AI-enabled wearables blur the line between innovation and surveillance. Using Norway's proposed restrictions on smart glasses, examine whether India's DPDP framework is enough to protect bystander privacy.

Smart glasses combine HD cameras, ambient audio recording and AI in ordinary-looking eyewear. They make possible covert recording and real-time facial recognition of people who never consented [1]. Norway's proposed curbs show one way to respond, and they expose gaps in India's consent-based data law.

Norway's model: regulate the use, not the product

• It proposes a temporary, location-based restriction in places where people expect privacy: schools, playgrounds, healthcare facilities, locker rooms, beaches and museums [1].
• Sales and private use are not banned, which makes it a proportionate, least-restrictive measure [1].
• An expert committee will study the technology before final rules are framed [1].

Strengths of India's DPDP framework

• The DPDP Act, 2023 is fully operational now that the DPDP Rules were notified on 14 November 2025 [2][3]. It rests on the privacy right recognised in Puttaswamy (2017) under Article 21.
• Data Fiduciaries must give standalone, clear consent notices, and requests to access, correct or erase data must be answered within 90 days [2].
• Platforms that store or analyse footage face penalties of up to ₹250 crore for weak security safeguards [2].

Gaps for bystander privacy

• Household exemption: the Act does not apply to processing by an individual for personal or domestic purposes [4]. A wearer recording strangers may fall outside it.
• Consent mismatch: a bystander never receives a consent notice and has no Data Fiduciary relationship with the wearer [2].
• Exemptions: the exemption for publicly available data [4] and the broad "legitimate uses" and government exemptions [5] weaken protection against facial recognition.
• No place-based rules: the law has no device-specific or location-based restrictions, and its 18-month phased compliance delays enforcement [2].

Way forward

• Sectoral rules for sensitive places such as schools, hospitals and changing rooms, following Norway's approach [1].
• Privacy-by-design in devices, such as visible recording indicators and limits on facial recognition, enforced through manufacturers.
• A MeitY expert committee on AI wearables, with stronger protections in child-related places.

India's DPDP framework is a strong base for privacy against organisations, but it was not built for one individual recording another in public. Combining it with Norway-style place-based restrictions and privacy-by-design rules would protect bystanders while still allowing innovation, in line with the dignity guaranteed by Article 21.