Privacy and consent in the age of smart glasses

 

On Sept 23, Meta unveiled its latest generation of smart glasses, including the camera-equipped Ray-Ban Meta Gen 3 and Ray-Ban Meta Audio, its first model without a camera.

The launch brings an old privacy question back into focus.

More than a decade ago, Google Glass sparked concerns that people could be photographed or filmed without easily knowing it, leading some restaurants and bars to prohibit the glasses.

Those concerns have returned with today's smart glasses. Some establishments overseas have again restricted their use, while an activist campaign in London placed spoof advertisements featuring disgraced financier Jeffrey Epstein wearing Meta glasses under the slogan, “Glasses for people who don't do consent”.

The technology has changed considerably since Google Glass. The underlying human question has not.

What happens to consent when the person being captured is not the person using the device?

Human behind the camera

Smart glasses change the way recording takes place in an ordinary social interaction.

With a phone, recording is usually obvious because the device has to be raised and pointed towards someone. Smart glasses make that much less noticeable.

This concern is not merely theoretical. In 2026, France's data-protection regulator, the National Commission on Informatics and Liberty (CNIL), surveyed more than 2,000 adults and found that 67 percent considered smart glasses a risk to privacy.

The regulator specifically highlighted how difficult it can be for people to know whether they are being filmed or recorded because smart glasses can closely resemble ordinary eyewear.

Emerging research from the University of Sydney illustrates how that risk can play out in practice.

Researchers analysing 350 publicly available Instagram videos from 2023 to 2026 linked to pick-up-artist communities found that, in a subset of covert point-of-view recordings, around 60 percent of interactions were classified as potential harassment.

In around 43 percent of the videos analysed, women were also exposed to abusive online commentary, sometimes involving the disclosure of personal information.

Manufacturers have also introduced safeguards. Meta's glasses, for example, use a visible capture light while photographs or videos are being taken, and the camera can be disabled if the light is covered or tampered with.

Such measures can alert people nearby, but the decision to record still belongs to the wearer. The person being recorded may only become aware of it after recording has begun.

Artificial intelligence issue

Artificial intelligence (AI) introduces a further layer.

Modern smart glasses can do more than preserve a photograph or video. France's National Commission on Informatics and Liberty (CNIL) notes that they can be connected to AI systems capable of responding to questions about the wearer's surroundings.

A wearer might ask the system to describe what they are looking at or translate what somebody nearby is saying, requiring the device to use its camera or microphone.

Meta's glasses already use AI for functions such as answering questions about what the wearer sees and hears.

The company is now extending this further with Muse, its personal AI agent, designed to provide more continuous assistance throughout the day.

The significance is that the privacy issue no longer ends when the photograph is taken, or the microphone is activated. The information captured can also be analysed and interpreted by the system.

This adds a second question to the first: did the person know they were being captured, and what can the system subsequently do with what it captured?

The person who clicked “I agree” - and the one who didn't

Much of digital privacy has developed around a familiar relationship.

I download an application. I create an account. I use a service. The company collects information about me.

Smart glasses complicate that relationship because there are now at least two people whose privacy may be affected.

The first is the wearer. The person may have bought the glasses, downloaded the accompanying application, and accepted the manufacturer's terms.

But clicking “I agree” does not necessarily mean that an ordinary user understands every stage of what happens to the information captured through the device.

Does the information remain on the glasses or the phone? When does it leave the device? Is it sent elsewhere for processing? How long is it retained? Which functions activate the camera or microphone?

Those questions matter to the person who actually chose to use the technology.

Then, there is the person who never chose it at all.

The person standing opposite the wearer has not bought the glasses, opened an account, read a privacy notice, or adjusted a setting. Yet that person's image or voice may still enter the system.

This creates an unusual privacy relationship. The wearer is the customer. The person being captured may be the data subject. And the company behind the glasses may ultimately process some of that information.

Malaysian laws

Malaysia does have laws that are relevant to these relationships, but their application depends on who is doing the processing and for what purpose.

Where smart glasses are used for harassment, sexual misconduct or the harmful publication of recordings, other Malaysian laws may already come into play.

Depending on the circumstances, these may include provisions of the Penal Code and Communications and Multimedia Act 1998, the Anti-Sexual Harassment Act 2022 and, where sexual material involving children is concerned, the Sexual Offences Against Children Act 2017.

But those laws address particular forms of harmful conduct or content. The privacy question raised by smart glasses can arise much earlier, even where the wearer is simply using the device for personal purposes.

The Personal Data Protection Act 2010 (PDPA) regulates the processing of personal data in connection with commercial transactions.

This becomes relevant where information captured through smart glasses is transmitted to and processed by the company providing the service.

The Act also contains an important exemption. Personal data processed by an individual solely for personal, family or household affairs, including recreational purposes, is exempt.

There is good reason for that. Someone taking photographs on holiday or recording a family gathering should not automatically be treated like a company processing personal data commercially.

Smart glasses, however, make the boundary more complicated.

A person may be using the glasses entirely for recreation while recording somebody else. That individual's use may fall within the personal-use exemption.

However, if the photograph, video or audio is then transmitted to a company's service, the company's processing is a separate matter under the PDPA.

The 2024 amendments become relevant if that processing goes further. A photograph or recording of an identifiable person may already constitute personal data.

If technical processing is then used on that person's facial, voice or other physical or behavioural characteristics and produces biometric data, that biometric data is now expressly treated as sensitive personal data.

This creates a further complication. A bystander may therefore begin outside the relationship altogether - having never bought the glasses or accepted any terms - yet information about that person may still enter a commercial data-processing system and, depending on what is subsequently done with it, receive different levels of protection under Malaysian law.

Malaysia's proposed AI Governance Bill approaches the issue from a different direction.

The PDPA is concerned principally with personal data and how it is processed. The proposed AI framework is concerned with the system itself and the responsibilities of those who develop and deploy it.

This framework is directly relevant to smart glasses. The National AI Office's consultation paper expressly contemplates AI that is embedded within another device.

It also proposes principles of transparency, accountability and responsible data governance, including appropriate awareness and safeguards for people affected by an AI system.

In other words, the question is not only what happens to a person's data after it has been collected. It is also whether the AI system was designed and deployed with adequate safeguards for the people it may observe, interpret, or otherwise affect.

The proposed framework could therefore address matters that the PDPA does not address in the same way: who is responsible for the behaviour of the AI system, what safeguards should be built into it, and whether particular types of AI or particular contexts of use require additional rules.

This is especially relevant because the consultation paper allows requirements to be developed according to the type of AI system and the context in which it is deployed.

The consultation exposes a boundary worth clarifying: what happens when personal use of a device intersects with commercial processing of the information it captures.

The question is how transparency, safeguards and responsibility should operate across that relationship.

What other regulators noticed

Malaysia would not be the first country to confront the question of how people nearby should be informed when smart glasses are recording.

In 2021, Ireland's Data Protection Commission and the Italian Data Protection Authority raised concerns over whether the small indicator light on the first generation of Ray-Ban smart glasses gave people adequate notice that they were being photographed or filmed.

Meta later increased the brightness of the external indicator light, while the next generation of glasses introduced a larger and more noticeable privacy LED.

The significance is not the design change itself. It shows that whether a person receives meaningful notice that recording is taking place can become a matter of regulatory scrutiny.

France has approached the issue from the wearer's side as well. Its data-protection regulator, the CNIL, advises users to inform people nearby when using smart glasses, avoid using them in places where such devices would not be expected, and respect the rights of people whose images or voices may be captured.

Where photographs or videos of others are subsequently used, such as when they are posted online, the CNIL also stresses the need to obtain consent where required.

South Korea takes a more prescriptive approach in certain situations. Its privacy law restricts the use of mobile video information-processing devices for business purposes in public places.

One permitted basis for recording is where the fact of filming is clearly indicated so that the person being filmed is aware of it and does not object, provided the recording does not unduly infringe their rights.

The rule does not directly cover ordinary recreational use of consumer smart glasses. Its relevance is narrower: it shows that, in some contexts, the responsibility to alert the person being recorded is imposed by law rather than left entirely to the wearer or the manufacturer.

Taken together, these approaches address different parts of the same problem. Ireland and Italy focused on whether the device itself gives meaningful notice.

France's guidance places greater emphasis on the conduct of the wearer. South Korea, in specific circumstances, makes clear notification part of the legal conditions for recording.

Malaysia need not adopt any of these approaches wholesale. However, they show that the question of how a person knows they are being recorded has already moved beyond product etiquette and into privacy regulation.

What should Malaysia clarify?

Smart glasses can have legitimate and useful functions, including hands-free assistance, translation and accessibility support.

The question is where responsibility should sit when their use affects another person's privacy.

Some responsibility belongs to the wearer. Technology becoming less conspicuous should not mean that ordinary expectations of courtesy and respect for others’ privacy can disappear.

A person who chooses to record another person remains responsible for that decision, even when the camera is built into a pair of glasses.

Manufacturers and service providers also have responsibilities. Recording indicators should provide clear and meaningful notice rather than merely be present. Users should be able to understand, in ordinary language, when cameras and microphones are activated, whether information remains on the device or is transmitted elsewhere, and what happens to it when AI functions are used.

For Malaysia, greater clarity is needed at the point where personal use and commercial processing meet.

The fact that an individual is using a device for personal purposes should not obscure the separate responsibilities that may arise when information about another person is transmitted to and processed by a commercial service.

The proposed AI Governance Bill also provides an opportunity to consider whether AI-enabled wearable devices require safeguards tailored to situations where people other than the user may be captured or otherwise affected.

The objective need not be to regulate ordinary users as though they were technology companies. It should be to make clearer where the wearer's responsibility ends, where the company's begins, and what protection remains for the person being captured. - Mkini

---

THULASY SUPPIAH is a lawyer focusing on artificial intelligence, data centres and cybersecurity.

The views expressed here are those of the author/contributor and do not necessarily represent the views of MMKtT