Smart Glasses and Privacy: Norway's Proposed Restrictions vs India's DPDP Act 2023

Context

Wearable artificial intelligence devices challenge global privacy frameworks by capturing ambient visual and audio data from unconsenting bystanders in everyday shared spaces. Norway's proposed 2026 legislation directly restricts AI-enabled smart glasses across sensitive public venues under European privacy principles. Conversely, India's Digital Personal Data Protection Act, 2023 faces acute enforcement challenges.

India's statutory framework exempts personal data processed for domestic purposes and lacks mandatory privacy-by-design standards. This leaves bystander surveillance in public spaces legally ambiguous despite constitutional privacy protections affirmed in the landmark 2017 Puttaswamy judgment.

Norway moved decisively against wearable surveillance on 5 October 2026. The Norwegian Ministry of Digitalisation and Public Governance announced plans to propose a bill establishing a temporary ban on AI-enabled smart glasses in designated public spaces. As of October 2026, European regulators are escalating scrutiny over consumer optical hardware equipped with ambient recording sensors.

The proposed restriction targets sensitive environments where citizens maintain a reasonable expectation of confidentiality. The ban covers several public spaces:

• Educational settings: Schools and kindergartens
• Healthcare and wellness venues: Healthcare facilities and gym changing rooms
• Communal gathering zones: Beaches, parks, shopping centres, and public events

Official statements from the Norwegian Ministry of Digitalisation and Public Governance explain that the statutory intervention aims to prevent a society where individuals risk covert photography, filming, or audio recording in spaces where they expect not to be monitored.

Regulatory intervention reflects broader institutional alarm across the continent. Norway's data protection authority, Datatilsynet, issued formal warnings that camera- and microphone-equipped smart glasses continuously collect background conversations and bystander personal data without any valid legal basis or consent. Market repercussions followed swiftly across Europe. In October 2026, major Dutch eyewear optical chain Hans Anders halted retail sales of Meta Ray-Ban smart glasses across over 400 stores in the Netherlands and Belgium due to escalating privacy concerns.

Smart glasses shift continuous biometric capture from fixed street infrastructure to ordinary citizens. Traditional data collection relies on distinct interfaces where individuals consciously type inputs or present identification. Wearable optics collapse this boundary. They gather real-time sensor streams passively throughout the wearer's daily routine.

The architectural challenge stems from pairing consumer hardware with remote generative models. Smart glasses route raw video and audio feeds off-device to foreign server infrastructures for real-time inference. Because processing occurs off-device, bystanders forfeit control over their likeness and spoken words before realising recording is underway.

This continuous ingestion challenges foundational principles of data minimisation and purpose limitation:

• Passive Environmental Scraping: Microphones capture ambient private conversations of third parties walking past, converting informal dialogue into machine-readable audio files.
• Biometric Extraction: High-resolution cameras record facial features, posture, and behavioural traits without alerting subjects.
• Information Asymmetry: Wearers access real-time AI contextualisation while surrounding citizens remain entirely unaware of algorithmic processing.

Commencement note (October 2026): The DPDP provisions below are not all in force. The November 2025 notification schedules most of sections 3-17, including core processing, notice and consent provisions, to commence 18 months after publication, with specified exceptions. Section 18 concerns establishment of the Data Protection Board.

The European Union's General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023 present divergent approaches to regulating wearable hardware. Norway applies GDPR principles as a member of the European Economic Area, subjecting consumer data collection to strict institutional oversight. India operates under the newly established DPDP Act, 2023, which constructs regulatory thresholds around distinct statutory exemptions.

The Court of Justice of the European Union clarified the limits of private video capture in František Ryneš v Úřad pro ochranu osobních údajů (Case C-212/13). The CJEU ruled that video recording extending into public space beyond a private residence does not qualify for the household exemption under European data protection law. Conversely, Section 3(c)(i) of India's DPDP Act, 2023 does not include this explicit territorial limitation, leaving public filming by individuals shielded from statutory scrutiny.

The Digital Personal Data Protection Act, 2023 builds its compliance architecture upon informed consent between Data Principals and Data Fiduciaries. Section 5 of the DPDP Act 2023 requires a Data Fiduciary to give notice detailing the personal data collected and the purpose of processing prior to or at the time of seeking consent under Section 6. Wearable smart glasses render this notice mechanism unworkable when capturing strangers moving through public thoroughfares.

Hardware manufacturers attempt to address transparency deficits through miniature light-emitting diodes mounted near the camera lens. Regulators maintain that physical indicators fail legal standards. Specifically, European data protection regulators have repeatedly flagged that minute external LED recording indicators on smart glasses are insufficient to provide lawful notice and transparency under GDPR Article 5(1)(a) and Article 12.

Several operational factors explain why miniature hardware signals cannot secure meaningful bystander consent:

1. Inadequate Visual Notice: Tiny indicator lights remain practically invisible in broad daylight, crowded urban transit hubs, or across distances exceeding a few metres.
2. Absence of Comprehension: A pedestrian observing a flickering pinhead light does not receive statutory notice regarding who controls the feed, where it is transmitted, or how algorithms process it.
3. Physical Impossibility of Opt-Out: Bystanders cannot revoke consent or prevent recording without physically leaving public environments or confronting device operators.
4. Hardware Tampering: Physical recording lights remain susceptible to deliberate occlusion using opaque paint, tape, or third-party electrical modifications, entirely disabling the visual cue.

The Supreme Court of India established that fundamental privacy rights endure within open, accessible environments. In the nine-judge bench judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court held that the right to privacy under Article 21 attaches to the person and is not lost merely because an individual enters a public space. The ruling firmly rejected the proposition that stepping outdoors constitutes a total surrender of personal liberty.

Justice D.Y. Chandrachud observed in his concurring opinion that continuous ambient video capture induces a panoptic surveillance environment that degrades public anonymity and creates a chilling effect on democratic speech and assembly.

This judicial doctrine highlights a sharp operational conflict with statutory data legislation:

• Constitutional Doctrine: Puttaswamy protects a reasonable expectation of privacy in public spaces, affirming personal autonomy, bodily integrity, and informational control across physical settings.
• Statutory Immunity: Section 3(c)(i) of the DPDP Act 2023 creates a statutory safe harbour for individuals capturing personal footage.

If an individual records surrounding citizens on wearable AI glasses for non-commercial use, the regulatory protections of the Act do not apply. This leaves constitutional principles without direct statutory enforcement.

Ubiquitous camera-equipped wearable smart optics create a severe ethical power asymmetry between device wearers and uninformed bystanders who lack visibility, agency, and opt-out mechanisms. Public spaces historically functioned on practical obscurity, where citizens moved freely without creating indelible digital footprints. Wearable AI hardware eliminates that civic cushion by facilitating decentralised, constant surveillance.

This ethical breakdown manifests across three distinct societal dimensions:

• Erosion of Spatial Anonymity: When every passer-by operates as a potential recording node, informal interactions lose spontaneity, compelling citizens to self-censor speech and association.
• Vulnerability of Marginalised Communities: Covert visual capture disproportionately imperils vulnerable demographics in sensitive public environments, including political dissidents, women navigating public spaces, and minority assemblies.
• Commodification of Unwilling Subjects: Real-world sensory inputs collected from bystanders train proprietary AI models, deriving commercial value from citizens who never sanctioned their inclusion.

Section 18 of the DPDP Act 2023 establishes the Data Protection Board; it does not itself grant the Board a general power to prescribe wearable hardware standards. Policymakers can consider guidance within their applicable statutory powers. Because the DPDP Act Schedule empowers the Board to penalise failures by Data Fiduciaries to implement reasonable security safeguards with fines reaching up to 250 crore rupees, regulatory bodies hold substantial authority to compel developer accountability.

To construct an effective regulatory architecture, policymakers and technical agencies should pursue targeted interventions:

1. Clarify Domestic Processing Exemptions: Legal experts recommend that the Ministry of Electronics and Information Technology (MeitY) issue delegated rules under Section 40 of the DPDP Act 2023 to clarify that personal recordings of public spaces cannot claim blanket domestic immunity under Section 3(c)(i). Adopting the European standard established in the František Ryneš ruling would prevent individuals from claiming household exemptions when recording public streets.
2. Mandate Hardware-Level Safeguards: Regulators should mandate hardware-level safeguards, such as tamper-proof physical shutters and software lockouts that disable sensors when recording lights are obstructed. Devices lacking verifiable, non-bypassable broadcast indicators should be barred from commercial retail.
3. Impose Strict On-Device Processing Mandates: Rather than allowing commercial fiduciaries to stream raw sensory footage across national borders under Section 16, technical guidelines must enforce on-device edge computation, stripping identifiable bystander features prior to remote storage.
4. Designate Sensor-Free Public Zones: Following the Norwegian precedent, municipal authorities and state governments should prohibit recording-capable wearables within high-sensitivity public environments, including schools, medical wards, and changing facilities.

• Norwegian Regulatory Pushback: On 5 October 2026, Norway's Ministry of Digitalisation and Public Governance announced plans to propose a bill establishing a temporary ban on AI smart glasses across schools, healthcare facilities, beaches, and public events to protect spatial privacy.
• The DPDP Act Statutory Gap: Section 3(c)(i) of India's DPDP Act, 2023 exempts personal or domestic processing, creating a legal loophole that allows individuals to record bystanders in public spaces without statutory oversight.
• Judicial Contrast on Household Processing: While the CJEU's František Ryneš judgment limits the household exemption when recording extends into public spaces, India lacks an equivalent statutory boundary.
• Constitutional Privacy in Public: The Supreme Court's 2017 Puttaswamy ruling affirms that Article 21 protections attach to the individual and persist in public spaces, conflicting with unbridled wearable surveillance.
• Regulatory Enforcement Levers: The Data Protection Board of India, established under Section 18, possesses statutory powers to penalise security and compliance failures with fines reaching up to 250 crore rupees under the DPDP Act Schedule.