Camera glasses and new statutory tort of serious invasion of privacy: the innocent bystander now has a cause of action
Key Insights
Since 10 June 2025, a person whose private activities or private affairs have been recorded without their consent may have a direct right to sue the person who recorded them, without proving financial loss and without a regulator's involvement.
Being in a public place is only one relevant factor, and may not be a complete answer to a potential claim of serious invasion of privacy.
Organisations may carry exposure of their own, through arguments about vicarious liability for what employees do and, for retailers and manufacturers, under the Australian Consumer Law.
The risks of covert surveillance using camera glasses has become a source of increasing community concern in Australia.
In early August 2026, Kmart reportedly sold out of its $89 Anko camera glasses within days of putting them on the shelf. The latest iteration of Meta's range, launched in June 2026 starts at around $469 and is being pushed hard into the Australian market with celebrity endorsements. Electronic Frontiers Australia has called for a recall and a regulatory ban, describing the devices as cheap, covert recording devices. A GetUp! petition addressed to Kmart's managing director has passed 42,000 signatures, and a separate e-petition to the Australian Parliament, promoted by parenting author Maggie Dent, which seeks a ban on the sale, promotion and public use of covert AI recording glasses, has already garnered more than 8,000 signatures.
While much of the public debate has focused on the act of recording, the more consequential question is what a recording enables with today’s AI-enabled technology. A few seconds of footage can be livestreamed, broadcast on social media, used to generate synthetic intimate or degrading imagery, matched against a face database, or mined for the time and place a person was somewhere they would rather not have been seen. Material uploaded to a platform may also be used to train AI systems under terms the person filmed has never seen, let alone consented to. The law reflects this - as set out below, the seriousness of an invasion is assessed against the harm the recording was likely to cause, and not against the act of capture alone.
There will be a range of legislation relevant to the use of these devices including surveillance devices, harassment and communications laws, the Australian Consumer Law and potentially criminal laws where conduct amounts to stalking or video surveillance is misused or used to generate synthetic abuse material. This article focuses on a development that has genuinely changed the legal landscape, which is that on 10 June 2025 the people being recorded acquired a direct right to sue against the person who they say has invaded their privacy.
The statutory tort
A tort is a legal wrong that gives the victim a right to sue the wrongdoer for civil damages.Schedule 2 of the Privacy Act 1988 (Cth), inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), created a new statutory tort for serious invasion of privacy. It covers two forms of invasion: intruding upon a person's seclusion, and misusing information relating to them. A plaintiff may rely on one or both of these limbs.
Several aspects of the drafting matter for present purposes.
First, the defendant pool. The tort reaches individuals and organisations alike, subject to the exemptions in Part 3 of Schedule 2 discussed below.The $3 million small business turnover threshold that applies elsewhere in the Privacy Act has no application to the statutory tort, and a defendant does not need to be an APP entity. That is a significant departure from how the Act has always operated, because it means that now any individual who commits a serious invasion of another individual’s privacy can be ordered to pay civil damages.
Second, the tort is actionable per se, so a plaintiff need not prove financial loss, although that is also recoverable. Damages for emotional distress are expressly available without a psychiatric diagnosis, which removes the single largest evidentiary hurdle in this kind of claim and makes no win, no fee arrangements commercially viable for plaintiff law firms. Damages for non-economic loss (or “pain and suffering”) are capped at the greater of $478,550 or the defamation cap – it is important to note however that this cap does not apply to economic loss claims, such as loss of income or out of pocket expenses required as a result of a privacy breach. Two relevant limits apply, however. Clause 11(2) prohibits an award of aggravated damages altogether, and clause 11(4) confines exemplary or punitive damages to exceptional circumstances. Injunctions are available under clause 9 at any stage of the proceedings, along with destruction and delivery-up orders, correction orders, apology orders, an account of profits and a declaration that the defendant has seriously invaded the plaintiff’s privacy.
Third, the tort operates directly between the parties. There will likely be no shortage of Australian regulators with something to say about this technology. The eSafety Commissioner can compel removal of image-based abuse, the ACCC administers the consumer law and state police enforce the surveillance devices legislation. The Office of the Australian Information Commissioner (OAIC) has said it is watching the rollout of these devices carefully. However, the OAIC has no complaint-handling or administrative function in relation to the tort, so there is no need for a plaintiff to file a complaint, or to persuade a regulator to act. A plaintiff who wants a remedy under Schedule 2 can simply file a statement of claim. The Commissioner is not absent from the picture altogether - Clause 22 permits the Commissioner, with the leave of the court, to intervene in proceedings under Schedule 2 or to assist the court as amicus curiae (“friend of the court”) which means the OAIC may still shape how the early cases are decided even though it has no gatekeeping role.
Fourth, the traditional “employee records exemption” under the Privacy Act does not apply in the case of the statutory tort, so there is nothing stopping an employee suing an employer who commits a serious invasion of privacy.
Fifth, Part 3 narrows the defendant pool considerably, by exempting Commonwealth agencies and State and Territory authorities and staff where they act in good faith, intelligence agencies, law enforcement bodies, and invasions of privacy to the extent that they involve the disclosure of information to a law enforcement body.
Individual wearers are exposed for the first time
Until the commencement of the statutory tort, the Privacy Act had never applied to individuals handling information in a personal capacity, so until then a person filming strangers on a beach sat outside the federal regime altogether. Their exposure was scattered across state surveillance devices legislation, the image-based abuse provisions and the occasional defamation claim, none of which fits the conduct particularly well. However, Schedule 2 contains no personal capacity carve-out, meaning that for the first time an individual with a consumer product on their face could be the subject of a federal privacy cause of action. Courts with jurisdiction to hear cases include the Federal Circuit and Family Court, the Federal Court, and state courts such as the NSW District Court or the Victorian County Court.
There is a narrow exemption only for defendants under 18 in clause 18, which is worth keeping in mind now that the entry price is $89 and a good deal of the market is likely school-aged. The journalism exemption in clause 15 is broad on its face and remains completely untested; the case that might have tested it, Groth v Herald and Weekly Times, settled in November 2025 with a published apology rather than a judgment. Non-media defendants cannot rely on it at all.
To date there has been only one published decision on the statutory tort. In Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, Gibson DCJ granted urgent interlocutory relief on 7 October 2025 in respect of wedding photographs published online as part of what the plaintiffs characterised as a campaign of extortion. Her Honour accepted that wedding photographs are intended to be private, that the plaintiff was not a public figure, and that publication constituted misuse of private information. Two things follow from this. First, the court was prepared to treat ordinary personal imagery, rather than intimate imagery, as capable of supporting the tort, and second, the Court was prepared to move quickly. Quantum remains untested, since Kurraba was an interlocutory judgment and Groth settled, making it hard to draw definitive conclusions about future damages claims.
Applied to camera glasses, the elements of the new tort will not be difficult to plead. There is an invasion without consent. Whether there was a reasonable expectation of privacy is assessed objectively against the factors in clause 7(5). Wearing a recording device into a space where people undress or speak confidentially almost certainly involves (or should involve) awareness of a risk and proceeding regardless, which is what recklessness means.
Seriousness is assessed against the factors in clause 7(6), which include the degree of offence, distress or harm to dignity that the invasion was likely to cause to a person of ordinary sensibilities in the plaintiff’s position, whether the defendant knew or ought to have known that the invasion was likely to have that effect, and, where the invasion was intentional, whether the defendant was motivated by malice. The balance of public interest is not a defence but an element the plaintiff must establish under clause 7(1)(e), although a countervailing public interest is unlikely to be substantial where the recording is covert and non-consensual. The likely battlegrounds in the early cases will be reasonable expectation and seriousness, and both will likely be the subject of vigorous debate while the law is being settled. In the meantime, it is a fair assumption that someone who deliberately and covertly films another person intending to post a humiliating or embarrassing video online could be the subject of a successful claim for damages by that person.
There are two other important points. The first is that the time limits for adults are short. Proceedings must generally be commenced within the earlier of one year after becoming aware of the invasion and three years after the invasion occurred, although an extension may be granted where it was not reasonable to have commenced in time. Where the plaintiff was under 18 when the invasion occurred, however, the deadline is instead the plaintiff’s twenty-first birthday, so footage of a ten year old child taken this week could still be litigated a decade from now.
The second point is that a further cause of action may be available. In Waller (A Pseudonym) v Barrett (A Pseudonym) [2024] VCC 962 the Victorian County Court recognised a standalone common law tort of invasion of privacy and awarded $30,000. It is a first-instance decision that was never appealed, so its status is unsettled, but it carries no journalism exemption. Clause 21 expressly preserves the concurrent operation of State and Territory laws, so the statutory tort and a common law action can be pleaded alongside each other.
Defences and early dismissal
Three further features of Schedule 2 will shape how these claims are actually run, and each of them answers a criticism commonly made of the tort.
Clause 8 sets out the defences. It is a defence that the invasion was required or authorised by an Australian law or by a court or tribunal order, that the plaintiff or someone with lawful authority expressly or impliedly consented, that the defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to a person’s life, health or safety, or that the invasion was incidental to the lawful defence of persons or property and was proportionate, necessary and reasonable. Where the invasion involved publication, clause 8(2) makes certain defamation defences available, being absolute privilege, publication of public documents and fair report of proceedings of public concern. The consent defence deserves particular attention here, because it extends to implied consent. A wearer will no doubt seek to argue that a person who saw the recording indicator and continued regardless consented by implication. Whether that argument succeeds should depend on whether the indicator was visible, understood and capable of being acted on in the moment, which is precisely the difficulty discussed later in this article.
Clause 10 gives the court an express power to enter judgment for the defendant where the plaintiff has no reasonable prospect of success, and clause 8A allows the court to determine whether an exemption applies at any stage. Together these provisions should answer the concern that the tort will generate a flood of claims about ordinary street photography.
Clause 7(7) makes it immaterial, on the misuse of information limb, whether the information was true, which distinguishes the tort from defamation law.
Is there a reasonable expectation of privacy on a public street?
This is the question the technology raises most sharply, and the answer is usually no, at least not without something more. Australia has never recognised a general right not to be photographed in public, and Schedule 2 did not create one. If it had, every tourist snapshot of a popular attraction with people in it would be a civil wrong that sounds in damages.
That is not the end of the analysis, however, because location is only one of the factors the court is directed to weigh under clause 7(5). The clause is structured according to which limb of the tort is being run, and the distinction is worth drawing carefully. Four factors apply to both limbs: the means used, including the use of any device or technology, the purpose of the invasion, attributes of the plaintiff including age, occupation and cultural background, and the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy. Where the claim is intrusion upon seclusion, clause 7(5)(e) adds the place where the intrusion occurred. Where the claim is misuse of information, clause 7(5)(f) adds the nature of the information, how the plaintiff held or communicated it, and whether and to what extent it was already in the public domain. A filming claim will often be pleaded on both limbs, but on the intrusion limb place is the only location-based factor, and it sits alongside four others that have nothing to do with where the plaintiff happened to be standing. Being filmed on a public street can tell against a finding of serious invasion of privacy, but it is not the only factor, and where the intention is malicious that will be an important consideration for the court.
The English courts have worked through this problem at some length, and their reasoning warrants attention because Gibson DCJ was already willing to draw on English authority in Kurraba, citing Douglas v Hello! on the private character of wedding photographs.
In Murray v Big Pictures (UK) Ltd [2008] EWCA Civ 446 a photographer used a long lens to photograph JK Rowling's 19-month-old son in a buggy as the family walked along an Edinburgh street to a local cafe, and the photograph was later published in a Sunday newspaper. The trial judge struck the claim out on the footing that the image was innocuous. The English Court of Appeal disagreed, holding it at least arguable that the child had a reasonable expectation of privacy, and observing that the law should protect children from intrusive attention at least to the extent of holding that a child has a reasonable expectation that he will not be targeted in order to obtain photographs in a public place. The House of Lords refused leave to appeal. Weller v Associated Newspapers Ltd [2015] EWCA Civ 1176 went further and awarded damages - unpixelated photographs of Paul Weller's 16-year-old daughter and 10-month-old twins, taken while the family were shopping and sitting in a cafe in Santa Monica, attracted damages of £10,000 between the three children for misuse of private information, and was upheld on appeal.
Neither decision binds an Australian court and the causes of action are not identical. However, the underlying principle is one that is likely to matter here, namely that location is not determinative and the critical question is whether the individual plaintiff was incidental to the scene or singled out.
That distinction maps closely onto how these devices are used. Someone recording while walking outside may capture only scenery. Someone who focuses on a single person or couple on a beach, holds the frame and later posts the footage has selected a specific target, and so has someone who wears the device into a gym, change room, a clinic waiting area, a school pick-up line or a family violence service, all of which are places the public may enter and none of which are places where anyone usually wants to be filmed. Add the features that come with the technology itself, which are that the capture is covert, at close range and at face height, and that the wearer made a deliberate choice to bring the device and turn it on, and a defence built solely on the public location of the recording begins to look more dubious.
Other relevant regimes
Several other regimes are relevant, but different in nature to the statutory tort. The following is a brief snapshot.
Surveillance devices legislation varies under state and territory laws and differentiates between audio and visual recording. As a general rule, recording a private conversation without the requisite consent, which, where the person recording is not a party, means the consent of all participants, is an offence, subject to limited exceptions. Because camera glasses record audio alongside video, a wearer who captures a nearby private conversation may commit an offence without ever intending to. Video surveillance is treated differently, and its legality may depend on whether the filming is of a 'private activity' or is carried on inside or outside a building or in a public place.
Image-based abuse and deepfake provisions operate downstream. Commonwealth offences for this growing crime address non-consensual sexually explicit synthetic material created from innocent photographs, several states have added their own provisions, and eSafety's scheme can compel removal. All of them engage once the material exists and once somebody has found it. That gap matters more than it used to, because a short clip or a single clear still is now sufficient raw material to generate synthetic images and video. The eSafety Commissioner has described nudify applications that operate on one photograph and return a result in seconds, and reports to eSafety from under-18s about digitally altered intimate images have doubled in 18 months. Between January and March 2026 eSafety received more than 100 reports concerning anonymous accounts targeting schools, almost all involving imagery harvested from school websites and social media.
The Australian Consumer Law may also be relevant. As can be seen from the analysis above, the issue of whether a non-consensual video recording is lawful in Australia requires nuanced analysis. Retailers and manufacturers will need to take care with representations regarding applicable privacy, surveillance, recording and consent laws. Sections 18 and 29 are engaged only where conduct or a representation can be identified, so the key question will be what, if anything, a retailer or manufacturer has actually conveyed, whether through packaging, marketing copy, in-store assurances, or the promotion of an LED indicator as a privacy or compliance feature.
Section 18 prohibits misleading or deceptive conduct and requires no intention to mislead, and section 29 prohibits false or misleading representations about goods, including representations concerning the existence or effect of a condition, warranty, guarantee, right or remedy. Any representation that these devices are lawful to use, or that an LED indicator discharges the wearer's obligations, may be genuinely arguable as a contravention. Two features of the ACL make such a claim easier to run. First, a statement that a device can be used lawfully is arguably a representation as to a future matter under section 4, which is deemed misleading unless the maker had reasonable grounds for making it, with the maker bearing the evidential burden, a burden that could be difficult to discharge given the complexity described above. Second, because the courts assess the dominant message conveyed, a Court or regulator might be less willing to accept a disclaimer that sought to shift the obligation to assess the legality of using the product onto the consumer, particularly where the product is sold at a child’s price-point. The legal position varies between states, varies again between audio and video, and has now been overlaid with a federal tort, so confident assurances of legality could be difficult to sustain.
Exposure under the ACL is not limited to misrepresentation, however, because the consumer guarantees may also be relevant. Where the ordinary use of a device is significantly constrained by privacy, surveillance and recording laws, there could be an argument that the goods are not of acceptable quality within the meaning of section 54, or are not reasonably fit for a purpose the consumer made known within the meaning of section 55. While these arguments remain untested in this context, they broaden the potential exposure of retailers and manufacturers beyond representations about legality, and reinforce the need to take advice before deploying, promoting or selling these devices.
None of the above is intended as a comment on the packaging, marketing or disclaimers of any particular retailer or manufacturer. Whether any specific representation or disclaimer contravenes the ACL would turn entirely on what was actually conveyed or omitted in the individual case, and could only be assessed on the specific facts. The points made here are general and illustrative.
Stalking and harassment provisions under the criminal law focus on the person rather than the place where the stalking occurred. State legislation in several states lists keeping the victim under surveillance as conduct capable of constituting stalking, intimidation, harassment or abuse. A practical limit is that these provisions require a course of conduct, meaning two or more acts or one protracted act, together with an intention to cause harm or fear or constructive knowledge of that likelihood. A single opportunistic recording may not meet the threshold, but sustained targeting of one person could. In practice the most immediate remedy for victims will be a personal safety intervention order or an apprehended personal violence, depending on jurisdiction. Where footage is published, s 474.17 of the Criminal Code (Cth) covers using a carriage service to menace, harass or cause offence, and the adult cyber abuse scheme under the Online Safety Act 2021 (Cth) can compel removal.
However, the statutory tort is the only one of these actions that puts the remedy directly in the hands of the person affected and perhaps most motivated to sue, although protective orders under stalking legislation are also available directly to the person affected.
Facial recognition
Anyone inclined to dismiss concerns about facial recognition on these devices as speculative should bear in mind recent disclosures regarding Meta’s AI glasses.
On 4 June 2026 WIRED reported that it had found dormant facial recognition code inside the Meta AI companion app, an app installed on more than 50 million devices, which would have converted faces into biometric signatures stored as numerical vectors and compared each new face entering the wearer's field of view against them. The Electronic Frontier Foundation's Threat Lab independently verified the finding through static analysis. On 5 June 2026, Meta removed the code in an unannounced app update, and it has declined to answer WIRED's questions about whether the feature will return or what became of any data collected during internal testing. A coalition of 75 organisations led by the American Civil Liberties Union had already written to Meta CEO Mark Zuckerberg warning that glasses with this capability could identify strangers at protests, medical clinics and businesses.
While the feature was never shipped, what separated a consumer product from a live stranger-identification tool appears to have been a configuration setting rather than an unsolved engineering problem and technical feasibility does not appear to be in doubt.
Organisational exposure
The statutory tort could be committed by an employee acting in the course of their employment. Schedule 2 contains no vicarious liability provision, however, so a claim against an employer will rest on general law principles. For intentional torts the Australian authorities require more than the employment having supplied an opportunity. The question is whether the role gave the employee the occasion for the wrongdoing, having regard to features such as authority, trust, power and the intimacy of the role. Whether wearing a recording device at work satisfies that test is untested and will turn on the facts of the particular employment. What can be predicted is that plaintiff lawyers will name both the individual and the organisation, since only one of them is likely to carry insurance. On the topic of insurance, while civil liability damages are generally insurable, whether a particular cyber, professional indemnity or management liability policy responds to a third-party privacy tort claim founded on intentional or reckless conduct may be a separate issue where the policy contains exclusions based on intentionality or public policy grounds. Recklessness under clause 7(1)(c) can be individual or systemic, and an organisation that knows staff are wearing these devices and has never turned its mind to the legalities is at risk.
There is a further exposure that sits outside the tort altogether. Covert recording of a colleague can amount to sexual harassment under the Sex Discrimination Act 1984 (Cth), and the Act imposes a positive duty on employers and persons conducting a business or undertaking to take reasonable and proportionate measures to eliminate sexual harassment and hostile workplace environments as far as possible. A recording device worn into a workplace is a foreseeable risk of precisely the type of conduct the duty is directed at, and the Commission’s guidance expects employers to have a policy on respectful behaviour and to enforce it. An employer with no position on personal recording devices may therefore have a positive duty problem as well as a recklessness problem, and that one does not wait for a plaintiff.
The question of fairness underlying the law
When someone lifts a phone to record, it is much more likely that people nearby know. That gesture is what makes consent possible, because it is what allows a person to object, move away, or agree. Smart glasses can remove that knowledge on the part of bystanders, and an LED does not substitute for it, since the person being recorded has to notice a small light, understand what it signifies and respond, in the moment, while a stranger is looking at them, even assuming that the wearer has not disabled or disguised the LED.
What is being lost with these devices is the practical ability to know when one is being recorded, and that ability is the precondition for consenting or refusing to anything. The loss falls most heavily on people least able to absorb it, which includes women in gyms and change rooms, children, and anyone whose safety depends on not being locatable, such as a domestic violence victim.
There will be legitimate uses, for example where members of a sporting team want to analyse performance and everyone consents to the filming. However, most consumer use will be different in nature and as outlined above, the risk of harm that can now occur from misuse of any photograph or video footage can be serious.
Where this leaves organisations
Anyone considering buying a pair of camera glasses should consider the people who will be standing in front of them. Where they believe they have suffered a serious breach of privacy, any one of those people may now have the legal standing to sue the wearer personally, without proving a dollar of loss, in a jurisdiction where damages for non-economic loss are capped at the greater of $478,550 and the defamation cap, and where no regulator will filter that claim before it arrives or attempt to broker a resolution.
Organisations considering deploying, promoting or selling these devices should take advice before committing. In practice that work has four parts. A personal recording devices policy, setting out what staff may wear and where. An exposure assessment for organisations operating across more than one state, since the surveillance and stalking provisions differ materially between jurisdictions. A positive duty gap analysis against the Commission’s standards, which is required whether or not anyone has complained. And written confirmation from their insurance broker on whether the relevant policies respond to a third-party claim founded on intentional or reckless conduct. Boards and partnerships increasingly expect that analysis in writing, and it is considerably easier to prepare before an incident than during one. Decision-makers should also consider whether the organisation is prepared to carry legal responsibility for the footage its people collect and for whatever is subsequently done with it.
Law & Cyber advises organisations on privacy, technology and cyber risk, and prepares device policies, exposure assessments and board briefings of this kind.
Update, 12 August 2026
This article was first published on 7 August 2026 and has been expanded following questions received from readers. The discussion of Schedule 2 now covers the limitation periods, the statutory defences, the summary judgment and exemption determination provisions, the preservation of State and Territory laws and the jurisdiction of the Federal Circuit and Family Court. Three passages have also been clarified. The definition of intruding upon seclusion is confined to a person’s private activities or private affairs. The exemptions in Part 3 of Schedule 2 for law enforcement bodies, intelligence agencies and government agencies mean the tort does not apply to every defendant. An additional comment has been added regarding the Information Commissioner’s ability to intervene in proceedings and to assist the court as amicus curiae, with the leave of the court. The discussion of vicarious liability has been clarified to note that Schedule 2 does not refer to this and to reflect the position taken by the Australian authorities on intentional torts. Lastly, the number of signatories to the two petitions was updated as of 12/8/2026.
Simone Herbert-Lowe, Principal, Law & Cyber. This article is general information only and does not constitute legal advice. If you require advice you should seek advice tailored to your circumstances.