Türkiye’s Personal Data Protection Authority (KVKK) has not issued a decision on smart glasses. What it has done is publish guidance: the May-September 2026 issue of the KVKK Bulletin (No. 12, “Smart Devices and Digital Privacy”, published 29 September 2026) carries a two-page section on protecting personal data when using smart glasses, and reports the French regulator CNIL’s warning of 11 May 2026. Since then the European Data Protection Board (EDPB) has adopted a statement on smart glasses, on 13 October 2026, that goes further and addresses manufacturers and AI providers directly. This note sets out what the three documents say, how Turkish law already applies to camera glasses, and what companies, event organisers and device makers should do now.
What the KVKK Bulletin says
The section is written for users rather than companies. Its starting point is that smart glasses can record images, sound and other data, so the privacy of people nearby matters as much as the wearer’s. The recommendations:
- do not record where people do not expect or accept recording, and switch recording off where phone cameras and recorders are restricted;
- keep the scope and duration of any recording to what is needed, and delete recordings that are no longer required;
- remember that the microphones can pick up nearby conversations without anyone noticing, and that the glasses may also process location, date, time and usage data;
- configure the device’s privacy and security settings and review them regularly;
- before sharing photos or videos that show other people, assess the effect on them and obtain their consent where needed;
- recording or sharing may give rise to civil or criminal liability depending on the facts.
The bulletin’s “developments” section summarises CNIL’s 11 May 2026 call for vigilance: tell people around you that the glasses are in use, switch recording off when it is not needed, switch the glasses off wherever phones must be switched off, avoid wearing them where people would not expect it, and get consent before publishing footage of others. CNIL also announced an action plan and said it would take the subject to the EDPB.
The EDPB statement of 13 October 2026
The EDPB’s statement is the first European text that treats smart glasses as a product-design problem, not only a user-behaviour problem. Its main positions:
- The household exemption is narrow. Purely personal use falls outside the GDPR, but publishing footage, or wearing the glasses in a professional, commercial or political setting, can make the wearer a controller.
- Manufacturers and AI or app providers can be controllers for what they process, and they cannot rely on the user’s conduct to discharge their own duties, including transparency towards bystanders.
- Transparency needs technical form: visual and audio indicators that are hard to cover or disable, proximity alerts, and design that distinguishes smart glasses from ordinary eyewear.
- Legal basis must exist before recording: consent obtained after the fact is not valid, and legitimate interest is hard to justify for commercial reuse or AI training that bystanders would not expect.
- Minimisation by design: limit continuous recording and live streaming, process on the device where possible, blur or pseudonymise bystanders before sharing, keep persistent storage off by default where the purpose is real-time assistance, and use geofencing for sensitive locations.
- Facial and voice recognition in combination with smart glasses is flagged as a serious concern; children and settings such as hospitals, schools, changing rooms and workplaces call for particular caution.
Turkish companies selling into the EU, or building apps for these devices, should read the statement as a design brief. The Turkish market will follow it in practice, because the same devices and apps are sold here.
How Turkish law applies today
| Situation | Rule |
|---|---|
| Wearer records family at home | Outside Law No. 6698: Art. 28(1)(a) exempts processing by a natural person for activities concerning only themselves or family members in the same household, provided the data are not given to third parties and security obligations are observed. |
| Wearer records strangers in the street, a shop or an office | The exemption no longer fits comfortably. The wearer processes the personal data of identifiable people and needs a basis under Art. 5 (explicit consent, or one of the Art. 5(2) grounds). Legitimate interest under Art. 5(2)(f) applies only where the fundamental rights of the person recorded are not harmed. |
| Footage is published or shared | Publishing takes the activity outside Art. 28(1)(a) altogether. Criminal law also applies: Art. 134 of the Criminal Code punishes violation of the privacy of private life with one to three years’ imprisonment, doubled where the violation is by recording images or sound, and unlawful disclosure of such images or sound with two to five years. Prosecution of the Art. 134 offence depends on a complaint (Art. 139). |
| Face or voice recognition features | Biometric data are special category data under Art. 6(1). Processing is prohibited unless one of the Art. 6(3) grounds applies, explicit consent being the realistic one for a consumer product. Identifying passers-by has no basis. |
| Company issues glasses to staff (field service, warehouse, retail) | The company is the controller. It owes the employee and every customer or visitor a notice under Art. 10, needs an Art. 5 basis, must apply proportionality and must secure the data (Art. 12). The Board’s approach to workplace cameras, biometrics and monitoring of work communications applies by analogy: no covert or continuous recording, a documented purpose, limited access. |
| Manufacturer or app developer serving Turkish users | Controller for cloud processing, AI features and analytics: notice, legal basis, data security, and the rules on transfers abroad and, where thresholds are met, VERBİS registration. |
Three practical questions
Can a venue ban smart glasses? Yes. The bulletin itself tells users to switch recording off where cameras are restricted. A hospital, courtroom, school, gym, co-working space or conference may set house rules, and the EDPB expects such settings to be treated with particular caution. The rule should be visible at the entrance and applied to all recording devices, not to one brand.
Does the wearer need consent from everyone in view? Not for every glance, but the data protection analysis starts the moment an identifiable person is recorded and stored. Where the glasses are used for assistance only, with no storage, the risk is low; where footage is kept, analysed or shared, consent or another basis is needed, and the person recorded can object and ask for deletion under Art. 11.
What should an employer do before issuing glasses? Define the purpose, switch off features that are not needed (continuous capture, cloud upload, face recognition), issue a privacy notice to staff and a visible notice to customers, set retention, restrict access and log it, and keep the device policy in writing. Our notes on the Board’s proportionality test and on workplace wearables before the Court of Cassation set out the tests the Board and the courts apply.
Where to start
- Companies: add smart glasses to the device and visitor policies; decide whether they are allowed in offices, stores and events, and how customers are told.
- Employers issuing glasses: purpose statement, privacy notice to staff, customer-facing notice, disabled features list, retention period, access log.
- Event organisers: a line in the participation terms and signage at entry; a rule for speakers and press.
- Developers and importers: on-device processing by default, recording indicator that cannot be covered, no face recognition of third parties, transfer-abroad and VERBİS analysis, a notice that reaches bystanders, not only the buyer.
- Everyone: treat the KVKK Bulletin as the Board’s current expectation. The next step after guidance is usually a complaint and a decision.
Frequently asked questions
Has KVKK issued a decision on smart glasses?
No. As of October 2026 there is no Board decision or principle decision. The Authority’s position is in the KVKK Bulletin No. 12 (May-September 2026), which gives recommendations to users and reports CNIL’s warning.
Is recording with smart glasses in public legal in Türkiye?
It depends on what is recorded and what is done with it. Recording identifiable people and keeping or sharing the footage is personal data processing under Law No. 6698 and needs a legal basis; recording private life or disclosing such recordings can be an offence under Art. 134 of the Criminal Code.
Can my company prohibit smart glasses in the office?
Yes. A workplace or venue may restrict recording devices. The KVKK Bulletin tells users to switch recording off where cameras are restricted, and the EDPB expects workplaces to be treated with particular caution.
Does the EDPB statement bind Turkish companies?
Not directly. It binds no one as such, but EU supervisory authorities will apply it, so it matters to Turkish manufacturers, app developers and companies serving EU users, and it is the most detailed statement of regulatory expectations available today.
Sources. KVKK Bulletin No. 12, May-September 2026, “Smart Devices and Digital Privacy”, pp. 20-21 and 24-25; KVKK, Selected Current Developments, 9 October 2026; CNIL, “Les lunettes connectées : la CNIL appelle à la vigilance”, 11 May 2026; EDPB, Statement on smart glasses, 13 October 2026; Law No. 6698 on the Protection of Personal Data, Arts. 5, 6, 10, 11, 12, 28; Turkish Criminal Code No. 5237, Arts. 134, 139.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Monitoring Employee Email in Türkiye: KVKK Principle Decision 2026/2035 and the 16 Rules for Employers
October 9, 2026Can You Answer a KVKK Data Subject Request by Phone? The Authority's 1 October 2026 Announcement
October 1, 2026The Medium-Term Programme Puts a Date on KVKK-GDPR Alignment: What Changes for Compliance Programmes Caught Between Two Laws
September 8, 2026The EU Data Act for Turkish Companies: Connected Products, Cloud Switching and the September 2026 Design Deadline
October 15, 2026Feeding Company Data to a Model: KVKK Basis, Transfer Abroad and the Trade Secret You Just Uploaded
October 5, 2026The Data Processing Agreement Under KVKK: How It Differs from GDPR Article 28 and What to Put in the Annexes
October 2, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →