This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An investigation by Swedish newspapers revealed that Meta's AI smart glasses, through their visual query feature, have been capturing intimate and private user imagery—including bathroom visits and sexual activity—which is then sent to human subcontractors in Kenya for manual review and AI training. Users are often unaware that the camera has been activated, and Meta's terms of service mandate this human review process without an opt-out mechanism. This practice has raised significant privacy concerns regarding the lack of transparency and the potential for sensitive data exposure.
Meta AI smart glasses reportedly captured intimate images and video through their visual query feature, including material allegedly recorded when users did not intend to activate the camera. According to a Swedish investigation, some of this content was later viewed by subcontracted human reviewers in Kenya, exposing highly private moments from users' homes and daily lives.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The AI system's wake-word detection and context-inference capabilities are not robust, leading to frequent accidental triggers and unintended recordings.
The AI system captures and transmits highly sensitive, non-public personal imagery and information (such as intimate activities and financial cards) to third-party contractors without explicit user consent or opt-out options.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk is triggered by the AI system's accidental activation and subsequent processing of unintended visual data post-deployment.
Added categories peak at 2: Minor (Psychological Harm, Direct)
Meta's smart glasses accidentally captured and transmitted highly intimate user imagery and sensitive data to subcontractors in Kenya for manual review. While constituting a significant privacy violation and regulatory challenge under GDPR, the incident presents minor national security implications, primarily limited to individual data exposure and localized privacy risks.
The AI system functions as an assistant, designed to respond to voice commands and augment human capabilities by answering questions, translating text, and identifying objects, but it does not take independent goal-directed actions.
Limited Risk: The system is an AI assistant/chatbot that interacts with users and processes visual/audio inputs, which triggers transparency obligations under the Act to ensure users are aware of when they are being recorded.
The primary function of Meta AI on the smart glasses is to act as a voice-activated assistant that answers queries and describes what the wearer is looking at.
The reports are highly detailed, based on a joint investigative journalism effort with direct testimonies from contractors and technical verification of network traffic. The facts regarding data transmission, lack of opt-out, and contractor exposure to intimate footage are clear and consistent across sources.
None. The privacy compromise is clear and acknowledged in Meta's terms of service, even if they dispute the severity of the filter failures.
Technology
Accidental Voice Activation
Device mishears 'Hey Meta' and captures images/videos without intent.
Imperfect Blurring Algorithm
Face/body blurring algorithm fails in difficult lighting conditions.
Contextual Query Inference Update
Late 2024 update increased accidental triggers during normal conversations.
Data Inputs
Unfiltered Intimate Media
Raw, highly private photos and videos are sent directly to contractors.
Lack of Opt-Out Data Settings
Users cannot disable human review of their AI interaction data.
Live AI Video Captures
Continuous conversation feature captures and uploads full video clips.
Human Factors
User Ignorance of Manual Review
Users are unaware that humans review their private visual queries.
Misinformed Retail Staff
Sales staff falsely reassure customers that data remains entirely local.
Non-consenting Bystanders Recorded
Family members and bystanders are recorded without their knowledge or consent.
Process and Methods
Mandatory Subcontractor Review
Meta relies on cheap offshore labor to manually rate and label AI queries.
Inadequate Data Pre-filtering
No robust automated culling of intimate data before human review.
Buried Privacy Policy Terms
Information about manual human review is hidden deep within terms of use.
Management
Prioritizing AI Model Training
Meta prioritizes rapid AI improvement over user privacy protections.
Punitive Subcontractor Culture
Contractors risk losing jobs if they refuse to label intimate content.
No Opt-Out Mechanism Provided
Management decided not to offer a privacy opt-out unlike competitors.
Regulatory Environment
Lack of EU-Kenya Adequacy Decision
Data transferred to Kenya lacks verified equivalent GDPR protections.
Weak Regulatory Enforcement
Regulators like IMY have not actively reviewed or blocked the device yet.
Unclear Legal Basis under GDPR
No explicit consent is obtained for using user data to train AI models.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
