Do smart glasses that use facial recognition breach the Privacy Act in Australia?

When AI-enabled smart glasses perform real-time facial recognition, they are not merely taking a photograph. They are generating and processing biometric data. Under Australian privacy law, that distinction has significant legal consequences.

1. Facial Geometry Data Is Likely Sensitive Information

The Privacy Act 1988 (Cth) defines “sensitive information” to include biometric information that is to be used for the purpose of automated biometric verification or biometric identification. Facial geometry data, the mathematical representation of a person’s facial features extracted for identification purposes, falls squarely within this definition.

Sensitive information attracts a higher consent threshold than ordinary personal information. Under Australian Privacy Principle 3.3, an APP entity must not collect sensitive information about an individual unless:

• The individual consents; and
• The collection is reasonably necessary for one or more of the entity’s functions or activities.

For a business deploying smart glasses that perform real-time facial recognition of customers, this means obtaining explicit, informed consent before collection. Implied or passive consent, such as walking onto a premises, is unlikely to be sufficient for sensitive biometric data.

2. Who Does the Privacy Act Apply To?

The Privacy Act applies to APP entities: Australian Government agencies and organisations with an annual turnover greater than $3 million, as well as health service providers and certain other operators regardless of turnover.

Critically, individuals using smart glasses personally for their own social use benefit from the personal, family or household affairs exemption in section 7B(1) of the Act. That exemption disappears the moment a business deploys the same technology for staff monitoring, customer analytics, or quality assurance.

3. Full APP Obligations for Business Use

A business deploying smart glasses for any commercial purpose must comply with all applicable Australian Privacy Principles, including:

• APP 3: Collection limits and consent requirements, with the higher threshold for sensitive biometric data;
• APP 5: Notification obligations at or before the time of collection;
• APP 6: Use and disclosure restrictions, requiring a separate lawful basis for secondary uses such as training AI models on captured footage;
• APP 8: Cross-border disclosure obligations if footage is processed by AI agents running on overseas servers; and
• APP 11: Security obligations, and mandatory destruction or de-identification once data is no longer needed for the purpose of collection.

4. The Notifiable Data Breaches Scheme

If a business suffers a data breach involving smart glasses footage that includes facial geometry data, the higher sensitivity of that data increases both the likelihood that the breach meets the “eligible data breach” threshold under the Notifiable Data Breaches scheme and the severity of the mandatory notification obligations to affected individuals and the Office of the Australian Information Commissioner.

5. The Illinois Benchmark

For businesses with US operations, Illinois’ Biometric Information Privacy Act (BIPA) requires written notice of collection, the collection purpose, and retention period, together with a written release, before any biometric identifier is collected. No equivalent statutory instrument currently exists in Australia, but BIPA has generated billions of dollars in class action settlements and is widely viewed as the likely direction of future reform in common law jurisdictions. A business building its data governance practices to BIPA standard would comfortably exceed current Australian requirements.

Related Topics

• Smart Glasses, Cameras and the Death of Ambient Privacy
• Are smart glasses legal to use in Queensland?
• Can a business ban smart glasses on their premises?
• What is the federal privacy tort for serious invasions of privacy?
• What are my legal obligations following a data breach?

Need advice on Privacy Act compliance, biometric data governance, or smart glasses deployment policies? Call Bell & Senior Lawyers at (07) 5532 8777 or contact us online .