#Meta Took the Camera Out of Its Smart Glasses. The DPDP Act Still Doesn't Protect the Person Across the Table

At its Connect event on 23 September, Meta launched Ray-Ban Meta Audio — its first smart glasses with no camera and no screen, just six microphones listening for a wake word. Removing the camera also removed the small LED that lit up when the older models recorded, and under the DPDP Act that LED was never a legal requirement in the first place: it was a design choice, and Meta has now designed it away.

That matters more in India than almost anywhere else, because India is one of the few markets where a smart-glasses bystander has already gone to a lawyer — and had to reach for negligence and tort law, not the Digital Personal Data Protection Act, to do it.

#What Meta actually shipped on 23 September

Ray-Ban Meta Audio starts at $349, weighs 43 grams, runs 12 hours on a charge with another 48 from the case, and comes in Clubmaster and Burbank styles across 23 colour and lens combinations. Pre-orders opened immediately; it ships 13 October. There is no camera, no display, and no capture indicator, because on Meta's own framing there is nothing being captured to indicate — the glasses are a hands-free surface for listening, calls, and talking to Muse, Meta's personal AI agent, which activates when you say its name.

Alongside it, Meta shipped Ray-Ban Meta Gen 3 at $449 with a 12MP camera and 3K video. That model reached India on 24 September at ₹44,300, about ₹4,400 above the previous generation's launch price. India already sells the camera line; Meta has not yet announced an Indian price or date for the camera-free Audio model, though its rollout list keeps widening.

The trade press read the audio-first pivot as a reputational manoeuvre. One India-focused analysis framed the launch explicitly as a response to bystander-privacy pressure, with the Delhi legal notice over camera glasses cited as a proximate cause. Whether or not that reading is right about Meta's motives, it gets the direction of travel backwards. A camera-free device is not a privacy-safer device under Indian law. It is a less legible one.

#The LED was the entire bystander protection — and the DPDP Act never mandated it

Meta's own announcement describes "a built-in LED light that helps make people around you aware if you're taking photos or video." That sentence appears in the section about the camera models. It is a courtesy, not a compliance artefact. Nothing in the DPDP Act, 2023 or the Digital Personal Data Protection Rules, 2025 obliges a wearable manufacturer to signal capture to third parties, and nothing obliges a wearer to disclose that they are recording.

Strip out the camera and you strip out the LED. What remains is a six-microphone array that must continuously monitor ambient sound to catch a wake word. That is a device that hears the table next to it — names, salaries, a diagnosis read aloud from a phone screen, a password spoken over a call — with no visible state at all. The person sitting across from you cannot tell a Ray-Ban Meta Audio from a pair of prescription glasses, and unlike the camera models, there is no moment at which the device announces itself.

MediaNama, covering the launch on 24 September, made the India-specific point plainly: the DPDP Act contains a personal-use exemption that requires no disclosure to bystanders when someone records in a public space. LED-blocking stickers, meanwhile, are already sold on Amazon India — a small, telling market signal that the indicator was doing real work for someone, and that some wearers wanted it gone.

#Why the DPDP Act doesn't reach the person wearing the glasses

Section 3(c)(i) of the DPDP Act says the Act does not apply to "personal data processed by an individual for any personal or domestic purpose." An ordinary person wearing smart glasses in a café, recording their day, asking an AI agent to summarise a conversation, is squarely inside that carve-out. They are not a data fiduciary. They owe no notice under Rule 3, no consent request, no purpose limitation, no erasure obligation. The Data Protection Board of India will have no jurisdiction over them.

This is not an Indian drafting error — GDPR Article 2(2)(c) has a near-identical household exemption, and European regulators have spent years narrowing it through case law. India has no such case law, no regulator sitting to develop any, and a statute whose relevant provisions are not yet in force.

The exemption does have edges. It is lost the moment processing becomes commercial, and it does not cover making data available to an indefinite audience. Post the recording as a monetised Reel and the personal-purpose defence weakens considerably. Note also what Section 3(c)(ii) — the separate exemption for personal data "made or caused to be made publicly available" — does not do here: it covers data the data principal themselves put into the open. A bystander who was recorded without knowing did not make anything public. The creator did.

So there is a theory under which an Indian content creator who films strangers and monetises the output is a data fiduciary with real obligations. But it is a theory that cannot be tested until 13 May 2027, and it says nothing at all about the quiet, non-commercial, always-listening case that the Audio model creates.

#Meta isn't a data fiduciary for what the microphones hear

The second gap is upstream. A data fiduciary is whoever "alone or in conjunction with other persons determines the purpose and means of processing." For a wake-word buffer running on-device, Meta will argue — plausibly — that the wearer determines the purpose, that the rolling audio never leaves the glasses until the wake word fires, and that Meta processes only what the user deliberately sends to Muse.

That argument may or may not survive contact with how the device actually behaves; nobody in India is currently positioned to audit it. But note the structural result: the wearer is exempt as an individual, and the manufacturer disclaims fiduciary status over the ambient layer. The bystander's audio sits in the gap between them, governed by nothing.

There is a partial answer available in the Act. MeitY has signalled that AI-enabled CCTV cameras will be covered under the DPDP Rules, and the government retains power under Section 10 to notify a Significant Data Fiduciary, which brings a mandatory Data Protection Officer, annual audits, periodic Data Protection Impact Assessments, and algorithmic-transparency duties. Ambient-capture wearables sold at scale are an obvious SDF candidate on the statutory criteria — volume of data, risk to data principals, public order. The criteria have not been notified. The Centre is expected to begin notifying SDFs during 2026, but has not done so.

#The Khan Market notice already ran this experiment

On 24 July 2026, a man was sitting alone at a café in Khan Market when an Instagram creator approached him, harassed him with unsolicited questions, and — he says — recorded the whole encounter on camera-equipped Ray-Ban Meta glasses. The Reel went up on 26 July and passed 419,000 views within ten days.

On 24 August, advocate Apar Gupta, acting pro bono with the Internet Freedom Foundation, sent a legal notice naming both the creator and Meta Platforms, demanding takedown, disclosure and preservation of evidence, an unconditional apology, and ₹2.05 crore in damages. The notice's most interesting move is the one against Meta: it argues a duty of care and frames the glasses as a product whose design — indistinguishable from ordinary spectacles, with an inadequate recording indicator — makes covert capture foreseeable.

Read the remedies that notice reaches for. Negligence. Product liability. Defamation and disparagement. Platform grievance mechanisms under the IT Rules. What it conspicuously cannot reach for is the DPDP Act, because the Act's operative provisions do not commence until 13 May 2027, and because even then Section 3(c)(i) likely shields the wearer.

The platform layer performed no better. Instagram's reporting flow offered no category for a privacy violation, forcing the complaint in under "Bullying or harassment." Instagram found no Community Standards breach. A review was rejected. A complaint to Meta's India grievance officer reportedly drew no acknowledgement at all.

That is the full stack of Indian remedy available to a bystander in September 2026: a tort notice and a rejected app report.

#Nothing in the next eight months changes this

It is worth being precise about the timeline, because vendors are selling urgency and the urgency points elsewhere.

The DPDP Rules were notified on 13 November 2025. Phase I commenced immediately and covers only the machinery for constituting the Data Protection Board of India. 13 November 2026 brings the consent-manager framework under Rule 4 into force — registration, the ₹2 crore net-worth threshold, interoperability and security standards. 13 May 2027 brings everything substantive: notice, consent, security safeguards, breach reporting under Rule 7, and data-principal rights. MeitY floated compressing that 18-month runway to 12 months during January 2026 stakeholder consultations, but no such amendment has been notified.

Meanwhile the regulator does not exist. MeitY invited applications for the Chairperson and four Members on 6 May 2026; as of last month the Board still had no appointed Chairperson and no appointed Members. The body that would register consent managers in November, and that would one day adjudicate a complaint about ambient audio capture, has no one sitting on it.

None of the three dates addresses bystander capture. The consent-manager deadline governs how enterprises broker consent from their own users. The May 2027 commencement will still carry Section 3(c)(i) intact.

#What Indian organisations should do before their premises become the issue

The near-term exposure is not consumer-side. It is that your offices, clinics, branches, and call-centre floors are places where third parties now wear undetectable recording devices, and your DPDP obligations over the data captured there do not evaporate because someone else's glasses did the capturing.

Practical steps that do not depend on the Board ever being constituted:

• Write wearables into visitor and vendor policy. "No cameras" is now underinclusive. Your policy needs to name ambient audio capture and always-on voice assistants, not camera lenses.
• Re-scope your record of processing. If client PII, patient data, or card details are spoken aloud in rooms that outsiders enter, that is a disclosure vector your DPIA should already name. SDFs will be audited on exactly this kind of omission.
• Fix the grievance path you actually control. The Khan Market complainant failed at Meta's grievance officer. Under Rule 13, yours has to work: a named officer, a published channel, and response timelines you can evidence.
• Stop treating consent as a document. Rule 3 notice obligations and the November consent-manager regime are about machine-readable, revocable, auditable consent artefacts. If you are evaluating that layer, our consent manager explainer sets out what the registration framework actually requires — and our resources library tracks each commencement date as it lands.

#The gap is a policy choice, not an oversight

Meta's audio-first glasses are a reasonable product. They may well be less invasive than the camera models in practice. But the reason they attract no Indian regulatory scrutiny has nothing to do with being safer — it is that India's privacy statute is built around a consent relationship between a data fiduciary and a data principal who opted in, and a bystander never opted into anything.

Every regime with an ambient-capture problem has had to solve it outside the consent frame: through product-design mandates, sectoral rules, or a regulator willing to stretch a household exemption. India has notified none of those, and the institution that might have started is still waiting for its first appointment letters. Until MeitY notifies SDF criteria that capture wearables, or issues guidance on ambient capture the way it has signalled for AI-enabled CCTV, the answer to "who protects the person across the table" remains: a tort lawyer, if they can afford one.

If your organisation handles personal data in physical spaces open to visitors, audit your wearables exposure now rather than in May 2027. The DPDP compliance resources at DPDPBot track every commencement date, rule, and enforcement signal as it lands — including the ones the vendors selling you urgency have not noticed yet.