Germany's debate over smart glasses has moved from abstract warnings to a forensic finding. Hamburg's data protection commissioner, Thomas Fuchs, had his team take apart a first-generation Meta Wayfarer in the lab and analyse the data traffic. The result, reported by heise online on Sunday, is a detailed case that everyday use of the Ray-Ban Meta AI Glasses in public has almost no legally secure basis unless Meta changes the hardware and its defaults.
The examiners quickly hit walls: the glasses' 32GB of flash storage has no standard connectors, and the app's data transfer stays encrypted. But in the app's storage on the paired smartphone they found SQLite table structures named "face", "face_group" and "face_low_confidence_pair". The tables were empty in testing and no biometric facial recognition is running today, yet the scaffolding for automated person-matching is already in place. The authority also points to security researchers who briefly managed to unlock a face-recognition feature — after which Meta responded with a covert update.
Two hardware problems compound the legal ones. Visually, the glasses are nearly indistinguishable from a classic 1950s Wayfarer, so passers-by cannot tell they are being captured by a camera, a five-microphone array and an AI assistant. The white signal LED is largely ineffective: it is barely visible in daylight and sometimes does not signal direct AI interactions at all. And the protection meant to block recording when the LED is covered can be defeated with tape or a cap — genuinely started recordings keep running even if the light is taped over afterwards, which the report says fails Europe's privacy-by-design requirement.
The legal consequence falls on buyers. The household exemption shields private individuals from GDPR duties for recordings in a private setting; filming strangers in public, or publishing footage on social media, forfeits that privilege. The authority is explicit that wearers then become fully responsible data controllers. It gets worse for anyone who does not opt out of Meta's defaults and helps train the model: when third parties' images and audio are sent to the US for AI training, the data leaves the private purpose, pulling users into joint controllership with the US company under Article 26 GDPR — a role for which Meta offers no allocation-of-duties agreement.
To process other people's images or conversations lawfully, wearers would need informed consent or a demonstrable overriding legitimate interest. The report argues both fail in practice: effective consent requires prior explanation that is effectively impossible given how inconspicuous the glasses are, and while public video recording can sometimes rest on legitimate interests, activated AI features nearly always tip the balance toward the rights of those filmed. Under the European Court of Justice's standard, walking through a city would require verbally briefing passers-by in advance or wearing warning vests. The report singles out doctors' offices, demonstrations, women's shelters and playgrounds as especially sensitive settings. The complaint that prompted much of this debate came from the digital-rights group HateAid, which in August filed a criminal complaint against Meta, Ray-Ban owner units and four German retailers.
