When smart glasses record you, the Privacy Act binds the company holding the data, likely the app maker. The OAIC is investigating the one behind Kmart’s Anko glasses

The OAIC says it has been watching smart glasses since early 2026, and in August the Attorney-General wrote asking the Privacy Commissioner, Carly Kind, to examine their privacy implications. From 12 August the office sent preliminary inquiries to five entities: the retailers Kmart and BDI Technology, which sell glasses but do not run the software; Meta, which makes glasses and the software on them; Google, which plans to; and Shenzhen Qingcheng, which supplies the software, including the HeyCyan app, used in many lower-cost glasses. The questions were how the glasses record, who can get at the recordings, and where they are stored.

On 7 October the OAIC announced the investigation and the Commissioner published a blog setting out what the inquiries taught her about where the law applies and where it does not. The blog is the more useful of the two documents for anyone who owns, sells or is filmed by smart glasses. It places the work against numerous local government bans on smart glasses at sensitive public spaces such as swimming pools, playgrounds and gyms, a GetUp petition the Commissioner says passed 55,000 signatures, and a proposal to restrict the use of smart glasses in federal workplaces and public service offices.

Why the OAIC opened an investigation

Shenzhen Qingcheng, which the OAIC says is based in China, did not respond to the preliminary inquiries. HeyCyan is needed for the full functions of many lower-cost glasses made in China and sold under various brand names, the OAIC says, including Kmart’s Anko glasses and glasses sold through Big W’s marketplace and Amazon. Wearers connect their phone to the app for music, calls and HeyCyan’s voice assistant, and using those features involves information the glasses gather being collected through the app for processing.

In the absence of any response from Shenzhen Qingcheng to the OAIC’s preliminary inquiries, I have no assurance that it is protecting personal data of Australians as required by the Privacy Act.

Carly Kind, Privacy Commissioner, OAIC media release, 7 October 2026

The Commissioner said the failure to respond raises concerns about the entity’s practices, procedures and systems to protect the personal information it holds, the subject of Australian Privacy Principle 1. Her blog adds concerns arising from third party analysis of the technology itself as well as the entity’s privacy policy; it does not name the analysis. An investigation, opened under section 40(2) of the Privacy Act, lets her issue compulsory information gathering notices. If she is satisfied there has been an interference with privacy, the options include a determination, which can include declarations requiring specified steps and redress, and, for serious or repeated interferences, civil penalty proceedings in the Federal Court. None of that is a finding: the OAIC says it will await the conclusion of the investigation before commenting further.

She also wrote to retailers of devices that use the app. Given the particular risks the OAIC has identified with the HeyCyan app, I would urge responsible retailers to consider whether it is appropriate to continue making these devices available, she said.

The other four entities are not under investigation. The Commissioner says no decision to investigate them has been made at this time, and that this should not be read as any conclusive statement about the compliance or otherwise of the entities under scrutiny.

Who the Privacy Act binds

The Commissioner notes that the Act does not apply to individuals, such as the person wearing the glasses, but to companies and Commonwealth agencies, and that among companies it covers only those that hold personal information. Providing a device or piece of hardware does not itself bring you under the auspice of the Act, even if that device does collect personal information. The entity responsible for Privacy Act compliance will be the entity that holds the personal information collected.

For retailers, the Commissioner’s point is that the Privacy Act may not reach them, but the community will expect due diligence. Businesses that skip due diligence will likely face at least reputational damage, she writes, and she has asked the Australian Retailers Council to encourage members to weigh the privacy risks of connected and surveillance devices before selling them.

Is a recording of you personal information?

Not always. The Act covers information about a reasonably identifiable person (tranche 2 would make that relates to). In her recent Monash IVF and Medmate Australia determinations the Commissioner said identifiable includes information that lets an entity single out or distinguish a person in a way that affects their rights or interests, even if their legal identity is not apparent. For glasses, she thinks it will depend on context and on what the company already knows. A company that already holds a lot about identifiable people is likely to be able to identify someone in its footage, and recordings that show a name badge or uniform, carry geolocation, or announce who someone is are likely to be personal information. But this may not be in all cases.

Consent is mostly not required

The Act does not make consent a general condition of collection. The usual test is that the information is reasonably necessary for the company’s functions or activities, which the Commissioner reads as a duty to collect no more than it needs. Consent is required for sensitive information, and for glasses the most relevant kind is biometric information: glasses with facial recognition are likely collecting biometric information, and the software provider would need consent. To clarify, we have not yet identified the use of facial recognition capabilities in smart glasses devices available on the Australian market. The OAIC’s view of facial recognition in shops is in its retail guidance.

Being told you were recorded

Companies must take reasonable steps to notify people of certain matters when they collect their information. The Commissioner calls this a highly qualified obligation, because it responds to the particular circumstances of the collection, and compares the glasses’ software provider with a photo storage service: it would be difficult, she writes, to contend that a provider such as Apple has Privacy Act obligations to everyone photographed in public whose image sits on its servers. She says it is impossible to say conclusively what glasses software providers should notify, and to whom, but it is difficult to avoid the analogy with photo storage apps.

Security is where she puts the weight. Where glasses collect personal information in volume and without people knowing, the duty to keep it secure is even greater, because a breach is likely to do more harm when people do not know they were recorded and cannot protect themselves.

What the tranche 2 reforms would change

The government’s proposed second tranche of Privacy Act reform, which we read in exposure draft on 7 October, would change four things that matter for glasses, on the Commissioner’s account, and the one that gives people the most direct control is unlikely to reach the smaller providers.

In the exposure draft, a large digital platform is a provider of a social media, relevant electronic or designated internet service whose business group, counting revenue from outside Australia, had gross revenue of at least $500 million in the previous financial year, or whose service averaged at least 2.5 million monthly end users in Australia, or one prescribed by regulation.

Our view

The Commissioner has done buyers a service by saying plainly what the law does not do. The brand on the box, and the shop that sold it, may sit outside the Privacy Act if they collect nothing; the company that answers is the one holding the data, and for many lower-cost glasses that is likely a software provider in China which did not answer her questions. She describes the gaps in Privacy Act coverage with respect to smart glasses herself. The investigation will show how far compulsory notices reach a company that did not answer voluntary inquiries; the OAIC has not said, and we would not guess.

That leaves retailers as the only party a buyer can see, and their duty is mostly one of expectation: a letter, an urging, a request to an industry council, with accessorial liability in the background. If the law is meant to rely on shops to screen what they sell, it would be better written down than left to reputation.

Tranche 2 helps where it matters most for the person being filmed. A bystander has little genuine choice about being recorded, and a fair and reasonable test that asks about choice speaks directly to that. But the erasure right stops at large digital platforms, and the Commissioner herself says it is unlikely to reach the small software providers in lower cost products, the kind of product at the centre of this investigation. If a bill is introduced, the question to ask is whether a person recorded by glasses should be able to have the footage deleted whatever the size of the company holding it.

Sources

Method note. Written substantially by AI and run by people, working from the 3 primary sources below. 25 quotes here were verified by script against copies of the sources we archived. How AI Geek works.

1. OAIC opens investigation into maker of HeyCyan smart glasses phone app, Office of the Australian Information Commissioner, media release, updated 7 October 2026 (read 15 October 2026, rechecked unchanged 18 October 2026): the Attorney-General’s request; preliminary inquiries from 12 August 2026; no response from Shenzhen Qingcheng; the Commissioner’s statements; the letter to retailers; background on the HeyCyan app; possible outcomes; section 40(2).
2. Smart glasses under the microscope, Carly Kind, Privacy Commissioner, OAIC blog, published 7 October 2026 (read 15 October 2026, rechecked unchanged 18 October 2026): the five entities; who the Act binds; reasonably identifiable; consent and biometrics; notice; security; retailers and the Australian Retailers Council; tranche 2.
3. Exposure Draft, Privacy Amendment (Personal Data Protection) Bill 2026, Attorney-General’s Department, 58 pages (read in full 7 October 2026): section 6EB, large digital platforms, gross revenue and end users tests (pp 43-45).

Sell, make or use smart glasses, or read the OAIC differently? Tell us and we will check it against the documents and log the outcome here.