What is Australia investigating about smart glasses?
Australia's privacy regulator has opened a formal investigation into the Chinese company behind the HeyCyan app used by several low-cost smart glasses. The inquiry follows an unanswered information request; it is not a finding that a breach or Privacy Act violation occurred.
The short version
- What happened
- The OAIC has opened a formal investigation into Shenzhen Qingcheng Future Technology, whose HeyCyan app supports multiple low-cost smart-glasses products sold through Australian retail channels.
- Who it affects
- Owners need clear information about what leaves the glasses or phone when calls, music and voice-assistant functions are used.
- What remains unproven
- The OAIC has opened an investigation but has not made a determination, established a breach or alleged that any identified person suffered harm.
Keep in mind
The OAIC has opened an investigation but has not made a determination, established a breach or alleged that any identified person suffered harm.
The regulator says Shenzhen Qingcheng did not answer preliminary inquiries, so key facts about data flows, access, storage, retention and security remain unverified publicly.
The OAIC has not identified facial-recognition capability in smart glasses then available on the Australian market.
Kmart, BDI Technology, Meta and Google were part of preliminary inquiries, but the OAIC has not opened the same formal investigation into those entities or concluded that they were non-compliant.
Retail listings can change; the regulator's named sales channels establish distribution observed during its inquiries, not current stock at every seller.
Source analysis · 2 linked sources. Primary analysed source date: 7 October 2026.
Read the full report · 7 min The evidence, methods, implications and limitations
The regulator is investigating the software provider, not announcing a proven breach
Australia's Office of the Australian Information Commissioner has begun a commissioner-initiated investigation into Shenzhen Qingcheng Future Technology, the China-based company behind the HeyCyan phone application. The app supplies software used with several lower-cost smart-glasses products, including Kmart's Anko-branded glasses and products offered through Big W Marketplace, Amazon and other retailers. The regulator says the app is required for functions including calls, music and a voice assistant, with information gathered through the glasses collected by the app for processing.
The announcement does not say that the company suffered a data breach, unlawfully recorded anyone or violated the Privacy Act. It establishes an inquiry into practices, procedures and systems. That distinction matters for users, bystanders and retailers: a formal investigation gives the regulator compulsory information-gathering powers, but evidence still has to be collected and tested before any determination, remedy or penalty application could follow.[1][2]
Five organisations were asked how recording, access and storage work
The OAIC says it had monitored smart-glasses deployment since early 2026. After correspondence from Australia's Attorney-General in August, it issued preliminary inquiries from 12 August to entities involved in hardware, retail and software. The regulator's account identifies Kmart and BDI Technology as retailers, Shenzhen Qingcheng as a software provider, Meta as a manufacturer and software provider, and Google as a company planning glasses and underlying software. The questions covered what the devices record, who has access to the resulting information and where it is stored.
Shenzhen Qingcheng did not respond, according to the regulator. Privacy Commissioner Carly Kind said that left her without assurance that Australians' personal data was being protected as the Privacy Act requires. The investigation was opened so the OAIC could use its full powers, including compulsory notices. That rationale is procedural: non-response and third-party concerns justify closer scrutiny, but they do not establish what data was collected, whether it left Australia, whether security failed or whether any individual suffered harm.[1][2]
The legal responsibility may sit with the entity holding the information
The Commissioner's accompanying analysis explains why a product's supply chain complicates accountability. Selling or manufacturing a recording-capable device does not automatically mean an organisation holds the personal information captured through it. The entity running the software or storage service may be the party collecting and holding the information, and therefore the party subject to relevant Australian Privacy Principles. Retailers may still face reputational expectations and should conduct due diligence, but the regulator has not treated every company in the chain as legally equivalent.
The OAIC wrote separately to retailers of devices using HeyCyan and urged them to consider whether continued sale was appropriate. It also contacted the Australian Retailers Council about privacy risks in connected and surveillance products. Those steps may alter what consumers see on shelves before the investigation ends. They are not product bans or recall orders. Retailers, marketplaces and consumers should distinguish a regulator's risk warning from a concluded enforcement action.[2]
Not every recording is automatically personal or sensitive information
Australian law currently turns partly on whether information is about a reasonably identifiable person. Images or voices may meet that test when names, uniforms, location data or other context allow someone to be singled out. The Commissioner's analysis says the answer can depend on the capabilities and other data held by the entity receiving the recording. That means the same-looking clip might have different privacy implications depending on whether it is processed only on a device, linked to an account or combined with identification data.
Consent is not mandatory for every collection of ordinary personal information under the current Act; collection generally must be reasonably necessary for the entity's functions or activities. Sensitive information faces a higher bar. Facial recognition could involve biometric information and normally require consent, but the Commissioner explicitly says the preliminary work had not identified facial-recognition capability in smart glasses then available in Australia. It would therefore be misleading to present this investigation as proof of covert facial recognition.[2]
For people nearby, visibility and security are the immediate practical issues
Smart glasses change the social conditions of recording because a camera, microphone or assistant can be worn continuously and may be less noticeable than a phone held up for a photograph. Bystanders may not know that their image or voice has been captured, which makes it difficult to exercise access, correction or complaint rights. The OAIC notes that community concern has already prompted restrictions in some local public facilities and a petition, but it also recognises that phones, action cameras, dashcams and doorbells create overlapping problems.
Security becomes more important when a software provider can receive large volumes of information that people did not realise was being collected. A weak account system, unclear retention policy or insecure transfer could expose recordings and associated metadata. The current sources do not demonstrate that any of those failures occurred in HeyCyan. The public-interest case for investigation is that users and bystanders cannot independently verify the app's handling practices while the provider has not answered the regulator's questions.[1][2]
What would change the assessment
The assessment should change when the investigation produces verified facts: a response from the company, compulsory-notice records, technical findings about data flows, locations and retention, or a determination identifying compliant or non-compliant conduct. Independent testing should document which models use HeyCyan, what permissions are requested, whether processing is local or remote, what is transmitted when the assistant is used, and whether people can delete or retrieve their data. Testing must avoid inventing evidence of a successful breach.
A final regulatory decision could require specified corrective steps or redress, and serious or repeated interference with privacy could lead the Commissioner to seek civil penalties in court. Conversely, evidence of data minimisation, transparent notices, secure storage and effective user controls could reduce concern. Until that record exists, the accurate conclusion is limited but consequential: Australia's privacy regulator has escalated unanswered questions about a widely distributed smart-glasses software layer into a formal investigation.[1][2]