Do we have an expectation of privacy in public? When data collected in public is retained and used to train AI, perhaps we do.

That is one of the questions raised in a letter from Senators Ron Wyden and Edward Markey to Meta regarding its AI-enabled glasses.

The letter requests information addressing several concerns:

  • The collection of sensitive and intimate imagery. Privacy protections have long applied to recording in places where individuals reasonably expect privacy. Specific surveillance and video-recording laws may also restrict recording in these settings.
  • The retention and use of captured images to train AI systems, including through human review. This may involve using sensitive data for purposes that people would not ordinarily expect when moving through public or semi-public spaces.
  • The disclosure of sensitive footage to contractors for AI training. This expands access beyond the people in the immediate vicinity to a potentially much larger and unknown group.
  • The lack of control available to bystanders. Owners of the glasses may be able to opt out of having their data used for AI training. Individuals captured without their knowledge, however, may have no comparable choice. In its WhatsApp decision the European Data Protection Board addressed transparency obligations concerning people who did not use WhatsApp but whose personal data was nevertheless processed by the service. Its more recent Statement 1/2026 on Smart Glasses applies that concern directly to wearable technology: non-users may be recorded without realizing that their data is being processed and may have no relationship with the manufacturer or connected AI provider through which to obtain information or exercise their rights. There is also a parallel to recent U.S. wiretapping cases involving AI note-taking tools, where the ability to disable the tool may be reserved to the meeting host rather than extended to everyone whose communications are captured.

What the Senators Want to Know

The letter requests information concerning:

  • Any internal human-rights analysis conducted before the glasses were launched.
  • Testing involving accidental camera activation, tampering with the recording indicator and camera-based AI interactions that do not activate the outward-facing recording indicator.
  • Testing concerning circumstances in which the recording indicator may not be visible to bystanders.
  • Safeguards, if any, used to prevent the nonconsensual capture, disclosure or processing of sensitive imagery.

Practical Takeaways for Companies

Companies developing or deploying recording-enabled AI products can take several steps now.

Before Deployment

  • Conduct a risk assessment addressing the rights and interests of users and non-users. Depending on the data involved and the applicable jurisdiction, an assessment may also be required under U.S. state privacy laws, particularly where the processing involves sensitive data, profiling or other activities presenting a heightened risk of harm.
  • Provide an effective way for people to know that recording is occurring. A recording indicator should be sufficiently noticeable to the people being recorded, not merely technically present on the device. Comparable transparency concerns have arisen in connection with services such as Google Street View (when it was deployed in Germany) and other technologies that collect information about people who have no direct relationship with the provider.
  • Implement measures that limit the collection, use and disclosure of sensitive data. Depending on the product, these measures may include restricting recording in sensitive locations, minimizing retention, limiting human review and blurring faces or license plates.
  • Build individual-rights processes into the product and its surrounding systems. Companies should determine how they will authenticate and respond to access and deletion requests from people who do not own the device and may not know when or by whom they were recorded.

After Deployment

  • Provide clear, real-time notice that recording is in progress. Companies should test whether an indicator remains visible from different angles, distances and lighting conditions and whether it can be covered, disabled or mistaken for another device function. The EDPB’s smart-glasses statement similarly highlights reliable, in-the-moment transparency measures, including visible lights, audio signals and other clear cues.
  • Provide a meaningful way to opt out of AI training. Companies should consider not only the choices available to the device owner, but also whether any mechanism is available to people incidentally captured by the device.
  • Assess and restrict third-party access. This should include contractors, human reviewers, AI-training vendors and other service providers that may receive or access recordings.
  • Facilitate rights of access and deletion. The process should account for the practical difficulties a bystander may face in identifying the recording, the device owner or the company holding the data.
  • Create mechanisms specifically for bystanders. Privacy controls designed only for account holders may leave the people most affected by ambient data collection without an effective way to exercise their rights.

The Broader Question

AI-enabled glasses blur the line between observing what happens in public and collecting, retaining, analyzing and repurposing it.

In the famous “Dog Poop Girl” incident, after a subway passenger photographed a woman who reportedly declined to clean up after her dog, the images were posted online. Internet users identified her and circulated information about her, turning an observable incident in a public place into persistent and widespread exposure. There, the public discourse struggled with something happening in public getting a longer life and bigger audience, due to the then, unique, use of a recording by mobile phone. With smart glasses, the capturing of the footage is even less conspicuous, the audience – broader and the AI training adding a different purpose and additional risk.

The public sphere seems to be no longer out of scope for the expectation of privacy and companies should prepare accordingly.