Smart glasses in the workplace: the privacy and surveillance risks organisations need to manage
When Kmart’s $89 Anko Smart Glasses sold out across Australia within days of their July 2026 release, they did more than generate headlines – they put affordable, covert recording technology into the hands of everyday consumers.
The regulatory response was swift, with the Attorney-General directing the Office of Australian Information Commissioner (OAIC) to investigate the privacy implications of smart glasses and the Privacy Commissioner signalling that regulatory intervention may be warranted.
For organisations, wearable recording technology has moved from a niche concern to a mainstream compliance issue. The question is no longer whether this technology will reach your premises, but whether your privacy, surveillance and governance frameworks are ready for it.
Key takeaways
Smart glasses create new challenges for organisations because discreet recording can expose personal, sensitive and confidential information without those being recorded necessarily knowing it is happening. Organisations should consider the following:
- Understand your Privacy Act obligations: the Privacy Act 1988 (Cth) and Australian Privacy Principles generally impose obligations on organisations rather than individuals acting in a personal capacity.
- Review existing policies: conduct a gap analysis of workplace surveillance, acceptable use, bring your own device (BYOD), and information security policies to determine whether they adequately address wearable recording devices. Ensure definitions are sufficiently broad to capture smart glasses and similar technology.
- Consider physical and operational controls: establish clear protocols for managing recording-capable devices on premises, including signage, visitor check-in procedures, and designated device-free zones, particularly in areas where sensitive or confidential information is discussed.
- Review privacy notices and consent processes: review existing privacy collection notices and consent mechanisms against a scenario in which recording devices are invisible. Identify and address any gaps in APP 5 notification processes and APP 3 collection practices.
- Monitor regulatory developments: track the Tranche 2 Privacy Act reforms, including the proposed fair and reasonable test and enhanced consent standards, and assess their likely impact on your current data handling practices.
- Prepare for privacy incidents: ensure your data breach and privacy incident response plan addresses covert wearable recording scenarios. Staff should know how to identify, report, and escalate suspected recording incidents.
- Consider the broader legal framework: look beyond the Privacy Act. State and territory surveillance devices legislation, workplace health and safety obligations, contractual confidentiality protections, and the new statutory tort for serious invasion of privacy tort each provide distinct mechanisms for managing recording risks.
The catalyst: Kmart’s Anko Smart Glasses
On 28 July 2026, Kmart released the Anko Smart Glasses, a pair of black-rimmed, clear-lens glasses with an integrated camera capable of recording high-definition video and photographs. Recorded content is transferred to a paired smartphone via the HeyCyan app.
Priced at a fraction of the cost of Meta’s Ray-Ban smart glasses, the product made wearable camera technology accessible to a far broader segment of Australian consumers than any previous device. The product sold out nationally within days.
The regulatory response was immediate. The Attorney-General formally requested that the OAIC investigate the privacy implications of smart glasses, expressing particular concern about risks to women and children. The Attorney-General observed that smart glasses ‘may be used more discreetly [than other technology], making it harder to know when you are being recorded.’
The Privacy Commissioner has also indicated that the OAIC is actively monitoring the market presence of surveillance wearables and considering whether regulatory intervention is warranted.
Internationally, some businesses have already responded. In the United Kingdom, pub chain Wetherspoons has banned camera-equipped smart glasses from its premises, a measure that may foreshadow similar responses from Australian venue operators and commercial landlords.
What can smart glasses record?
Understanding what these devices can do is important when assessing the compliance risks they create.
The Anko Smart Glasses feature an integrated 8-megapixel camera capable of capturing 1080p video and photographs from the wearer’s line of sight. Critically, the glasses have no visible recording indicator, such as an LED light, making it effectively impossible for bystanders to know when recording is taking place.
Recorded content is transferred to the wearer’s smartphone via Bluetooth through the HeyCyan companion app. From there, recordings can be copied, uploaded to cloud platforms, shared on social media or transmitted to third parties, all without the knowledge or consent of those captured in the footage.
For organisations, the potential risk is significant. These devices can capture faces, identity credentials, confidential documents, screen content, and private conversations in workplace and commercial settings. The combination of covert recording capability, ease of dissemination, and high data quality creates a compliance challenge that existing frameworks were not designed to address.
How does the Privacy Act apply to smart glasses in the workplace?
Much of the public debate has focused on the privacy risks to individuals in public spaces. However, the more immediate compliance exposure sits with organisations. The Privacy Act and the Australian Privacy Principles (APPs) do not regulate individuals acting in a personal capacity, but they do regulate organisations, including in respect of activities carried out by employees in the course of their employment.
The practical implication is this: an employee who uses smart glasses to covertly record colleagues for purely personal reasons is unlikely to be directly breaching the APPs. However, the organisation that employs that person, controls the premises, and manages the personal information environment within which the recording occurs, does bear compliance obligations. Where personal information is collected in the course of an organisation’s functions or activities, or where an organisation holds personal information that may be exposed by on-premises recording, the APPs apply.
APP 3 mandates that personal information must be collected by lawful and fair means. For sensitive information, such as biometric data (including facial images), APP 3.3 requires that collection only occur with consent. Organisations must also ensure that the collection of personal information is reasonably necessary for their functions or activities.
APP 5 requires organisations to notify individuals, at or before the time of collection, about the purposes of the collection, who will receive the information, and the consequences of non-collection.
Smart glasses create an obvious compliance challenge: how can individuals be notified that they are being recorded when the recording device is indistinguishable from ordinary eyewear?
The Privacy Commissioner has highlighted this issue, stating: ‘There are real questions as to whether [technology companies] will be able to [comply with privacy law]: how will they notify individuals that their images or voice has been recorded?’
For organisations permitting the use of smart glasses, achieving APP 5 compliance may require measures such as:
- prominent signage at entry points, clearly disclosing the potential for recording;
- express terms in visitor and contractor agreements addressing recording on premises;
- real-time notification mechanisms, where practicable; and
- policies restricting or prohibiting the use of recording-capable wearables in defined areas.
Non-compliance with the Privacy Act can result in significant penalties. Under section 13G, corporations face maximum civil penalties of up to the greater of $50 million, three times the value of any benefit obtained directly or indirectly from the conduct, or 30 per cent of the body corporate’s adjusted turnover during the breach period (whichever is greatest).
What other laws apply to smart glasses and cover recording?
Surveillance and workplace surveillance laws
The use of surveillance and listening devices is governed by a patchwork of Commonwealth, state and territory legislation. There is no single national law regulating the use of recording devices by individuals. Instead, each state and territory maintains its own surveillance devices regime.
In New South Wales, for example, surveillance devices are primarily regulated by the Surveillance Devices Act 2007 (NSW) and the Workplace Surveillance Act 2005 (NSW). In the workplace context, the legislation regulates camera, computer and tracking surveillance of employees and generally requires employers to provide advance notice before surveillance is carried out.
These provisions are directly applicable to AI-powered smart glasses which have the capability to discreetly capture audio, video and other information in workplace settings.
From a compliance perspective, several critical concerns arise. Covert recordings may constitute unlawful surveillance, private investigations and commercial matters may be recorded without the knowledge or consent of those involved, and the volume of personal and sensitive information that can be collected covertly is significant.
Statutory tort of serious invasion of privacy
The Privacy and Other Legislation Amendment (Remedies and Other Measures) Act 2024 (Cth) introduced a statutory tort of serious invasion of privacy into Australian federal law.
This provides individuals with a right of action where their privacy has been seriously invaded, including through intrusion upon seclusion or misuse of private information. While this remedy is costly for individuals to pursue, it represents a significant expansion of the remedial landscape and signals Parliament’s intent to strengthen privacy protections.
Organisations should be aware that covert recording by smart glasses in commercial settings could give rise to liability under this tort.
Australian Consumer Law
The Australian Consumer Law, contained in Schedule 2 to the Competition and Consumer Act 2010 (Cth)) may also be relevant.
Product safety standards and consumer guarantees apply where wearable devices are sold without adequate warnings about the legal obligations associated with their use. Further, the prohibition on misleading or deceptive conduct under s 18 of the Australian Consumer Law could apply to marketing that downplays the privacy risks of recording-capable wearables or fails to adequately disclose the legal obligations on purchasers.
Workplace health and safety and other obligations
The risks extend beyond privacy compliance. Mass adoption of wearable recording devices may increase insider threats, from the removal of confidential information and intellectual property to the broader challenges for cyber security frameworks.
Organisations should also consider their workplace health and safety obligations, particularly the duty to manage psychosocial hazards, given that covert recording may feature in bullying, harassment, or performance management disputes.
Can organisations ban smart glasses from their premises?
A practical question for many organisations is whether they can require individuals to remove or hand over smart glasses before entering their premises.
Generally, employers and those controlling premises have broad authority to impose conditions of entry. However, any such policy should:
be communicated clearly and in advance through employment contracts, workplace policies, or visitor terms;
apply consistently across all personnel and visitors to avoid discrimination claims;
address prescription smart glasses, where recording capability is integrated into corrective lenses, potentially requiring alternative arrangements;
provide secure storage arrangements for surrendered devices; and
set out clear consequences for non-compliance.
Where an organisation permits wearable recording devices, it should implement clear usage policies that delineate permitted and prohibited conduct, and ensure staff and visitors are aware of the applicable rules.
What should organisations do as smart glasses become more common?
The Anko Smart Glasses are unlikely to be an anomaly. They represent the beginning of a broader trend towards cheaper, more capable, and more discreet wearable recording technology – while the regulatory response is still developing.
A potential OAIC investigation and the Tranche 2 Privacy Act reforms signal that the regulatory framework is shifting, but it has not yet matured. The Tranche 2 reforms are expected to introduce a ‘fair and reasonable’ test for the handling of personal information and enhanced consent standards, both of which will have direct implications for organisations managing surveillance risks on their premises.
Organisations that establish clear governance frameworks now, rather than waiting for regulatory clarity, will be better positioned to manage the evolving risk landscape and demonstrate proactive compliance to regulators, employees, and clients alike.
How we can help
Smart glasses and other wearable recording devices raise overlapping privacy, surveillance, workplace and information security issues. As these devices become more widely available, organisations should consider whether the existing policies and controls are equipped to manage the risks.
If you need advice on managing wearable recording devices in your workplace or premises, reviewing your privacy and surveillance frameworks, or preparing for emerging privacy reforms, please contact our team.
Contacts
