On September 2, 2026, lawyers amended the federal class action against Meta over its Ray-Ban AI glasses to add a new group of plaintiffs: people who never bought, wore, or asked to be near the device at all. Read only the wearer's side of that transaction and Meta's compliance story looks intact. A buyer sets up the glasses, accepts a policy, and a small light blinks when the camera is recording. Apple's always-listening Watch features and pendant recorders from startups like Limitless work the same way: one consent screen, one person, one signature standing in for everyone the device will ever point at.
It is worth slowing down on that. Strip out the wearer's own consent and look at who is left standing in front of the lens: the colleague across the table, the barista, the stranger on the train. Under India's Digital Personal Data Protection Act, 2023, lawful processing turns on consent from the "Data Principal," and the law defines that consent as free, specific, informed and given through a clear affirmative action. That machinery describes the wearer. It has no clause for the person standing next to them. The gap is not a drafting oversight still waiting to be closed: India's implementing DPDP Rules, 2025, notified by the Ministry of Electronics and Information Technology on November 14, 2025 and described by the government as giving the Act "full effect," build out citizens' rights of consent, access, correction, erasure and nomination entirely around the Data Principal, with no bystander or third-party mechanism added at the rulemaking stage either.
That is what turns a design gap into a live problem rather than a hypothetical one.
The law only sees the wearer
This is not a gap unique to India. Under the EU's General Data Protection Regulation, in force since May 2018, a bystander's voice or image becomes personal data the moment they are identifiable, regardless of whether they agreed to being recorded. That is real protection on paper: the recording is regulated, not exempt. But recognizing bystander data as protected is not the same as giving the bystander a way to consent, object, or even know in the moment. GDPR names the interest without building the mechanism.
No wearable-era privacy law gives the bystander a consent step of their own.
| Law | Whose consent it requires | Bystander mechanism |
|---|---|---|
| India's DPDP Act, 2023 (Section 6) | The Data Principal, the person whose data is processed | None |
| EU GDPR (Recital 26) | Confirms bystander data is protected once identifiable | Protected status only, no consent step |
| California SB 1130 (enrolled Sept. 4, 2026) | Any other identifiable person in a place of business | Explicit consent required; recording light cannot be disabled |
Source: MeitY, DPDP Act 2023; EUR-Lex, GDPR Recital 26; California Legislature, SB 1130.
What bystanders want is not what wearers give
The mismatch is not abstract to the people standing in front of these devices. A 2026 study built on a 525-person survey and 20 paired wearer-bystander interviews found that bystanders consistently demand stronger transparency and protection than wearers are willing to provide, a gap that widens in sensitive settings where 65 to 90 percent of bystanders said they would take defensive action against the device. Wearers, surveyed separately, did not report matching discomfort about recording others.
That is a structural mismatch, not a communication problem. No amount of clearer disclosure to the wearer closes it, because the wearer was never the party with the objection.
Regulators have already punished this kind of recording, just not this gap
The idea that a recording made without a subject's meaningful consent can be unlawful is not new. In May 2023, the FTC and the Department of Justice fined Amazon $25 million after finding it retained children's Alexa voice recordings indefinitely and used them to improve its algorithm, undermining parents' deletion requests. That case turned on retention and reuse of a subject who could not meaningfully consent, a child, not a wearer-versus-bystander asymmetry. But the underlying principle, that indefinite retention and reuse of someone else's recorded voice for model training is a live enforcement target, is exactly the exposure now facing wearable makers that route ordinary bystanders' voices and faces into AI systems.
California just wrote the first law for the room, not the wearer
That is the gap California moved to close. SB 1130, enrolled and sent to the Governor on September 4, 2026, would require a wearable device operator to obtain explicit consent before recording any other identifiable person in a place of business where that person has a reasonable expectation of privacy, and it bans disabling the device's recording indicator. It is the first wearable-specific law anywhere in this matrix that puts an affirmative consent requirement on the bystander's side of the transaction rather than the wearer's.
SB 1130 is not entirely alone, but the company it has is narrower. Louisiana enacted Act 965, effective August 1, 2026, making it the first state after California to legislate specifically on wearable recording devices. Its model stops short of SB 1130's: it requires a wearer to notify the other participants in a direct conversation that a wearable eyeglass device is recording, but it explicitly exempts "incidental, unintended, or background capture of individuals or conversations occurring in public places where the videoing and recording are not specifically directed at the individuals," per the enrolled bill text. That is a notice rule for people already in the conversation, not a consent right for the bystander who was never part of it, the exact gap SB 1130 was written to close.
The Meta litigation shows why that distinction now matters beyond the moment of recording. The amended complaint filed around September 2, 2026 argues that even a bystander who notices the glasses and accepts being filmed in the moment cannot have consented to having that footage fed into Meta's AI training pipeline. On-the-spot awareness, the closest thing to consent a bystander currently gets, does not cover what happens to the recording afterward.
The honest objection
The strongest case against a bystander consent requirement is practicality. A rule that makes every recording depend on obtaining "free, specific, informed and unambiguous" consent, in DPDP's language, from every identifiable person nearby would make a public street, a train, or a shop floor impossible to film at all, and one-party consent norms for ordinary recording have coexisted with public life for decades without collapsing it.
That case holds for a single, contained recording. It strains once the data leaves the room. SB 1130 shows the objection is not fatal to the idea, only to a crude version of it: it scopes the requirement to places of business with a reasonable expectation of privacy and substitutes a visible, tamper-proof recording indicator for individual sign-off, which is a workable design, not an unworkable mandate. And the Meta case is arguing a narrower, sharper point than "get consent for the recording": even where a bystander plainly saw the device and accepted being filmed, that awareness cannot extend to consenting that the footage trains a company's AI models. A solvable in-the-moment problem and an unresolved downstream-use problem are being treated as one fight, and they are not.
The Signal
Every consent framework built for this device category, DPDP's Data Principal, GDPR's data subject, Meta's own onboarding screen, was written around a single signer. The hardware has moved faster than that assumption: a wearable that captures a room now ships to millions of people a year while the room itself has no legal standing in the transaction. California's SB 1130 is the first attempt to give it one, and it is still sitting on a governor's desk, not yet law. Watch two things next: whether SB 1130 is signed and whether other jurisdictions, India's DPDP framework included, follow its lead by naming the bystander explicitly rather than leaving them to infer protection from rules written for someone else. Until a law does that, the room is being recorded by consent of exactly one person in it.
Reporting basis: the consent language in India's Digital Personal Data Protection Act, 2023 and the EU's General Data Protection Regulation is drawn directly from the primary statutory text, via the Ministry of Electronics and Information Technology and EUR-Lex respectively. The California SB 1130 provisions are from the bill text as passed by the state Legislature. The bystander-plaintiff expansion in the Meta AI-glasses litigation is per Fortune's reporting on the amended complaint; the underlying court filing itself was not independently reviewed here. The wearer-bystander expectation gap is from a single 2026 arXiv preprint and has not yet been independently replicated. The Amazon Alexa penalty is per the FTC and Department of Justice's joint press release. The 2025 device-sales figures and the year-over-year comparison are per UploadVR's reporting of EssilorLuxottica's disclosed sales data. The claim that the addressable device base roughly quadrupled in about a year is The Signal's calculation from those sales figures. The status of India's DPDP Rules, 2025 is per a Press Information Bureau, Government of India backgrounder on the notified rules. The Louisiana Act 965 provisions are from the enrolled bill text as passed by the Louisiana Legislature.
