Ray-Ban Meta privacy report questions filming strangers and AI training

Hamburg’s privacy regulator says Ray-Ban Meta users will generally struggle to justify recording identifiable strangers under EU data-protection law. It reaches an even tougher conclusion when those people’s information is passed to Meta for AI training.

The report published on 10 September argues that people around the wearer often don’t know they’re being recorded, let alone understand what an AI service might do with their information. Without that knowledge, meaningful consent is unlikely, while other legal justifications will usually be difficult to establish.

This is a completed investigation by the Hamburg Commissioner for Data Protection and Freedom of Information, rather than a court judgment or a ban on selling the glasses. Its central challenge is whether cameras built into ordinary-looking glasses give the people caught in those recordings enough information and control.

What did Hamburg actually conclude?

The 53-page report separates activities that are easy to lump together:

• Taking a photo or video. Normal photography rules still apply. Consent can provide a lawful basis, and some uses may be justified by a legitimate interest: a necessary purpose that outweighs the intrusion into somebody else’s privacy. Hamburg’s concern is that the glasses make recording difficult to recognise, so those requirements often won’t be met in everyday use.
• Asking Meta AI about what the camera sees. This involves sending information to an AI service. The report accepts that navigation, translation and accessibility can justify some uses, depending on the circumstances. Deliberately analysing an unsuspecting person is harder to defend than a request that avoids identifying anyone.
• Using that information to train AI. Improving Meta’s models is a further purpose requiring its own justification. Hamburg concludes that bystanders’ rights will generally outweigh that training interest because they haven’t knowingly supplied the information and may have no realistic opportunity to object.

The report also says permission to take a picture doesn’t automatically cover posting it on social media. It recognises an exemption for purely personal or household activities, such as filming close friends or family, but says that protection falls away when their data is collected and transferred for AI training.

That leaves a demanding overall conclusion: in the everyday situations Hamburg examined, recognisable recordings of people outside that close circle will generally lack a lawful basis, apart from limited exceptions. The report leaves room for properly informed, agreed recordings; it doesn’t claim every use of a camera on glasses is inherently unlawful.

The recording light doesn’t explain where the data goes

The detailed technical investigation focused on first-generation Ray-Ban Meta Wayfarers, including the companion app, data transmissions and a hardware teardown. Hamburg also compared Gen 2’s capture light. It found the newer light slightly more visible, but said both generations remained difficult to notice in some conditions, particularly outdoors in sunshine or from an angle.

Even a clearly visible light would leave questions unanswered. Someone might understand that they’re in a video without knowing whether their image will be sent to Meta AI, posted publicly or used for training.

Current Ray-Ban UK documentation confirms that some camera-assisted AI features on newer models operate without illuminating the capture LED. Ray-Ban distinguishes these requests, such as identifying a plant or landmark, from photos and videos intended for the gallery. It says protections include removing identifying details such as number plates or phone numbers, and that AI imagery isn’t saved in conversation history.

Those protections are relevant, although Hamburg’s legal analysis says masking a face doesn’t necessarily remove every clue to somebody’s identity. Clothing, location and the surrounding circumstances can still identify a person.

In its July explanation of its privacy safeguards, Meta said it had tested the white light for visibility and was strengthening detection of blocked or damaged LEDs. We’ve also covered its subsequent recording-light loophole fix. These are existing product statements and updates, rather than a response to Hamburg’s September findings; the report’s technical results shouldn’t be treated as a test of every current software version.

Meta deserves credit for continuing to strengthen its privacy safeguards. The company has introduced protections against covered recording lights, tightened its response to physical tampering and says it takes action against businesses offering services to disable the indicator. In our view, those steps show Meta is taking its responsibility to improve bystander privacy seriously, even as wider questions about consent and AI training remain unresolved.

AIWearHQ analysis

What this could mean

If authorities pursue Hamburg’s interpretation, the consequences could reach beyond asking owners to be considerate:

• Clearer signs when the camera is feeding AI. Manufacturers could face pressure to make camera activity more obvious and explain the associated data use. A brighter recording light alone wouldn’t answer all the report’s objections.
• Tighter limits on AI training. Meta could need to change how it obtains or uses information about people who haven’t chosen to use its glasses. Where there’s no lawful basis, the affected processing would need to stop or change; permission to answer one question doesn’t automatically justify retaining information to improve a model.
• More responsibility for wearers. Hamburg says users can share legal responsibility with Meta for collecting and transferring bystander data for training. In plain terms, a wearer can’t necessarily assume that every privacy obligation belongs to the manufacturer.

These are possible implications of the regulator’s reasoning, not changes Meta has announced or measures ordered by this report. Any enforcement action and its scope would need to be assessed separately.

What changes for UK owners?

The report doesn’t change UK law or order British owners to stop using their glasses. Hamburg is applying EU data-protection law, while UK uses must be considered under the UK’s own framework.

There is a relevant distinction in ICO guidance for connected products: an individual’s purely personal or household activity can fall outside UK GDPR, while a company processing the resulting personal information for its own purposes still has data-protection responsibilities. A private photograph and a commercial AI-training process therefore need separate consideration here too.

For everyday use, our advice is to explain before recording people, respect objections and avoid camera use in private or sensitive settings. When asking AI about your surroundings, aim the camera away from people and personal details that aren’t needed for the question. An unlit capture LED shouldn’t be taken as proof that the camera isn’t being used.

Our earlier feature on why banning AI glasses won’t solve the whole privacy problem argued that context and behaviour deserve closer attention. Hamburg adds a substantial legal challenge: even a well-intentioned wearer may be involving other people in data processing they can neither see nor control. Making that processing understandable, and establishing when it can lawfully happen, is the problem manufacturers and regulators now have to address.