Smart Glasses and Wearables: Protecting Workplace Information

01 / Capabilities

What can a wearable capture?

Capabilities vary by model. Some devices capture photographs, video, or audio; others collect movement, location, or physiological measurements.^[1][2]

In an office, a recording could include a visible password, a client document, financial information, or a confidential conversation. Public guidance from the Office of the Victorian Information Commissioner identifies credentials and personal, financial, and health information as particular workplace concerns.^[1]

For your own assessment, identify which information could appear in a camera’s view or within a microphone’s range. Consider visitors and contractors as well as employees.

02 / The data path

Recording and uploading are separate steps

Ray-Ban’s documentation states that its Meta glasses can capture photos and videos without being connected to the companion app.^[3] Meta explains that gallery photos and videos can remain on the glasses until they are imported to a phone.^[4]

The practical implication is that blocking a device from office Wi-Fi does not prevent it from recording locally. Network controls can govern traffic that crosses the network; workplace rules must also address capture and subsequent sharing.

When approving a device, establish:

• What is stored on the device.
• Whether information moves to a personal phone or account.
• Which features send information to an external service.
• Who can access, share, retain, or delete the resulting material.

Do not assume every photograph is automatically uploaded or used for AI training. The handling of gallery captures, AI requests, and other features can differ; review the documentation and settings for the actual product.^[3][4]

03 / Indicators

Indicator lights have limits

Some smart glasses use an outward-facing light when capturing photos or videos for the gallery.^[4] Ray-Ban’s current FAQ also distinguishes certain camera-assisted AI functions on newer models that do not activate that light.^[3]

Treat an indicator as information about a particular device and function, rather than a universal assurance that no camera or microphone is being used.

For workplace decisions, focus on approved capabilities and use. The shape of someone’s glasses, ordinary gestures, or the fact that they have begun wearing glasses does not establish unauthorized recording.

04 / Location data

Location information can reveal more than a destination

NSA’s public guidance explains that location information can expose routines, movements, and associations between people and places. It identifies fitness trackers, smartwatches, and other connected devices as relevant sources of exposure.^[5]

Location can be derived through several mechanisms, including cellular, Wi-Fi, Bluetooth, and sensor information. Disabling an application’s location permission does not eliminate every source of location exposure.^[5]

Consider this risk where work involves sensitive facilities, travel, or operational movements. Apply controls appropriate to the work and the device; the needs of an ordinary office may differ from those of a sensitive operational site.

05 / External programs

Paid recording programs need workplace approval

Public recruitment materials show that some companies pay participants to record first-person video for AI and robotics training. For example, Asimov’s recruitment listing describes paid recording with a head-mounted phone of everyday activities, including desk and office tasks.^[6]

That establishes a commercial practice. It does not establish misconduct by the company or its participants.

Stealth recommends requiring organizational approval before employees record work for an outside program. The review should identify the intended tasks, recording areas, people who may appear, information that could be captured, recipients, and retention arrangements.

An employee’s agreement to participate should not be treated as organizational approval to disclose workplace information.

06 / Workplace rules

Set practical rules for your workplace

Public regulator guidance recommends reviewing wearable-device risks and updating recording policies. NIST also recommends documented wireless-device policies, user education, and security assessments.^[1][7]

Stealth recommends the following approach:

1. Define approved uses. Identify who authorizes recording, which devices or features are permitted, and where captured information may be stored.
2. Identify sensitive settings. Decide which rooms, meetings, screens, documents, and work processes need recording restrictions. Communicate those rules before people enter or participate.
3. Cover employees and visitors. Include contractors, vendors, and other visitors in the procedures appropriate to their access.
4. Review the complete data path. Include the wearable, paired phone, account, application, external processing, and storage destination.
5. Explain the rules clearly. Give staff examples relevant to their work and a straightforward way to ask for approval.
6. Account for legitimate needs. Provide a process for reviewing accessibility, medical, safety, and authorized business uses. Assess the relevant capabilities and setting.
7. Maintain approved devices. Assign responsibility for configuration, software updates, access, and periodic review. NIST recommends reviewing configurations and deploying tested Bluetooth software and firmware updates.^[7]
8. Provide a reporting path. Tell staff whom to contact if they believe sensitive information has been captured or shared.

These are operational recommendations. Apply them alongside the legal, employment, privacy, and contractual requirements relevant to your organization.

07 / Reporting

If information may have been exposed

Stealth recommends reporting the concern through your organization’s established IT, security, or privacy process.

Record the time, location, device or application if known, and the type of information that may have been involved. Avoid circulating potentially sensitive footage while trying to report the issue.

The responsible team should assess what was captured, whether it was transferred, who may have received it, and which containment and notification steps apply.