German authorities endorse Hamburg's smart glasses assessment and publish draft guidance on gym cameras
The Conference of the Independent Federal and State Data Protection Authorities, the DSK, met on 23 September 2026 and, in results published the next day, set out its views on smart glasses and on video surveillance in fitness studios. Both reach well beyond the devices and premises they name.
The first is smart glasses. The DSK endorsed the Hamburg Commissioner's examination report of 10 September 2026 on the Ray-Ban Meta AI Glasses, which issue 3 covered. In the DSK's assessment, the wearer is responsible for the recordings, and the GDPR applies to the wearer once images of other people are processed outside a purely personal or household context. The DSK considers that people must be informed before they are recorded, and that a warning LED is not enough. It also considers that using recordings of others to train AI generally lacks a legal basis, and that facial recognition with AI in public spaces would not be permitted. What had been one Land authority's assessment now carries the endorsement of the German supervisory authorities' joint conference. It remains an assessment, not a decision against any company.
The second is draft guidance on video surveillance in fitness studios, dated 1 September 2026 and published after the conference as a supplement to the DSK's general guidance on video surveillance by private bodies. It responds to rising complaints, and in particular to studios that operate partly or entirely without staff. Under the draft:
- Changing rooms, showers and saunas may never be monitored.
- Relaxation, eating and waiting areas may not be monitored, because people do not expect it there.
- Training floors are generally off limits. Narrow exceptions include a camera limited to where small equipment is stored, on a documented concrete risk; live monitoring where there is an elevated health risk and staff able to intervene at once; and, in exceptional cases, targeted surveillance after repeated serious offences.
- At the entrance, a camera for access control is justified only where electronic access control, staff at reception or barriers are not enough. Recording to investigate offences requires documented past incidents and must be limited in time, and recording alone is not considered able to prevent offences.
- Outside opening hours, when nobody is entitled to be present, blanket surveillance is generally permissible.
- Permanent workstations and the monitoring of staff behaviour or performance are excluded.
The draft narrows the legal bases operators most often rely on. Walking into a signposted area is not consent, and consent written into a membership contract is generally not freely given. Consent is conceivable only exceptionally, for a camera trained on a single machine that the member switches on for their own session and that captures no one else.
Surveillance is generally not necessary to perform the contract, unless the service itself is video based, such as video training analysis. The ordinary risk of a sports injury does not engage vital interests.
For other uses, that leaves legitimate interests. The draft says that a supposed deterrent effect does not justify cameras on its own, and it names emergency buttons, fall-alert wristbands and staff rounds as the answer to safety concerns. It also says that a sign on the wall is irrelevant to whether people should objectively expect to be filmed.
The DSK will open a public consultation on the draft. As at 30 September 2026, no deadline had been published in the DSK's materials.
Follow-up: the EDPB statement on smart glasses of 13 October 2026, in issue 7.