Smart Glasses and Privacy Issue

By /

A. Introduction

A camera that looks like a pair of spectacles is now an ordinary consumer product in India. Ray-Ban Meta glasses went on sale here on 19 May 2025, at a starting price of about Rs. 29,990. They can photograph, record, live-stream and describe surroundings through an AI assistant, often without anyone nearby realizing it.

This raises a question that India’s data protection law has not yet answered directly: when a person wearing smart glasses records the people around them, whose responsibility is that data, and what protection do those people have?

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified in November 2025, and most substantive obligations apply from 13th May 2027. Wearable cameras should be part of compliance from the start.

In October 2026 the European Data Protection Board (EDPB) issued a Statement on Smart Glasses, supported by a sociological study. Its findings drawn are briefly discussed as below where relevant. The focus of this article, however, is India: what the DPDP Act says, who the Data Fiduciary is, what regulators can do and how stakeholders should prepare.

B. What Are Smart Glasses?

Smart glasses are wearable devices that look like regular spectacles or sunglasses but contain cameras, microphones, speakers and wireless connectivity. They pair with a smartphone app and the manufacturer’s cloud and AI services, and are operated by touch, voice or gesture.

They can capture faces, nearby conversations, voice commands and location, and through AI even text on medical reports or identity cards. Facial or voice recognition would add biometric data.

This data moves to the paired phone, cloud storage, AI provider’s servers and often onward to social media platforms.

C. Key Privacy Concerns

Smart glasses have genuine benefits. They assist people with visual impairments and free professionals’ hands. However, the same features that make them useful also give rise to the following privacy concerns:

  1. Covert recording. Bystanders usually cannot tell whether they are being recorded. The European study cites an official whose colleague recorded strategic meetings and, when challenged, replied, “prove I’m recording”. Indian offices, boardrooms and government meetings face the same risk.
  2. Erosion of trust and free speech. When anyone might be recording, people speak less openly. The study found self-censorship at work, and a relative who secretly recorded a family discussion and later quoted it back.
  3. The shift to an “evidence culture”. The study’s central finding is that many people want smart glasses to protect themselves: drivers, delivery riders and employees want proof if things go wrong. Even people who disliked surveillance said they would record everything if they found themselves in a dispute. India, already reliant on dashcam and phone footage, will see this accelerate.
  4. Weak warning signals. The recording LED is small, hard to see in daylight, can be covered with tape and can be disabled through software. In crowded Indian public spaces, few people will notice it at all.
  5. Hidden data flows. Images and voice queries are often processed on the manufacturer’s servers, possibly outside India. Bystanders have no relationship with the manufacturer and no way of knowing what happens to their data, so possible no consent framework practical applicability.
  6. Facial recognition. Combined with facial recognition, glasses could let a stranger identify anyone on the street in seconds, sharply raising the risk to women, children and vulnerable groups.
  7. Unequal awareness. Technically aware people can spot recording and even bypass safeguards; others cannot, a gap that will be wider in India.

D. How the DPDP Act Applies

  1. Personal data in digital form. The DPDP Act applies to digital personal data. A recognizable face, voice or linked number plate is personal data, so the Act is engaged whenever smart glasses record an identifiable person.
  2. The key roles. The person recorded is the Data Principal; a person whoever decides the purpose and means of processing is the Data Fiduciary; and one who processes on its behalf is a Data Processor.
  3. Territorial reach. Section 3(b) of the Act also covers processing outside India connected with offering goods or services in India, so a global provider processing Indian users’ footage abroad is within scope.
  4. The personal or domestic purpose exemption. Section 3(c)(i) of the Act excludes personal data processed by an individual for any personal or domestic purpose. Recording a child’s birthday or a family dinner and sharing it only with family is outside the Act.

The Act does not say where personal purpose ends. In humble view of authors, the exemption should not extend to footage posted publicly on social media, to recording for work or business, or to systematic recording of strangers in public places. This is the point that most needs guidance.

  1. Publicly available data. Section 3(c)(ii) of the Act excludes personal data that the Data Principal has made publicly available. Mere presence in a market or café should not be treated as making one’s image and conversation public.
  2. Other laws continue to apply. Section 66E of the Information Technology Act, 2000 penalizes capturing or publishing images of a person’s private area without consent. Sections 77 (voyeurism) and 78 (stalking) of the Bharatiya Nyaya Sanhita, 2023 cover serious misuse. Above all of these sits the fundamental right to privacy recognized in Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1.

E. Who Is the Data Fiduciary?

The answer depends on who decides why and how the data is processed. One recording can involve several Data Fiduciaries. Some act independently, each responsible for its own part of the processing. Others act together as joint Data Fiduciaries. Which of these applies has to be decided case by case.

  1. The individual wearer, for personal use. A person who records for purely personal or domestic purposes is not a Data Fiduciary, because the Act does not apply to them under Section 3(c)(i). However, the exemption does not extend to the companies processing the same footage.
  2. The individual wearer, beyond personal use. Where a wearer publishes footage of strangers, monetizes it, or records for work, the personal purpose exemption is unlikely to apply. The wearer then becomes a Data Fiduciary for the filmed people. Influencers, vloggers and self-employed professionals are typical examples.
  3. The employer. Where a company issues smart glasses to staff (for inspections, support or training) or permits their use for work, it is the Data Fiduciary. Section 7(i) of the Act covers employees’ own data for employment purposes, not customers or the public.
  4. The manufacturer and the AI provider. The company behind the glasses, app and AI assistant is a Data Fiduciary in its own right when it analyses images, stores footage, processes voice commands or uses the data to improve its products. This is so even when the wearer is personally exempt. The EDPB takes the same view, adding that AI providers or parties involved cannot shift their duties to users. As far as the manufactures or assemblers of hardware devices in the frame used for smart glasses are concerned, whether or not they are Data fiduciary would depend on whether they are determining or processing any digital personal data jointly with AI providers.
  5. Third-party apps and platforms. A social media platform that receives a live stream or uploaded video is a Data Fiduciary for its own processing of that content. Third-party app developers are Data Fiduciaries or Data Processors depending on whether they decide purposes themselves or by getting implied data access through their apps installed on users’ smart devices/mobile phones.

Section 2(i) of the DPDP Act defines a Data Fiduciary as a person who, “alone or in conjunction with other persons”, determines the purpose and means of processing. The Act therefore recognizes that two or more persons can be Data Fiduciaries jointly for the same processing. Unlike European law, however, it does not set out how responsibilities are divided between them.

Joint fiduciary situations are likely to be common, for example:

  • An employer that deploys smart glasses for field inspections, together with a technology vendor that stores the footage and uses it for its own product.
  • A manufacturer and an AI provider that jointly design how camera images are captured, analysed and retained.
  • A brand and a content creator who jointly plan and publish smart glasses footage of members of the public for a marketing campaign.

Whether parties are joint fiduciaries, independent fiduciaries or a fiduciary and its processor cannot be decided by labels in a contract. It depends on the facts of each case: who decides why recording happens, what is stored and for how long, with whom it is shared, and who benefits from further use. A vendor hosting footage on instructions is a Data Processor; one that also trains its AI models on it becomes a Data Fiduciary for that purpose, alone or jointly.

Where parties are joint Data Fiduciaries, they should record in writing who gives notice, handles grievances, maintains security and reports breaches. Each should assume it may be held accountable for the processing as a whole.

F. Obligations of Data Fiduciaries and Rights of Data Principals Under the Act

The DPDP Act sets out the duties of Data Fiduciaries and the corresponding rights of Data Principals. In the context of smart glasses, the key obligations and rights are discussed below:

  1. Lawful basis. Section 4 of the Act permits processing only with consent or for “certain legitimate use” under Section 7. Unlike European law, the DPDP Act has no general “legitimate interests” ground. In practice, obtaining consent from every bystander is difficult, and Section 7 does not specifically permit recording strangers. Therefore, using bystanders’ data for other purposes, especially AI training, would be difficult to justify.
  2. Notice and consent. Sections 5 and 6 require prior notice and free, specific, informed and unambiguous consent. Consent after recording does not cure earlier processing.
  3. Reasonable security safeguards. Section 8(5) requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches. The DPDP Rules specify encryption, access controls and logging. Failure can attract a penalty of up to Rs. 250 crore.
  4. Children. Section 9 requires verifiable parental consent before processing a child’s data and prohibits tracking, behavioral monitoring and targeted advertising directed at children. Glasses used near schools and playgrounds will routinely capture children.
  5. Significant Data Fiduciaries. Under Section 10, high-volume or high-risk Data Fiduciaries may be designated significant, requiring an India-based Data Protection Officer, an independent auditor and periodic impact assessments.
  6. Rights of Data Principals. A person recorded has the right to obtain information about the processing (Section 11), to seek correction and erasure (Section 12), to grievance redressal by the Data Fiduciary (Section 13) and, after exhausting that, to complain to the Data Protection Board.

The practical problem is clear. A bystander cannot use their rights if they do not know who the Data Fiduciary is. Effective transparency is therefore the precondition for every other right in the Act.

G. Role of the Government, the Data Protection Board and Sectoral Authorities

Under the DPDP Act, the Central Government (through the Ministry of Electronics and Information Technology, MeitY) makes rules under Section 40, while the Data Protection Board of India is primarily an adjudicatory body that inquire into breaches, direct remedial measures and imposes penalties.

  1. Guidance from MeitY. The most useful step would be guidance or rules clarifying:
    • Where the personal or domestic purpose exemption ends.
    • How responsibility is allocated between joint and independent Data Fiduciaries, including manufacturers and AI providers.
    • Minimum transparency expectations for wearable recording devices, so that bystanders are actually informed.
  2. Device standards. MeitY and the Bureau of Indian Standards could set basic safety rules for smart glasses sold in India. The recording light should be clearly visible, recording should stop if the light is covered, and the device should make a sound when recording begins. Its default settings should protect privacy. It could also blur bystanders’ faces and prevent recording in sensitive places.
  3. Data Protection Board. Early orders on covert recording would give clear signals. Through its digital office and public communications, the Board can also explain to citizens how to file complaints and what to expect. Its power to accept voluntary undertakings under Section 32 offers a route for parties involved to commit to better practices without lengthy proceedings.
  4. Sectoral regulators. Many of the sensitive settings fall under specialized regulators. Health authorities and the National Medical Commission could address smart glasses in hospitals and clinics; education boards and the Ministry of Education could issue norms for schools and coaching centers; financial regulators could address their use in bank branches and data centers. The Ministry of Consumer Affairs may require clear disclosure of recording and AI features at the point of sale.
  5. Public awareness. Most Indians will never read a privacy notice for a device they do not own. Campaigns through MeitY’s digital literacy initiatives, CERT-In advisories and the Board should therefore reach the public, covering:
    • How to recognize smart glasses and their recording indicator.
    • The right to ask someone whether they are recording and to ask them to stop in private settings.
    • How to request deletion and how to complain to a Data Fiduciary and then to the Board.

Guidelines should be in regional languages and reach people with limited digital literacy.

H. Sensitive Areas That Need Specific Rules

  1. Workplaces. Glasses can capture board discussions, client data and trade secrets. Every organization should update its HR, IT and information security policies to cover wearable recording devices expressly. The policy should state where they may be worn, whether recording is permitted and the consequences of breach. An employer deploying them should document the purpose, inform employees, limit retention and secure the footage.
  2. Hospitals and clinics. Patients are vulnerable, and health information can be read from charts and screens. Hospitals should restrict smart glasses in clinical areas, with clear signage and trained staff. Any clinical use should be approved and documented.
  3. Schools, colleges and coaching centers. Children are especially exposed and less able to recognize recording. Institutions should prohibit recording on campus except for approved purposes, and teachers should not wear recording glasses in class. Parents should be told about the policy of usage and proper consent should be taken.

I. Preparedness Measures for Stakeholders

Protecting privacy requires action from everyone involved in the use of smart glasses. The following measures can help device wearers, bystanders and organisations use them responsibly and safely:

Responsible Use by User, i.e. Device Wearers

  1. Review the companion app’s privacy settings before first use, including how recordings and AI queries are stored, and switch off what is not needed.
  2. Tell people when you are recording, especially in conversations, meetings and private spaces. Never cover or disable the LED recording light.
  3. Do not record or wear in places like hospitals, schools, washrooms, changing rooms, places of worship or other private settings, and remove the glasses or switch off recording when asked.
  4. Be careful with what you show the AI assistant. Medical reports, identity documents and bank statements shown to it reach the provider’s servers.
  5. Think before posting. Publishing or monetising footage of others may take you outside the personal use exemption and create DPDP obligations.
  6. Do not record continuously “just in case”. A general concern for personal safety does not justify indiscriminate recording of others. Recording a specific incident is different from recording everyone, all the time.
  7. Enabling privacy lock feature or button in the relevant app or device used for video recording.

Safeguards for Bystanders and the Public

  1. Learn to recognize smart glasses. Thicker frames, small camera openings at the corners of the lens and a small light on the frame are the usual signs.
  2. You are entitled to ask whether someone is recording, and to ask them to stop, particularly in private conversations, at work and in sensitive places.
  3. If your image or voice has been published or used without your agreement, ask the person or platform to remove it.
  4. If the Data Fiduciary does not respond satisfactorily, you can complain to the Data Protection Board of India. Serious misuse such as voyeurism or stalking should be reported to the police.
  5. Help children recognize smart glasses and tell an adult if they feel they are being filmed.

Compliance Measures for Organizations

Update your policies, train your staff, put up signage where recording is not allowed, and include wearables in your DPDP readiness program. A short, clear policy adopted now will prevent difficult disputes later.

J. Conclusion

Smart glasses are useful, and their use will only grow. The issue is not whether Indians should wear them, but whether the people around the wearer keep meaningful control over their own image, voice and information.

The DPDP Act already provides the framework. It recognizes the bystander as a Data Principal, makes manufacturers, AI providers, employers and commercial users accountable as Data Fiduciaries, alone or jointly, and gives individuals rights and a forum of the Data Protection Board. What is missing is clarity; where personal use ends, what transparency a wearable device must offer, and how sensitive places should be protected.

With law coming into force with effect from 13th May 2027, there is a short window for the Government, the Board, sectoral regulators, businesses and citizens to address this deliberately. It is far better to set clear expectations now than to respond after the first serious controversy.

Disclaimer

This article is for general informational and educational purposes and does not constitute legal advice.

Sources

  • Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025.
  • Information Technology Act, 2000; Bharatiya Nyaya Sanhita, 2023.
  • Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
  • European Data Protection Board, Statement on Smart Glasses, adopted 13 October 2026.
  • Dr. Yann Bruna, “The connected gaze”, study for the EDPB Support Pool of Experts Programme, 2026. The views in this study are the author’s and not the official position of the EDPB.
  • TechCrunch, “Meta to start selling its Ray-Ban smart glasses in India on May 19”, 13 May 2025.

CA Mukesh Soni, Advocate
Partner, Chir Amrit Legal LLP

CA Kapil Gupta
Senior Associate, Experge Consulting Group

Scroll to Top