Odette CaplanArtificial intelligence has given new meaning to the phrase "I can see you." As of September 2026, AI-powered smart glasses worn by any stranger around you can silently scan your face, match it to public databases, and retrieve your name, employer, home neighborhood, and social media profiles — all within 60 seconds, without your knowledge. A chain of federal lawsuits, a first-of-its-kind statewide court ban, and urgent warnings from policy analysts confirm what privacy advocates have long argued: the law has not caught up.
What AI Smart Glasses Are Actually Capturing
Ray-Ban Meta smart glasses — the most widely worn AI eyewear in the United States — do far more than take photos on voice command. Their built-in microphones capture ambient conversation continuously. According to Meta's own documentation, voice recordings triggered by the wake word are stored in the cloud by default for up to one year, with no opt-out available beyond manual deletion. Until June 2026, the companion app also contained embedded code for a feature internally known as "Name Tag," which would have enabled wearers to identify any person with a public Meta account simply by looking at them.
Meta quietly removed that code after it was discovered by security researchers. But the underlying hardware capability remains — and third-party tools are already filling the gap. The story that put this reality in front of the public came in 2024, when two Harvard students used Ray-Ban Meta frames alongside the facial-recognition search engine PimEyes and freely available public databases to identify strangers on the Boston subway. Within seconds, they retrieved complete strangers' full names, employers, family members, and home addresses — without speaking a word to anyone.
By September 2026, that experiment has become the template for a mounting crisis. Insurance Journal reported on September 22 that Meta's glasses "have become a lightning rod for growing unease over AI-powered devices," drawing scrutiny from courts, regulators across three continents, and civil liberties organizations including the ACLU. A lawsuit filed this year alleges that contracted human annotators at Meta were shown footage of private individuals changing clothes, using bathrooms, and handling personal financial documents — footage captured by smart glasses and uploaded for AI training.
The Legal Blind Spot That Leaves You Exposed
The United States has no single federal law governing what AI wearable cameras can capture in public. In its place sits a patchwork of state statutes that was written for a different era — and that patchwork has a structural gap at the center.
Twenty states now have comprehensive consumer privacy laws. But as the Atlantic Council analyzed in its 2026 study on smart glasses as "the blind spot in US privacy law," those statutes were built around data collected through websites and mobile apps. Smart glasses are different in kind: they capture data passively, in real time, without the wearer initiating an upload, and without the subject ever interacting with a device. None of the existing federal frameworks — HIPAA, the Children's Online Privacy Protection Act, the Electronic Communications Privacy Act — cleanly applies.
Illinois stands apart. Its Biometric Information Privacy Act (BIPA), the toughest biometric statute in the nation, requires any entity collecting a facial scan to obtain written consent, disclose retention schedules, and give individuals the right to sue for up to $5,000 per intentional violation. Texas and Washington have similar, though narrower, laws. But in 47 other states, and under current federal law, wearing a camera on your face and running live facial recognition on everyone you encounter is, as a practical matter, legal.
The European Union has taken a different path. The EU AI Act — which reached full enforcement on August 2, 2026 — classifies real-time biometric identification in public spaces as high-risk and bans it for most civilian applications. Americans traveling to Europe with their AI glasses face serious legal exposure. At home, they face almost none.
The Scenario That Exposes the Gap: A Real-World Case
Imagine this situation: You are meeting someone for the first time at a coffee shop in Chicago on October 1, 2026. Your date is wearing Ray-Ban Meta smart glasses and has installed a third-party AI companion app that feeds the glasses' live camera output to a commercial facial recognition service.
In Illinois, where BIPA applies, that scan — if stored and processed — constitutes an unauthorized collection of your biometric identifier. You did not provide written consent. The entity collecting your data did not disclose a retention schedule. The law is unambiguous: you have the right to sue for $1,000 per negligent violation or $5,000 per intentional violation per occurrence. In a certified class action with dozens of victims, those numbers scale quickly.
Now move the same scenario to New York City. Under New York law as of September 2026, the identical facial scan triggers no civil cause of action whatsoever. There is no consent requirement for a private individual. There is no disclosure obligation. There are no damages you can seek unless you can prove a separate tort — emotional distress, defamation, or harassment — arising from how the data was subsequently used.
The if/then logic is direct: if you are in Illinois, Texas, or Washington, then unauthorized biometric capture of your face may entitle you to thousands of dollars in statutory damages. If you are in any of the other 47 states, then the same act — the same glasses, the same face-scan, the same database query — gives you almost no legal remedy unless the data is later weaponized to commit an additional crime.
For the person who later discovers their image was uploaded to an AI training server without consent — as alleged in the 2026 lawsuit against Meta — the outcome depends almost entirely on their home state.
What Rights You Actually Have — and What to Do
Even outside the three states with biometric-specific statutes, you retain meaningful protections in specific circumstances.
Audio consent laws are the strongest tool in most states. If a person wearing smart glasses audio-records a private conversation with you without your knowledge, they may face criminal liability under two-party (all-party) consent wiretapping laws in California, Illinois, Florida, Pennsylvania, Maryland, and 13 other states. This protection is separate from biometric law and often easier to establish: it covers the ambient audio captured by the glasses' microphones, regardless of whether facial recognition was involved.
Workplace surveillance carries additional protections everywhere. Federal and state wiretapping statutes, combined with National Labor Relations Act obligations, mean any employer deploying smart glasses to monitor employees without disclosure faces substantial legal risk. For employees who believe they are being covertly recorded on the job, the legal landscape is considerably more favorable than for bystanders in public — a distinction privacy attorneys emphasize in consultations. For a detailed breakdown of employer monitoring rights, see our analysis of Big Brother at the Workplace.
Data deletion rights apply if you live in a state with a comprehensive consumer privacy law. Under the California Privacy Rights Act, Colorado's CPA, and similar statutes in 18 states, you have the right to request that a company delete any personal data it holds about you — including biometric data collected by a third-party facial recognition service. Submitting a deletion request directly to the app provider creates a paper trail and, if the request is denied, a potential basis for regulatory complaint.
Civil harassment and stalking statutes apply when AI glasses are used to systematically follow, identify, and track a specific individual across multiple locations. Several states updated their stalking statutes in 2025 to explicitly include AI-assisted location tracking. If someone is using smart glasses to surveil you over time rather than scanning you once in passing, the legal analysis shifts significantly.
The Federal Trade Commission regulates unfair and deceptive data collection practices and accepts consumer complaints about companies that misuse personal information. If you believe a device manufacturer or app has collected your biometric data unlawfully, filing a complaint at ftc.gov creates an official record and may contribute to enforcement action — particularly as the FTC increases scrutiny of AI data pipelines in 2026.
Before You Look Away
The trending search "you can see everything" captured something real this week: a public catching up with a technology that has outpaced the law. Smart glasses are on millions of faces in the United States. The hardware to scan, identify, and archive the people around you is already in market — embedded in stylish frames, carried into schools, offices, restaurants, and subway cars every day.
The legal protections available to you right now depend heavily on your state, the setting, and how the data was used. That complexity is exactly what makes a consultation with a privacy attorney worthwhile before an incident occurs, not after.
Disclaimer: This article provides general legal information only and does not constitute legal advice. Laws vary by state and are evolving rapidly. Consult a qualified privacy attorney in your jurisdiction for advice specific to your situation.
ExpertZoom connects you with privacy law specialists who can assess your rights under your state's specific statutes. With facial recognition now embedded in consumer eyewear, understanding where the law protects you — and where it leaves a gap — is no longer a hypothetical question.
