Check smart glasses GDPR compliance in procurement

Time needed about three hours, spread over two days

The steps

1. Prepare the demo environmentArrange the demo with the vendor, invite IT and legal, connect your laptop to the demo network, and create a test user account on the vendor platform.You should see: Vendor confirms demo scope and provides a test account; your laptop is on the same network and ready to capture traffic.
2. Map sensors and data flowsRequest a live or exported data flow diagram naming sensors, on‑device processing, vendor endpoints and third‑party SDKs, and ask the vendor to run a standard use case while you watch.You should see: Vendor produces a flow map and starts a use case; you see corresponding network activity to the listed endpoints in your capture.
3. Capture and inspect network trafficStart packet capture on your laptop, reproduce the use case (stream, capture image, voice command), stop capture and inspect hostnames/IPs and server certificates or ask the vendor for TLS hostnames.You should see: Your capture shows the endpoints the vendor named and no unexpected third‑party destinations.
4. Test visible and audible recording indicatorsEnable camera and microphone while watching the device for visual and audio indicators, trigger a physical shutter if present, and request the consent log for that session.You should see: An LED or on‑screen icon appears and a consent log entry is produced with timestamp and test user ID.
5. Exercise data subject rights liveUsing the test account, create personal data (photo, audio), then request access and deletion through the app or vendor portal and record timestamps and logs.You should see: The export contains the requested data with metadata; deletion request produces a verifiable log entry and the data is no longer visible in storage endpoints.
6. Request storage and transfer detailsAsk the vendor for written storage locations, retention schedules for each data class, deletion mechanism details, and the legal basis for any transfers outside the EEA.You should see: Vendor provides a retention schedule and lists storage endpoints and transfer safeguards in writing.
7. Review roles and sub‑processor listsObtain a draft DPA, confirm who is controller and processor, and request a current sub‑processor list and the vendor’s process for notifying you of changes.You should see: You receive a DPA draft, an explicit role statement and a sub‑processor list; vendor agrees to provide change notices.
8. Verify security and DPIA evidenceRequest encryption descriptions, firmware/update policies, recent independent security assessments, and a DPIA or DPIA summary; ask the vendor to support your DPIA process if needed.You should see: Vendor provides encryption details, update policy, a redacted assessment or report, and a DPIA summary.
9. Decide and document the outcomeCollect all evidence (PCAPs, logs, DPA, DPIA summary), have legal and IT score the vendor against your checklist, and document remediation items with deadlines or decline to proceed.You should see: A procurement decision record with evidence attached and either a remediation plan with deadlines or a rejection.

How to check smart glasses GDPR compliance

Run six demonstrable checks during the vendor demo and in procurement paperwork: map sensors and data flows; confirm visible and audible recording indicators and consent logs; inspect storage, retention and transfers; secure controller/processor contracts and sub‑processor lists; exercise data subject rights with live logs; and verify security evidence and the DPIA.

If the vendor will not provide live evidence or written commitments for any of these checks, treat the product as not GDPR‑ready.

• Collect PCAPs, consent logs, a draft DPA and a DPIA summary during the demo.
• Record the demo—get permission—and store captures and screenshots for legal review.

Map the device data flows before you trust the demo

Ask the vendor to show a data flow map that names every sensor (camera, microphone, IMU, biometric), specifies what is processed on‑device, lists each endpoint and every third‑party SDK, and identifies which data leaves the device. Verify the map by capturing traffic and matching endpoints.

During a use case—streaming, image capture or voice command—capture network traffic and compare the hostnames and IPs to the flow map. If TLS hides hostnames, ask the vendor to provide server hostnames or a vendor PCAP.

• Require the vendor to list sensors and third‑party SDKs in writing.
• Request hostname lists for servers the device contacts during demo scenarios.

Confirm visible and audible recording indicators and consent

Verify the device shows an unmistakable visible indicator (LED or on‑screen icon) and, where appropriate, an audible cue when camera or microphone are active. Confirm consent is recorded with a timestamp, device ID and user account in audit logs you can inspect.

During the demo, enable and disable camera and microphone functions and watch the indicator. If the device has a physical shutter, inspect its state. Request the consent log entry for the session and verify its fields.

• Deal-breaker: no visible or audible indicator, or indicators described as ‘optional’.
• Require consent logs to be accessible via a secure API or downloadable report.

Inspect storage, retention and international transfers

Get a written description of where each data class is stored (on‑device only, in‑region cloud, or servers in third countries), the retention period for raw recordings, processed data and logs, and the deletion mechanism (hard delete vs logical delete). Ask how transfers outside the EEA are justified.

Upload a test recording tied to your test account, request deletion, and verify removal in the storage endpoint or audit log. Require the vendor to list backups, analytics copies and any third‑party processors that may hold copies.

• Require contractual commitments to deletion timelines and a deletion‑confirmation mechanism.
• Refuse vendors that claim indefinite backups without an auditable retention policy.

Demand clear controller/processor roles and sub‑processor transparency

Before purchase, require a written statement of whether you or the vendor is the data controller, and obtain a draft data processing agreement that includes security measures, breach notification timelines, audit rights and sub‑processor handling.

Ask the vendor to provide a current sub‑processor list and a process for notifying you of changes with a minimum objection window. If the vendor refuses to share a DPA at demo stage, treat that as a red flag.

• Non‑negotiable: a written DPA with explicit roles and audit rights.
• Require a sub‑processor change notice period you can operate with.

Test data subject rights and operability from the device and app

Demonstrate during the demo the exact steps a user takes to access, rectify, download and delete their personal data from the device or companion app, and obtain the audit log entries those actions produce.

Create a test user, capture an image and audio, then request access and deletion via the app or vendor portal. Verify exports include the requested items and metadata, and that deletion removes data from searchable storage and the device UI.

• Do not accept ‘we can delete on request’ without a live demo that results in a verifiable log entry.
• Require portability exports to be machine‑readable (JSON or CSV) and include timestamps and device IDs.

Verify security practices, patching policy and the DPIA

Confirm encryption in transit and at rest, request the vendor’s firmware and security update policy, and ask for a DPIA or a redacted DPIA summary plus an incident response plan with a breach notification timeline compatible with GDPR.

Request proof of TLS for network connections, storage encryption descriptions, a firmware signing process or whitepaper, and a recent independent security assessment or penetration test report. If the vendor will not provide these, score them poorly for operational risk.

• Require a vendor commitment to timely security updates and an explanation of how urgent fixes are applied.
• Insist on a DPIA or DPIA summary and vendor cooperation in your own DPIA process.

What typically fails in demos and how you spot it

Common failures are vague answers instead of live evidence, indicators that fail in normal use, hidden third‑party SDK traffic and rights requests handled only by slow manual processes. You expose these failures with live tests, packet captures and deletion confirmations.

If a capture shows analytics endpoints not on the flow map, if an indicator does not appear when the mic is active, or if a deletion request leaves backups intact, document the mismatch with PCAPs, screenshots and timestamps and require remediation with enforceable deadlines.

• Red flag: vendor promises a firmware fix with no timeline or contractually enforceable commitment.
• Test captures and logs are the most reliable way to expose hidden behaviour.

What you should do next

Use this checklist in your next vendor demo, collect evidence (PCAPs, consent logs, draft DPA, DPIA summary), and run the demo steps below. Only proceed to procurement once legal and IT sign off on the evidence and contractual terms.

Schedule a demo with the vendor that includes a technical contact, your IT person with a packet capture laptop, and legal. Compare shortlisted models using our device pages for Vuzix Shield apps and Ray‑Ban Meta apps and third‑party apps from our apps directory.

• If you need accessibility or translation features, test them separately using our live captions and translation pages.
• Document everything; procurement decisions must be evidence‑based and reproducible.

Where this usually goes wrong

• Vendor refuses network capture or provides only vague endpoint namesVendor unwilling to expose third‑party SDKs or analytics endpoints or fearful of revealing architectureRequest a vendor PCAP, an independent audit report, or refuse to proceed until you get verifiable endpoint information
• Recording indicator does not appear when microphone or camera are activeIndicator is cosmetic, firmware bug, or activation path bypasses the indicatorDemand a firmware‑level fix and a retest; do not deploy if the vendor only promises a future patch with no contractual commitment
• Deletion request appears to succeed but data remains in backups or analytics storesIncomplete deletion workflows and undisclosed copies retained by sub‑processorsRequire detailed retention rules for backups and analytics and contractual deletion obligations with audit rights
• Vendor cannot produce a DPIA or independent security assessmentVendor is early‑stage, lacks compliance maturity, or is hiding weaknessesRequire a completed DPIA and a recent assessment before purchase or choose a vendor with demonstrable security maturity

The checklist

• Prepare the demo environment
• Map sensors and data flows
• Capture and inspect network traffic
• Test visible and audible recording indicators
• Exercise data subject rights live
• Request storage and transfer details
• Review roles and sub‑processor lists
• Verify security and DPIA evidence
• Decide and document the outcome

Frequently asked questions