Guideline
EDPB Statement 1/2026 on smart glasses
- Date
- Status
- final
- Body
- European Data Protection Board (EDPB)
- Reference
- Statement 1/2026 of the EDPB on smart glasses
What it is about
On 13 October 2026 the EDPB gave preliminary reflections on smart glasses. A user recording for purely personal purposes falls outside the GDPR, but that exemption is narrow: sharing on a public account or professional use is not covered. The producer and the provider of a linked service, including an AI system, can be controllers themselves and should not rely on the user to meet their duties. Ordinary privacy notices do not reach bystanders; the EDPB mentions light and sound indicators among other measures.
What this means in practice
If you give staff smart glasses or offer a service on them, you are probably a controller and must make clear to bystanders at that moment that recording is taking place. Consent from bystanders is hard to obtain, and according to the EDPB legitimate interest is particularly difficult to demonstrate for further commercial use or for training AI. The statement is preliminary and is not a guideline.
The GDPR articles concerned
- Article 2: Material scope
- Article 5: Principles relating to processing of personal data
- Article 6: Lawfulness of processing
- Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject
- Article 13: Information to be provided where personal data are collected from the data subject
- Article 14: Information to be provided where personal data have not been obtained from the data subject
Source: EDPB, Statement 1/2026 on smart glasseschecked on 5 November 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
The counterpart in the other law
- Article 10 AI Act: Data and data governance
- Article 11 AI Act: Technical documentation
via Keeping records: record of processing, technical documentation and logs
- Article 12 AI Act: Record-keeping
via Keeping records: record of processing, technical documentation and logs
- Article 14 AI Act: Human oversight
- Article 18 AI Act: Documentation keeping
via Keeping records: record of processing, technical documentation and logs
- Article 19 AI Act: Automatically generated logs
via Keeping records: record of processing, technical documentation and logs
- Article 26 AI Act: Obligations of deployers of high-risk AI systems
via Keeping records: record of processing, technical documentation and logs
- Article 50 AI Act: Transparency obligations for providers and deployers of certain AI systems
- Article 86 AI Act: Right to explanation of individual decision-making
Case law8 of 18
- Interim relief judge: DPA must redact fine amount when giving an enforcement decision to complainants
2024-05-31 · status not established, Rechtbank Den Haag, voorzieningenrechter (kort geding, team handel)
- Noord-Nederland District Court upholds DPA fine for village livestream, reduces it to 375 euros
2025-01-09 · status not established, Rechtbank Noord-Nederland
- Council of State: 600,000 euro fine for wifi tracking in Enschede stays annulled
2026-07-29 · final, Raad van State, Afdeling bestuursrechtspraak
- EDPS v SRB: pseudonymised data are not always personal data for everyone, but the information duty applies from collection
2025-09-04 · final, Hof van Justitie van de EU (Eerste kamer), Europese Toezichthouder voor gegevensbescherming (EDPS) tegen Gemeenschappelijke Afwikkelingsraad (SRB)
- Mousse: asking for Mr or Ms when selling a train ticket is not necessary
2025-01-09 · final, Hof van Justitie van de EU (Eerste kamer), Mousse tegen Commission nationale de l'informatique et des libertés (CNIL) en SNCF Connect
- Overijssel District Court revokes DPA fine for wifi tracking in Enschede
2024-02-02 · final, Rechtbank Overijssel
- SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
- EU Court of Justice in KNLTB: a purely commercial interest can be a legitimate interest
2024-10-04 · final, Hof van Justitie van de Europese Unie
Guidelines8 of 13
- Guidelines on transparency under Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)
2024-10-08 · under consultation, European Data Protection Board (EDPB)
- Guidelines 03/2026 on web scraping in the context of generative AI
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Guidelines 02/2026 on Anonymisation
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
2024-12-17 · final, European Data Protection Board (EDPB)
- Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · under consultation, European Data Protection Board (EDPB)
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
2020-10-20 · final, European Data Protection Board (EDPB)
Enforcement and fines8 of 16
- Experian Netherlands fined 2.7 million euros for credit scoring without legal basis or information
2025-10-16 · final, Autoriteit Persoonsgegevens
- Netflix fined 4.75 million euros for failing to properly inform customers
2024-11-26 · under appeal, Autoriteit Persoonsgegevens
- Dutch DPA study: algorithms and AI at debt collection agencies
2026-10-29 · final, Autoriteit Persoonsgegevens
- Dutch DPA and tennis federation KNLTB end litigation: fine cut from 525,000 to at most 250,000 euros
2025-10-18 · status not established, Autoriteit Persoonsgegevens
- 600,000 euro fine for AS Watson (Kruidvat) over tracking cookies without consent
2024-05-02 · annulled, Autoriteit Persoonsgegevens
- 10 million euro fine for Uber over unclear retention and transfer information, objection rejected
2023-12-11 · under appeal, Autoriteit Persoonsgegevens
- 500 euro fine and penalty order for Stichting Oud Lemmer over webcam livestream
2021-07-09 · status not established, Autoriteit Persoonsgegevens
- Dutch DPA fines Uber 824.99 million euros for automated driver deactivation
2026-08-21 · under appeal, Autoriteit Persoonsgegevens
Legislation in motion6 of 9
- Proposal: definition of scientific research, purpose limitation and information duty for research (Article 4(38), 5(1)(b) and 13(5) GDPR)
2025-11-19 · under negotiation, Europese Commissie
- Proposal: no information duty in clear, non data-intensive relationships (Article 13(4) GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: exception for biometric verification under the data subject's sole control (Article 9(2)(l) GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: refusing requests that abuse the right of access (Article 12(5) GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: legitimate interest for development and operation of AI (new Article 88c GDPR)
2025-11-19 · proposal, Europese Commissie
- Council: Irish Presidency continues with a revised compromise, Antici Group 11 September 2026
2026-09-11 · under negotiation, Raad van de Europese Unie, Iers voorzitterschap
Analysis
- AI agents and the GDPR: what you need to arrange
2026-11-05
- AI agents in a Dutch municipality: a governance plan in five steps
2026-11-05
- The agent register: what to record for each AI agent
2026-11-05
- Copilot in Dutch municipalities: the DPIA after the Dutch DPA's advice in 10 steps
2026-10-14
- The AI addendum to your DPIA: what a standard DPIA misses
2026-10-14