As Smart Glasses Become Common, They’re Creating Privacy Risks
Smart glasses are becoming increasingly common, and they’re getting harder to detect. Manufacturers are moving away from bulky, futuristic designs to fashion-forward frames, making them indistinguishable from regular glasses. Components are becoming smaller and better integrated, reducing the telltale signs of technology.
These AI-powered spectacles have built-in cameras and microphones that enable the wearer to covertly record and instantly identify people using facial recognition. As a result, smart glasses create a privacy minefield.
These risks extend to organizations that allow smart glasses in the workplace. While there are relevant use cases for the technology in business operations, organizations must ensure that they remain compliant with applicable privacy laws and regulations. Failure to do so could result in substantial legal or financial penalties and loss of employee and customer trust.
AI Is Making Smart Glasses Smarter
In the past, smart glasses weren’t all that smart. The first consumer versions were essentially hands-free cameras and audio recording devices with a few preset voice commands. Google Glass hit the market in 2013 and brought smart glasses to the public’s attention. However, the product flopped because it was expensive, clunky, and didn’t offer much in the way of features. Google discontinued it in 2015.
Features of AI-powered smart glasses can include video streaming, facial and object recognition, hands-free communication, and real-time translation. Spatial computing enables them to blend digital information with the physical world. They can recognize real-world features and overlay contextual data, graphics, or 3D models in real time.
These advances enable a range of practical use cases. Surgeons can view patient vitals and imaging data hands-free during procedures. Technicians can stream live video to remote specialists who can see what the technicians see and provide on-the-spot help. Field service personnel can access repair manuals and schematics to streamline complex assembly or maintenance. Retail staff can access product information, inventory, and customer history instantly for enhanced customer service.
Collecting Biometric Data Can Run Afoul of Privacy Laws
Increasingly, smart glasses collect biometric data, and that’s when they become problematic. Facial recognition, voiceprint recording, and other features can implicate a range of privacy laws.
The Illinois Biometric Information Privacy Act (BIPA), for example, requires organizations to get written consent before collecting, storing, or using biometric data before such data is captured. They must also inform individuals of the purpose of the data collection and the retention period. They cannot disclose or disseminate biometric data without consent, except for specific authorized purposes or as required by law. Penalties for violating BIPA are $1,000 per negligent violation and $5,000 per intentional or reckless violation. BIPA also provides a private right of action, and plaintiffs can recover attorney’s fees, expert witness fees, and court costs.
BIPA is the most well-known U.S. state law regulating the collection of biometric data, but there are others. The Texas Capture or Use of Biometric Identifier Act (CUBI) is similar to BIPA, but enforcement is less aggressive. Washington’s Biometric Privacy Protection Act (BPPA) requires disclosure and consent before biometric data is collected. Several states regulate biometric data as a category of sensitive personal information within their broader privacy frameworks.
The collection of biometric data may also implicate various federal regulations. Under the Health Insurance Portability and Accountability Act (HIPAA), biometric data is considered Protected Health Information (PHI) when it’s linked to an individual’s health records. Financial institutions are required by the Gramm-Leach-Bliley Act (GLBA) to protect consumers’ nonpublic personal information, which includes biometric data used for verification or security.
Smart Glasses, Illegal Wiretap?
Voice recording, transcription, and translation can run afoul of state wiretapping laws. In 11 states, all parties must consent to the recording of private conversations. Connecticut requires all-party consent for electronic and phone conversations. Nevada requires all-party consent for phone conversations. Oregon requires all-party consent for in-person conversations. No published court cases have addressed the use of smart glasses in these states, but legal experts warn that it poses a major risk.
Wiretapping laws are primarily for audio interception but can encompass video that involves audio recording. Additionally, all states generally prohibit hidden cameras in areas where people have a reasonable expectation of privacy, such as bathrooms and changing rooms. Several states have stricter hidden camera laws.
Smart Glasses Features Don’t Do Enough
To address privacy concerns, most commercially available smart glasses have a clear, visible LED light that illuminates when the camera and microphone are actively recording. A light can count as legal notice of recording in some cases, but it’s often not sufficient on its own.
Many jurisdictions require clear, explicit signage that audio and video recording are in progress. Users should not depend on this feature for compliance with notification and consent requirements. Furthermore, recording is generally illegal in areas where people have a reasonable expectation of privacy, light or no light.
Users of smart glasses should also be concerned about their own privacy. In recent updates to Ray-Ban Meta smart glasses, voice recordings, photos, and videos are used to train and improve Meta’s AI models by default. The camera and microphone are always enabled unless the user turns off the “Hey Meta” wake word feature. However, users can’t opt out of automatic voice recording. Voice commands and interactions are recorded when the wake word is detected and must be manually deleted.
How Can Organizations Deal With Smart Glasses?
Given their practical uses, smart glasses may have applications in day-to-day business operations. Before deploying them, however, organizations should assess all relevant laws and regulations in their jurisdiction and industry. Some laws, such as the California Consumer Privacy Act, also require a privacy risk assessment when “sensitive personal information” is processed. Such information includes biometric data.
Armed with an understanding of the applicable laws, organizations should then develop detailed policies governing the use of smart glasses. These policies should include how, where, and when they may be used and what uses are prohibited. They should also provide guidance on notice and consent requirements. Users should receive regular, role-specific training to ensure they understand and comply with these policies.
When buying smart glasses and related services for business use, organizations should carefully vet their security controls and data processing, storage, and retention policies. Organizations can also implement internal technical controls, such as geofencing, to disable recording features in sensitive areas.
Privacy laws and regulations are complex, overlapping, and constantly changing. Organizations should consult with attorneys who understand the potential implications before deploying smart glasses. With a strategic approach, organizations can capitalize on the benefits of smart glasses while minimizing potential risk.
Advance Your Legal Knowledge With Purdue Global Law School
Staying current on emerging technologies such as AI-powered smart glasses and the legal concerns surrounding them can help organizations avoid compliance missteps.
Purdue Global Law School offers an online Juris Doctor program and an online Executive Juris Doctor program. Graduates of our JD program are academically eligible to sit for the California or Connecticut bar or, with an approved petition, the Indiana bar.
You can also explore specific legal topics, including artificial intelligence law, through our single course offerings. Request more information today.