Luxembourg’s data protection authority confronts the challenges posed by nearly invisible smart glasses, asserting that existing laws, including GDPR, are sufficient to regulate their use despite practical enforcement hurdles and privacy risks.
A set of smart glasses that looks almost indistinguishable from ordinary eyewear is forcing Luxembourg’s privacy rules to confront a technology that was barely imaginable when the country’s main private-life law was written in 1982. The Commission nationale pour la protection des données has said the devices are not outside the law simply because they are discreet. On the contrary, their unobtrusive design is part of the problem, because people around the wearer may not know when they are being recorded, or by whom.
According to the CNPD, the moment a pair of connected glasses captures identifiable people through photo, video or audio functions, the device is processing personal data and therefore falls under the EU’s General Data Protection Regulation. The commission says that, in legal terms, the use of such glasses is broadly comparable to video surveillance, which means the familiar principles of lawfulness, transparency, purpose limitation and data minimisation still apply. The difficulty is practical: unlike a smartphone or a fixed camera, smart glasses can be used without making it obvious to bystanders that recording is taking place.
That problem is amplified by the small indicator light fitted to many devices. The CNPD has questioned whether a tiny lamp is a meaningful warning in everyday settings, especially at distance, in poor light or from certain angles. Even if people notice it, they still may not know whether the wearer is taking still images, recording sound, running artificial intelligence functions or streaming live. The commission’s view is that such a signal is not enough, on its own, to inform those in the vicinity properly.
Luxembourg’s data protection authority also says there is no special national law written specifically for smart glasses, but that does not create a loophole. In August, justice minister Elisabeth Margue said existing rules were technologically neutral and already covered networked eyewear. The CNPD has since published guidance for the public, setting out the obligations of users, manufacturers and suppliers, and explaining that the technology must be handled within the same legal framework that governs other forms of data capture.
The legal picture becomes more sensitive in places where privacy expectations are highest. The CNPD points to schools, surgeries and workplaces as locations where necessity and proportionality matter particularly. Changing rooms, showers and similar areas are treated as especially sensitive. Operators can also restrict smart glasses through house rules, a point illustrated by a swimming pool in Cologne that recently refused access to people wearing camera glasses. The broader trend is clear: several companies are trying to build in visible recording lights and anti-tampering measures, but regulators remain focused on whether those safeguards are actually effective in practice. Reporting on enterprise use of the devices has also highlighted concerns over covert recording, leaks and compliance breaches, underlining why corporate policies are increasingly being drawn up alongside legal guidance.
For anyone who believes they have been filmed without consent, the CNPD advises starting with the person or organisation responsible and asking for information or deletion. If that fails, a complaint can be filed with the authority. Civil courts can also hear claims linked to the right to one’s image, while recordings made in non-public places may, in some cases, trigger criminal provisions under the 1982 law. For now, the commission does not favour new location-specific bans. Its position is that the issue is not a lack of rules, but the challenge of applying older legal standards to a device that can record almost invisibly.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
