Norway plans a temporary AI glasses ban: proposal, not law, with wider privacy lessons

What Norway has announced

The proposed measure would regulate use in particular places rather than impose a total ban on buying, owning or privately using AI glasses. The government says use could remain possible where other people are not at risk of being recorded without consent.

The technology boundary is still open. The government will consider whether the measure should cover glasses with cameras and microphones, glasses that combine cameras with AI functions, or a wider category of body-worn technology using cameras, audio recording or AI.

Possible exceptions are also part of the policy. The announcement says vulnerable groups and socially beneficial uses may be exempted in defined cases. That matters because the same technology can create serious surveillance risks while also assisting people with visual impairment, dementia or other accessibility needs.

The government intends to return to the Norwegian Parliament with a bill as soon as possible. Until a bill is published and enacted, businesses should not describe the proposed ban as binding law or assume that its final scope will match every example in the announcement.

Existing Norwegian rules still apply

In an official parliamentary answer dated 2 October, the Norwegian digitalisation minister said that existing technology-neutral rules already cover privacy, confidentiality, information security and criminal law. He also said Norway is working to implement the EU AI Act into national law. The new announcement seeks an additional device or place-specific measure; it does not displace those existing regimes.

Norway's Data Protection Authority explains that camera recordings processed by businesses are subject to the general data protection rules. A legitimate interest in surveillance must outweigh the privacy rights of those affected, and alternatives should be considered. Its guidance says audio surveillance is so intrusive that it is normally not permitted, and that concealed recording of other people's conversations may also be criminal.

Those propositions do not mean that every photograph taken by an individual is unlawful. The applicable analysis depends on who determines the purpose and means of processing, whether the activity is genuinely personal or household, what happens to the recording and whether it is disclosed to a provider or wider audience. Product architecture can change that answer, especially where cloud processing, analytics, identity matching or model improvement occur.

What this means in the UK

Norway's proposed law would be national. It would not create a UK prohibition. The UK position continues to turn principally on the UK GDPR, the Data Protection Act 2018, surveillance rules, confidentiality, criminal law and the facts of each use.

On 17 September, the Information Commissioner's Office addressed smart glasses directly. It said the personal or household exemption can apply where individuals use personal data only for their own private activities. Publicly sharing recordings is unlikely to remain within that exemption. The ICO also stressed that smart glasses raise issues beyond data protection, including public expectations, safety by design and the responsibilities of developers, sellers and users.

For organisations, the ICO's portable surveillance guidance is more concrete. It calls for recording only where people would reasonably expect it, giving notice where possible, securing the device and storage, minimising footage, and considering the effects on rights and freedoms through a data protection impact assessment before use. The guidance is under review following the Data (Use and Access) Act, so businesses should check for updates rather than freezing their compliance position at today's wording.

A photograph or voice recording can be personal data where a person is identifiable. It does not become special category biometric data merely because it shows a face or contains a voice. The stricter biometric regime is engaged when specific technical processing is used for unique identification, such as facial or voice recognition.

The EU AI Act does not ban the device as a category

The EU AI Act regulates systems and practices according to function, intended purpose and risk. It does not impose a general ban on every pair of glasses that combines a camera, microphone and AI.

Specific functions can nevertheless trigger important rules. Article 5 prohibits defined practices including untargeted scraping of facial images to create or expand facial-recognition databases, biometric categorisation used to infer certain sensitive attributes, emotion recognition in workplaces and educational institutions subject to limited medical or safety exceptions, and tightly limited real-time remote biometric identification by law enforcement in publicly accessible spaces.

Article 50 creates separate transparency duties. Where an emotion recognition or biometric categorisation system is lawfully deployed, exposed people must be informed of its operation, subject to the legislation's stated law-enforcement exception. Data protection law continues to apply alongside the AI Act.

The GDPR separately requires a lawful basis, transparency, purpose limitation, data minimisation, security and respect for individual rights. A data protection impact assessment is expressly required for systematic large-scale monitoring of publicly accessible areas and more generally where processing is likely to create a high risk. Whether a particular wearable deployment meets those thresholds depends on scale, context, features and use.

Practical actions for wearable AI providers

1. Create a jurisdiction and location matrix. Identify where recording, audio capture, biometric recognition and AI analysis may be used, and where schools, workplaces, healthcare premises, events or changing facilities impose additional restrictions.
2. Separate the functions. Treat capture, live streaming, storage, transcription, scene analysis, face recognition, voice recognition and model training as distinct processing operations with their own purposes, roles, legal bases and controls.
3. Make recording perceptible. Use a clear, persistent indicator that cannot be quietly disabled, and provide an accessible way for people who cannot see a visual cue to understand that capture or analysis is active.
4. Minimise by default. Prefer local processing, short buffers, narrow fields of view, user-triggered capture, prompt deletion and no default cloud retention where the use can work without broader collection.
5. Keep biometric recognition off by default. Do not treat ordinary image capture as permission to identify people, infer protected attributes or build a recognition database.
6. Complete a DPIA before high-risk deployment. Test necessity, proportionality, bystander expectations, children and vulnerable people, sensitive locations, audio capture, misuse, safeguard bypasses and less intrusive alternatives.
7. Design for restricted places. Give enterprise customers enforceable administrator controls, location or mode restrictions, event logs and a rapid disable mechanism. Geofencing can support compliance but should not be the only safeguard.
8. Preserve accessibility routes. Document how any exception for assistive or socially beneficial use will operate without becoming a general route around privacy controls.
9. Contract for the full data path. Allocate controller and processor roles, cloud purposes, model improvement, sub-processors, international transfers, retention, security incidents, government requests, deletion and evidence access.
10. Track the Norwegian bill. Update product rules only when the published text clarifies the devices, places, exceptions, offences, enforcement body, sanctions and commencement date.

The compliance conclusion

Norway's announcement is a significant policy development because it moves the smart-glasses debate towards a place-specific statutory restriction. It is not yet a legal ban, and the details remain open.

The wider direction is nevertheless clear. Wearable AI providers should expect general data protection and AI rules to be supplemented by national rules for particular devices, functions and sensitive locations. The durable compliance response is not a single consent screen. It is a product that can show when it records, minimise what it captures, restrict higher-risk functions and prove where and how each feature was used.