Imagine you are sitting at one of the terraces on Place d’Armes, talking to a friend, checking your bank account or trying to calm your child. At the next table, someone wearing an ordinary pair of glasses looks in your direction.
Those glasses could contain a camera and several microphones. The person might be taking a photograph, recording your conversation or asking an AI assistant about something they see.
Hidden cameras have existed for decades. What is changing is their place in everyday life. Connected cameras are now sold as normal eyewear, designed to be worn for hours and linked directly to online services.
A small light is supposed to indicate when the camera is operating. European regulators questioned this safeguard in 2021. The Irish and Italian data protection authorities asked whether the indicator gave people enough warning that they were being recorded.
Manufacturers later introduced technology intended to stop the camera when the light is covered. In October 2025, an investigation found that a hobbyist was offering a $60 modification that disabled the light without disabling the camera.
The manufacturer responded in July 2026 with a mandatory update designed to detect physical tampering and shut down the camera. It has also acted against businesses advertising modifications.
Most owners will use the glasses harmlessly. The episode still shows the weakness of relying on one small light. People nearby may overlook it or have no idea what it means.
Similar fears followed the arrival of camera phones. People worried that strangers would photograph them without permission and distribute the images online. European privacy law already existed, although the General Data Protection Regulation, or GDPR, was still years away.
Camera phones eventually became part of daily life. We also learned to recognise how they are used. Someone normally has to take out the phone, raise it and point it. That gives others a chance to notice and react.
Smart glasses require no similar gesture. Taking a photograph can look exactly like an ordinary glance.
They can also send an image to an AI service. The wearer might ask the system to read a sign, identify an object or translate a menu. To answer, the service may process the image on a remote server. Other people can appear in it without being the subject of the request.
The privacy implications became clearer earlier this year after an investigation by two Swedish newspapers. Contractors in Kenya working on the glasses' AI functions said they had encountered footage showing bathroom visits, naked people, sexual activity and financial information.
The devices do not constantly upload everything their owners see, and not every photograph is sent to a human reviewer. The material described by the workers had reached the company through its AI functions.
The investigation nevertheless showed how far a recording can travel after it enters a cloud service. The wearer may understand that an image is being processed online. A partner leaving the bathroom or a stranger caught in the background may not even know that the image exists.
This question has now reached Luxembourg's parliament.
In July, MPs Liz Braz and Ben Polidori asked the government whether smart glasses threatened privacy and whether Luxembourg's laws were sufficient.
The government acknowledged that the technology creates real difficulties. Mobile recording can be hard to detect. Someone may struggle to identify who filmed them or obtain deletion of an image. Livestreaming and publication on social media can increase the potential harm, while later use for AI training creates another set of concerns.
For now, Luxembourg is not proposing a law specifically for this technology. The government's position is that the existing rules apply regardless of which device is used.
There has also been an important development since the government answered the question. On 26 August, the National Commission for Data Protection, or CNPD, published guidance specifically on smart glasses. It confirms that buying and wearing them is not in itself prohibited, but using their cameras, microphones and AI functions can bring existing privacy and data protection rules into play.
The rules are more nuanced than saying that nobody can ever photograph another person without asking first. Luxembourg's rules on the right to one's image distinguish between targeted and non-targeted photographs. If someone is the main subject of a photograph, consent is generally required. If a photograph simply captures the general atmosphere and nobody is the main subject, informing the people concerned is generally enough.
That distinction is easy enough to understand with an ordinary camera. If someone asks you to pose for a photograph, you know you are the subject. If you happen to appear in the background of a photograph of Place d'Armes, the situation is different.
Smart glasses make that distinction much less obvious from the other side of the lens. If the person at the next table looks towards you, you have no easy way of knowing whether they are photographing the square and you happen to be in the picture, or whether you are the reason they are taking the picture at all.
There is a separate layer of law when the recording involves personal data. The CNPD says that images allowing people to be identified are personal data and that using smart glasses to record people in public can fall within the GDPR. It also warns that a private person wanting to record public spaces with smart glasses may find it particularly difficult to establish the legal basis required for that processing.
Perhaps more interestingly, the CNPD identifies exactly the problem with the little recording light. Under the GDPR, people whose data is being processed generally need to be informed clearly about what is happening. With smart glasses, the CNPD says fulfilling that obligation can be difficult or even impossible because people nearby may not be able to distinguish them from ordinary glasses and may not realise that images or sound are being recorded.
So the light helps, but it does not solve the problem. Even if you notice it, it does not necessarily tell you what is being recorded, where the information is going or what will happen to it afterwards.
Luxembourg law is stricter in places that are not accessible to the public. The country's 1982 privacy law can make intentionally observing someone with a device, without consent, in such a place a criminal offence. A café terrace is normally accessible to the public, so recording there does not automatically fall into that category. The legal position can be very different once someone takes the same technology into a genuinely private space.
Someone whose image has been misused may be able to ask for its deletion, complain to the CNPD or bring legal proceedings. Luxembourg also protects the right to one's image, independently of the GDPR, and the CNPD points to civil remedies for people whose rights have been infringed.
Those remedies are important, but smart glasses create a practical problem that law cannot easily solve after the event. The person being recorded first has to know that a recording exists and have some idea who made it or which service received it.
Finding an individual wearer afterwards may be difficult or impossible. That makes the safeguards built into the glasses and the services behind them more important. Providers can limit what is sent to the cloud, how long information is retained and whether recordings are subsequently used for other purposes. Regulators also need practical ways to verify that those protections work.
There are plenty of legitimate reasons to use smart glasses. They can translate text, provide navigation, assist people with disabilities, take photographs without occupying someone's hands and eventually do things that we have not thought of yet. A ban would throw away those benefits along with the risks.
Luxembourg has instead chosen to rely on laws broad enough to cover new technology. That avoids rewriting the rules every time a camera appears in a new device.
The harder question is whether those laws can protect someone who never discovers that anything happened.
Camera phones placed cameras in everyone's pockets. Smart glasses could place them on millions of faces and connect them directly to AI. The camera is familiar. The possibility that an ordinary glance can become data collection is not.
