How Much Do Your Smart Glasses Really Reveal?
On 7 October 2026, Australia’s privacy regulator opened an investigation into Shenzhen Qingcheng Future Technology, maker of the HeyCyan phone app. The company had not answered preliminary questions about how connected glasses record information, who can access it and where it is stored.
That is the current regulatory event. OAIC has not found a Privacy Act breach, imposed a fine or announced a universal ban on HeyCyan-compatible glasses. Meta, Google and Kmart also received preliminary inquiries, but the regulator says that should not be read as a conclusion about their compliance.
Follow the service behind the frames
The product on a shelf is only the visible end of the chain. OAIC describes Kmart and BDI Technology as retailers, Shenzhen Qingcheng as the provider of software used by many lower-cost models, and Meta and Google as companies that provide or plan to provide both devices and underlying software. Its formal investigation currently concerns Shenzhen Qingcheng.
HeyCyan is required to enable the full functionality of products including Kmart’s Anko smart glasses and models offered through Big W Marketplace, Amazon and other retailers. A phone connects the frames to the app, and information gathered by the glasses can then enter an app-controlled processing route.
This distinction matters during procurement. The logo on the frame, the seller, the app publisher, the hosting provider and any support party can be different organisations. A product inventory that records only the hardware brand will not explain which entity receives information or controls the service after purchase.
Turn three unanswered questions into evidence requests
OAIC’s questions provide a useful minimum review: what is recorded, who can access it and where it is stored. A buyer or retailer should make each answer testable.
For recording, ask for a feature-level data map. It should separate information captured by the glasses from information created by the phone, app, account, voice assistant, diagnostics and support workflow. It should also show which features work locally, which require a network service and what changes when a feature is disabled.
For access, identify the legal entities, staff roles, service providers and subprocessors that can reach content or metadata. Obtain the technical control behind the answer, such as role definitions, access logs, approval records and a tested method for removing access.
For storage, record production, backup, telemetry and support locations, together with retention and deletion rules. A country name in a privacy policy is not enough if backups or human support follow a different route.
These are BlackTree operational recommendations for making a data flow reviewable. They are not findings about what HeyCyan collects or where it stores information.
APP 1 makes governance part of the product decision
APP 1 requires a covered entity to take reasonable steps to maintain practices, procedures and systems for compliance and for handling privacy inquiries and complaints. It also requires a clear, current privacy policy. OAIC describes this as a proactive and continuing obligation.
For a connected device, governance evidence should link the public policy to the operating service. Name the privacy owner, preserve the supplier assessment, record approved purposes, test access and deletion, define complaint handling, and set a review trigger for app, firmware, hosting or subprocessor changes. The evidence should show what happens in practice, not only what a contract promises.
For the wider Australian programme, BlackTree’s earlier analysis explains how APP 1’s December disclosure rule reaches software-assisted decisions. The HeyCyan investigation raises a different decision, but both require an organisation to connect policy wording to the data route and accountable owner.
Retail responsibility can extend beyond direct legal scope
The Privacy Commissioner says a retailer that neither collects nor holds personal information may not itself have Privacy Act obligations for the device. The same commentary says customers and shareholders are still likely to expect retailers to perform privacy due diligence. OAIC has written to retailers about devices using HeyCyan and urged them to consider whether continued sale is appropriate.
That does not create a universal stop-sale order. It does make an undocumented decision harder to defend. A retailer can record the supplier evidence requested, unresolved questions, affected products, interim controls, decision owner and date for reconsideration. An organisational buyer can use the same record for approval, restriction or removal from an approved catalogue.
Before approving or continuing a product, ask:
- Which app and remote services are required for each advertised feature?
- Which information can the glasses, phone and service collect or generate?
- Which entity controls each stage, and which other parties can access it?
- In which countries are production, backup, support and telemetry data handled?
- What retention, deletion, access and correction processes have been tested?
- How will buyers learn about changes to the app, privacy terms, hosting or subprocessors?
- Which owner can pause use or sale when the evidence becomes incomplete?
The present decision is a due-diligence gate, not a verdict on the product. Keep the unresolved questions visible, set a review date and revisit the record when OAIC publishes the outcome of its investigation.
Primary sources
- OAIC announcement: investigation into the maker of the HeyCyan app, updated 7 October 2026
- Privacy Commissioner blog: Smart glasses under the microscope, published 7 October 2026
- OAIC APP 1 guideline, version 2.0, updated 30 September 2026
