Hamburg’s data protection authority put a hard line under Ray-Ban Meta AI Glasses today. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) published a final technical and legal review of the Ray-Ban Meta Wayfarer (Gen 1) dated September 10, 2026 — and the conclusion is blunt: recording bystanders outside a wearer’s close circle will rarely be lawful under the GDPR, and Meta’s AI training on that bystander data typically has no legal basis at all.
The 53-page package is not a consumer tip sheet. An interdisciplinary HmbBfDI team tore down the hardware, inspected companion-app traffic and local storage, filed Account Center access requests, then mapped the findings onto GDPR Articles 6, 9, and 26. PPC Land’s same-day write-up walks the technical spine; the regulator’s own English final report and German original are the primary sources.
The LED is not transparency
The report’s sharpest hardware finding is the outward recording indicator. Investigators say the white LED is not a reliable notice to bystanders. Visibility collapses with distance, angle, and daylight. On Gen 2 units, the LED does not light at all when the wearer is only talking to Meta AI about the scene — as opposed to explicitly shooting photo or video. On Gen 1, AI interactions keep the LED dim compared with a brighter flash on a still capture.
Covering tests cut deeper. Meta’s safeguard that kills the camera when the LED’s light sensor is blocked can be defeated with certain stickers or paint that still leak enough ambient light to the sensor. During video, the covered-LED check runs at start only; covering after recording begins lets the clip continue dark.
That matters because consent under Article 6(1)(a) needs a clear prior signal. A 2025 CJEU bodycam ruling the report cites requires essential facts at the moment of collection. A dim, situational LED does not clear that bar — a point Hamburg commissioner Thomas Fuchs already previewed in his August 11 Tagesspiegel Background essay on public-space privacy and smart glasses.
Wearers are controllers. Training makes Meta a joint one.
Where the glasses pick up an identifiable third party — face, badge, distinctive clothing, or a named discussion with Meta AI — the wearer is treated as a data controller for that processing. The household exemption under Article 2(2)(c) does not stretch to public-transit AI capture or Instagram publishing; Ryneš, Lindqvist, and Buivids are the CJEU anchors the report uses.
Legitimate interest under Article 6(1)(f) fares little better for everyday scenes. The three-part balancing test usually favors the bystander when recording can be covert relative to a raised smartphone. The report carves a narrow, case-by-case path for visually impaired users — not a blanket carve-out.
AI training changes the math entirely. With Meta’s EU “Flywheel” opt-out regime in place since May 27, 2025, bystander data can leave the wearer’s personal sphere and enter model development. The report concludes that when training is on, wearer and Meta become joint controllers under Article 26 for third-party training data — and that neither consent nor legitimate interest realistically justifies that pipeline for people who never opted into anything. Hamburg distinguishes this from Cologne’s May 2025 ruling on public Facebook/Instagram posts by registered adult users: platform relationship, notice campaigns, and deliberate publication are missing when a stranger is scooped up on a sidewalk.
Facial recognition: schema present, feature off — for now
Inside the Meta AI Android package com.facebook.stella, investigators found a StellaDatabase with empty tables named face, face_group, and related pairings — infrastructure that looks built for recognition, but inactive in their build. Object-level face masking for local storage is not the same as biometric identification under Article 9.
That finding sits next to June 2026 EFF/WIRED reporting that a face-ID path briefly existed and was later patched. Hamburg’s lab result and the earlier exploit report can both be true across different software builds. If identifying recognition ever returns, Article 9’s special-category rules slam shut on both wearer and Meta.
Why XR watchers should care
This lands in the same week Meta is pushing AI glasses onto Best Buy’s Meta Lab floors and rivals are racing display-equipped frames. The product category’s growth story still assumes a soft LED and an AI chat that can describe the room. Hamburg’s answer is that the legal risk sits with the person wearing the frame — and with Meta whenever training is in the loop — not with a vague “the light was on” defense.
Fuchs has already pointed at Germany’s Section 8 TDDDG and the Federal Network Agency for devices designed to record unnoticed while disguised as everyday objects. Today’s report is the technical evidence pack behind that argument. For anyone shipping camera glasses into the EU, the design homework is no longer optional: notice that bystanders can actually see, and a training story that does not quietly eat other people’s faces and voices.
Sources: HmbBfDI announcement (Sep 10, 2026); English final report PDF; German final report PDF; PPC Land; Fuchs / Tagesspiegel Background (Aug 11, 2026).