Smart glasses and invisible recording: where privacy law stops and the real problem begins

People have learned to recognise a phone held up to take a photograph and signs warning that CCTV is operating. Wearable technology weakens those cues. A camera can point in the same direction as the wearer, record continuously or send material for remote processing without the people nearby understanding what is happening.

The ICO also makes an accessibility point. Visual indicators and signs have never given equal transparency to people with no or low vision. As devices become less obvious, the same failure becomes a broader public problem: how can someone avoid, question or object to processing that they cannot identify?

UK data protection law contains an exemption for processing carried out by an individual in the course of a purely personal or household activity. The ICO says this means the law does not prevent people taking photographs or videos for personal use. A bystander cannot assume that UK GDPR applies simply because their image was captured.

The ICO says a recording posted so widely online that anyone can see it is unlikely to remain purely personal use. Data protection considerations may then apply. The boundary is contextual: sharing privately with a small circle is different from building an audience, monetising clips, systematically recording strangers or publishing material for a commercial purpose.

There is no general rule that every photograph or recording made in a public place requires the consent of every person visible. That does not make every use acceptable. Audio capture, expectation of privacy, confidential settings, children, targeted conduct, publication and automated analysis can all create additional legal and safeguarding questions.

A photograph of a face is personal data when a person is identifiable, but it is not automatically special-category biometric data. That higher classification generally becomes relevant where specific technical processing is used for the purpose of uniquely identifying a person. Facial recognition or matching can therefore create obligations beyond ordinary recording.

The ICO's Chief Executive, who is severely visually impaired, highlighted how smart glasses can support navigation, access to information and independence. The regulator has also worked with technology intended to assist people living with dementia. Responsible assistive use should not be treated as suspicious merely because other users bypass safeguards or behave intrusively.

Good product design should make responsible use easier. That can include reliable capture indicators, accessible explanations, clear controls, limited default collection, secure processing and barriers against disabling safety features. Privacy and accessibility should be designed together.

The story exposes a gap between public expectation and regulatory reach. A person can experience an intrusive recording without the individual wearer necessarily falling within UK GDPR. The practical response is to identify the actor, use and harm, then choose among data protection, platform rules, venue policy, safeguarding, harassment law or police action rather than assuming the ICO can solve every case.

Smart glasses make recording easier and less visible, but the correct response is neither a blanket ban nor the claim that existing law covers everything. Identify what was captured, who processed it, how it was used and whether the conduct created a separate harm. That is the route to a complaint capable of reaching the right decision-maker.