The Meta Glasses File: A Test Case the AI Act Was Not Quite Built For

The call, this week from Berlin, is straightforward: ban Meta's camera-equipped glasses before they settle onto German faces at scale. Rights groups have joined the chorus; data protection authorities have hinted, in that particular register regulators use when they wish to be heard without yet being quoted, that consumer risk is real. The political mood is clear. The legal instrument is less so.

Start with what the texts actually say, because the texts are where this file will be won or lost. The AI Act, whose obligations for general-purpose and high-risk systems began phasing in from August 2025, does not contain an article headed 'smart glasses.' It contains Article 5, which prohibits certain practices, including real-time remote biometric identification in publicly accessible spaces, subject to exceptions member states fought bitterly over during the 2023-2024 trilogue. Whether a consumer wearable that streams video to a model capable of recognising faces falls inside Article 5 or merely near it is the question every compliance officer in Munich, Paris and — this matters — Dubai is now asking her outside counsel.

The GDPR, meanwhile, has been sitting quietly with the answer since 2018. Article 6 requires a lawful basis for processing personal data. A bystander filmed on a Berlin U-Bahn platform has consented to nothing. The Hamburg data protection authority made this point about an earlier generation of camera glasses more than a decade ago; the legal analysis has not changed, only the processing power behind the lens.

So why the appetite for a fresh ban? Because enforcement is the test, and GDPR enforcement against a consumer device worn by millions of individuals is a nightmare no supervisory authority wants to own. You cannot fine a tourist. You can, in principle, restrict a product. This is the move rights groups are pushing: use the AI Act's market surveillance architecture, or the General Product Safety Regulation, to keep the device off shelves rather than chase its wearers through administrative proceedings that will never scale.

Which brings us to the institutional choreography. The Commission proposes and, on AI Act implementation, coordinates through the AI Office established last year. But the operative power to restrict a product on the internal market sits with national competent authorities acting under Chapter VII of the AI Act, with the Commission empowered to intervene where a national measure raises Union-wide concerns. Germany moving alone would set a precedent. Germany moving with France and the Netherlands would set a policy. So far, only Berlin has moved.

The compromise history matters here. During the AI Act negotiations, it was France that pushed hardest to preserve law-enforcement exceptions to the biometric identification ban, and a group led by the Greens and several liberal delegations in the Parliament that pushed hardest to narrow them. The final text is a truce, not a doctrine. A consumer wearable that performs, in effect, ambient biometric processing is exactly the case the truce did not resolve. Expect the Council's Telecommunications and Information Society working party to receive an agenda item it did not ask for.