in an ordinary looking pair of glasses. The authority examined the first generation Wayfarer model and published the full report in German and in English. Its central conclusion is that, in the usage scenarios that matter in practice, recording identifiable people who do not belong to the wearer's close circle of family and friends will not be permissible under data protection law, other than in rare cases resting on legitimate interests.
It matters what actually reaches Meta. Ordinary photos and videos taken with the glasses stay on the device and in the phone gallery. The material at issue is what is sent when the wearer speaks to the Meta AI assistant: the image and the context that accompany the question, and the exchange itself.
The GDPR does not apply to processing carried out by a natural person in the course of a purely personal or household activity. The authority reads that exemption narrowly here. It can cover use of the glasses in a private setting where third parties are not deliberately recorded, nothing is published, and no material is passed to Meta for AI training. Since that last condition is not the default, the exemption is in practice available only to a wearer who has objected to the training use.
AI training runs by default unless the wearer objects, and while it runs the household exemption no longer applies, because the personal data of bystanders are transferred to Meta for its own purposes.
That leads to the report's most consequential finding. The wearer decides where to point the camera and what to ask the assistant, while Meta determines the infrastructure and the purposes of the training. On the authority's analysis the two act as joint controllers for that processing within the meaning of Article 26 of the GDPR. The result is that an individual consumer ends up in a role that the GDPR normally allocates to organisations.
The authority also assessed whether the device gives bystanders adequate notice that they are being recorded. Its technical testing found that the recording indicator does not. The LED is visible only from certain angles and in good light. Covering it with a sticker or paint does not stop the recording. When Meta AI is used it glows only dimly on the first generation, and on the second generation it does not light at all. The authority concludes that the mere flashing of a white LED does not sufficiently indicate that video and audio are being recorded. A wearer who wants to rely on consent or on legitimate interests would therefore have to take additional measures, such as announcing the recording or using visible signs.
On the legitimate interests test, the authority notes that recording with smart glasses will often fall outside the reasonable expectations of the data subjects, so that in the absence of transparency the balancing test will in the vast majority of cases favour the affected third parties. Face recognition is not switched on in the glasses today. The names of the database tables mentioned in the report suggest that such a feature could be added later, although that is not confirmed. If the glasses were used to identify people by their faces, that would involve processing biometric data, which is governed by Article 9 of the GDPR.
The report describes the arrangement as an opt-out: the material is generally used for AI training unless the user objects, so this is the default state rather than a deliberate choice by the wearer. On the substance of the training, the authority notes that personal data may be taken into training datasets and model parameters and that it cannot be reliably ruled out that the information continues to have an effect within the model. The report concludes that there will as a rule be no legal basis for Meta's use of that material to train its AI systems.
The procedural status matters. This is a supervisory examination report, not a formal decision, and neither a fine nor the opening of formal proceedings was announced with it.
Follow-up: the EDPB statement on smart glasses of 13 October 2026, in issue 7.
Practical impact
If an organisation issues camera-equipped smart glasses to staff, or allows them at work, it is advisable to treat the device as a recording device rather than as an accessory. Decide in advance whether the features that send material to the manufacturer may be used at all, and record that decision.
The report is describing the person wearing the glasses. It did not examine professional use in detail, but it states that professional users are always controllers and must comply with the GDPR in full. Where an employer issues the device, that responsibility will normally sit with the organisation. Check the legal basis, the information given to visitors and staff, and whether facial recognition can be switched on.
Read the English version of the report before advising. It sets out the authority's reasoning on the household exemption, joint controllership and AI training in detail, and is usable as a reference outside Germany as well.
Copies a clean, cited sentence for use in a note.