Camera glasses and new statutory of breach of privacy: the innocent bystander now has a cause of action
Key Insights
Since 10 June 2025, a person recorded without their consent can potentially sue the person who recorded them directly, without proving financial loss and without a regulator's involvement.
Being in a public place is only one relevant factor, and may not be a complete answer to a potential claim of serious invasion of privacy.
Organisations may carry exposure of their own, through vicarious liability for what employees do and, for retailers and manufacturers, under the Australian Consumer Law.
The risks of covert surveillance using camera glasses has become a source of increasing community concern in Australia.
This week, Kmart reportedly sold out of its $89 Anko camera glasses within days of putting them on the shelf. The latest iteration of Meta's range, launched in June 2026 starts at around $469 and is being pushed hard into the Australian market with celebrity endorsements. Electronic Frontiers Australia has called for a recall and a regulatory ban, describing the devices as cheap, covert recording devices. A GetUp! petition addressed to Kmart's managing director has passed 23,000 signatures, and a separate e-petition to the Australian Parliament, promoted by parenting author Maggie Dent, which seeks a ban on the sale, promotion and public use of covert AI recording glasses, has already garnered more than 6,000 signatures.
There will be a range of legislation relevant to the use of these devices including surveillance devices, harassment and communications laws, the Australian Consumer Law and potentially criminal laws where conduct amounts to stalking or video surveillance is misused or used to generate synthetic abuse material. This article focuses on a development that has genuinely changed the legal landscape, which is that on 10 June 2025 the people being recorded acquired a direct right to sue against the person who they say has invaded their privacy.
The statutory tort
A tort is a legal wrong that gives the victim a right to sue the wrongdoer for civil damages.Schedule 2 of the Privacy Act 1988 (Cth), inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), created a new statutory tort for serious invasion of privacy. It covers two forms of invasion: intruding upon a person's seclusion, which expressly extends to watching, listening to or recording them, and misusing information relating to them. A device that records video and audio from the wearer's eyeline is capable of both.
Four aspects of the drafting matter for present purposes.
First, the defendant pool. The tort reaches any individual or organisation. The $3 million small business turnover threshold that applies elsewhere in the Privacy Act has no application to the statutory tort, and a defendant does not need to be an APP entity. That is a significant departure from how the Act has always operated, because it means that now any individual who commits a serious invasion of another individual’s privacy can be ordered to pay civil damages.
Second, the tort is actionable per se, so a plaintiff need not prove financial loss, although that is also recoverable. Damages for emotional distress are expressly available without a psychiatric diagnosis, which removes the single largest evidentiary hurdle in this kind of claim and makes no win, no fee arrangements commercially viable for plaintiff law firms. Damages for non-economic loss (or “pain and suffering”) and any exemplary or punitive damages are capped at the greater of $478,550 or the defamation cap – it is important to note however that this cap does not apply to economic loss claims, such as loss of income or out of pocket expenses required as a result of a privacy breach. Injunctions are available, including urgent ex parte relief, along with destruction orders, apology orders and an account of profits.
Third, the tort operates directly between the parties. There will likely be no shortage of Australian regulators with something to say about this technology. The eSafety Commissioner can compel removal of image-based abuse, the ACCC administers the consumer law and state police enforce the surveillance devices legislation. The Office of the Australian Information Commissioner (OAIC) has said it is watching the rollout of these devices carefully. But the OAIC has confirmed it has no direct role in administering the tort, so there is no need for a plaintiff to file a complaint, or to persuade a regulator to act. A plaintiff who wants a remedy under Schedule 2 can simply file a statement of claim.
Fourth, the traditional “employee records exemption” under the Privacy Act does not apply in the case of the statutory tort, so there is nothing stopping an employee suing an employer who commits a serious invasion of privacy.
Individual wearers are exposed for the first time
Until the commencement of the statutory tort, the Privacy Act had never applied to individuals handling information in a personal capacity, so until then a person filming strangers on a beach sat outside the federal regime altogether. Their exposure was scattered across state surveillance devices legislation, the image-based abuse provisions and the occasional defamation claim, none of which fits the conduct particularly well. However, Schedule 2 contains no personal capacity carve-out, meaning that for the first time an individual with a consumer product on their face could be the subject of a federal privacy cause of action, which they can litigate in a state court such as the NSW District or Victorian County Courts or the Federal Court.
There is a narrow exemption only for defendants under 18 in clause 18, which is worth keeping in mind now that the entry price is $89 and a good deal of the market is likely school-aged. The journalism exemption in clause 15 is broad on its face and remains completely untested; the case that might have tested it, Groth v Herald and Weekly Times, settled in November 2025 with a published apology rather than a judgment. Non-media defendants cannot rely on it at all.
To date there has been only one published decision on the statutory tort. In Kurraba Group Pty Ltd & Anor v Williams [2025] NSWDC 396, Gibson DCJ granted urgent interlocutory relief on 7 October 2025 in respect of wedding photographs published online as part of what the plaintiffs characterised as a campaign of extortion. Her Honour accepted that wedding photographs are intended to be private, that the plaintiff was not a public figure, and that publication constituted misuse of private information. Two things follow from this. First, the court was prepared to treat ordinary personal imagery, rather than intimate imagery, as capable of supporting the tort, and second, the Court was prepared to move quickly. Quantum remains untested, since Kurraba was an interlocutory judgment and Groth settled, making it hard to draw definitive conclusions about future damages claims.
Applied to camera glasses, the elements of the new tort will not be difficult to plead. There is an invasion without consent. Whether there was a reasonable expectation of privacy is assessed objectively against the factors in clause 7(5). Wearing a recording device into a space where people undress or speak confidentially almost certainly involves (or should involve) awareness of a risk and proceeding regardless, which is what recklessness means. Seriousness is measured by the distress likely to be caused to a person of ordinary sensibilities, and the countervailing public interest is unlikely to be substantial where the recording is covert and non-consensual. The likely battlegrounds in the early cases will be reasonable expectation and seriousness, and both will likely be the subject of vigorous debate while the law is being settled. In the meantime, it is a fair assumption that where someone deliberately and covertly films someone with the intention of posting a humiliating or embarrassing video online that conduct could be the subject of a successful legal action for damages by the victim.
There are two other important points. The limitation rule for minors means that where the plaintiff was under 18 at the time, the limitation period does not expire before they turn 21, so footage of a ten year old child, for example, that is taken this week could be the subject of litigation in ten years’ time. Further, a second cause of action may be available - in Waller (A Pseudonym) v Barrett (A Pseudonym) [2024] VCC 962 the Victorian County Court recognised a standalone common law tort of invasion of privacy and awarded $30,000. It is a first-instance decision that was never appealed, so its status is unsettled, but it carries no journalism exemption.
Is there a reasonable expectation of privacy on a public street?
This is the question the technology raises most sharply, and the answer is usually no, at least not without something more. Australia has never recognised a general right not to be photographed in public, and Schedule 2 did not create one. If it had, every tourist snapshot of a popular attraction with people in it would be a civil wrong that sounds in damages.
That is not the end of the analysis, however, because location is only one of the factors the court is directed to weigh under clause 7(5). The others include the nature of the information, the means used to obtain it, the purpose of the intrusion, whether the information was already in the public domain, and the attributes and conduct of the plaintiff. While being filmed on a public street can be a factor that tells against a finding of serious invasion of privacy, it is by no means the only factor, and where the intention is malicious, that will an important factor for the court to consider.
The English courts have worked through this problem at some length, and their reasoning warrants attention because Gibson DCJ was already willing to draw on English authority in Kurraba, citing Douglas v Hello! on the private character of wedding photographs.
In Murray v Big Pictures (UK) Ltd [2008] EWCA Civ 446 a photographer used a long lens to photograph JK Rowling's 19-month-old son in a buggy as the family walked along an Edinburgh street to a local cafe, and the photograph was later published in a Sunday newspaper. The trial judge struck the claim out on the footing that the image was innocuous. The English Court of Appeal disagreed, holding it at least arguable that the child had a reasonable expectation of privacy, and observing that the law should protect children from intrusive attention at least to the extent of holding that a child has a reasonable expectation that he will not be targeted in order to obtain photographs in a public place. The House of Lords refused leave to appeal. Weller v Associated Newspapers Ltd [2015] EWCA Civ 1176 went further and awarded damages - unpixelated photographs of Paul Weller's 16-year-old daughter and 10-month-old twins, taken while the family were shopping and sitting in a cafe in Santa Monica, attracted damages of £10,000 between the three children for misuse of private information, and was upheld on appeal.
Neither decision binds an Australian court and the causes of action are not identical. However, the underlying principle is one that is likely to matter here, namely that location is not determinative and the critical question is whether the individual plaintiff was incidental to the scene or singled out.
That distinction maps closely onto how these devices are used. Someone recording while walking outside may capture only scenery. Someone who focuses on a single person or couple on a beach, holds the frame and later posts the footage has selected a specific target, and so has someone who wears the device into a gym, change room, a clinic waiting area, a school pick-up line or a family violence service, all of which are places the public may enter and none of which are places where anyone usually wants to be filmed. Add the features that come with the technology itself, which are that the capture is covert, at close range and at face height, and that the wearer made a deliberate choice to bring the device and turn it on, and a defence built solely on the public location of the recording begins to look more dubious.
Other relevant regimes
Several other regimes are relevant, but different in nature to the statutory tort. The following is a brief snapshot.
Surveillance devices legislation varies under state and territory laws and differentiates between audio and visual recording. As a general rule, recording a private conversation without the requisite consent, which, where the person recording is not a party, means the consent of all participants, is an offence, subject to limited exceptions. Because camera glasses record audio alongside video, a wearer who captures a nearby private conversation may commit an offence without ever intending to. Video surveillance is treated differently, and its legality may depend on whether the filming is of a 'private activity' or is carried on inside or outside a building or in a public place.
Image-based abuse and deepfake provisions operate downstream. Commonwealth offences for this growing crime address non-consensual sexually explicit synthetic material created from innocent photographs, several states have added their own provisions, and eSafety's scheme can compel removal. All of them engage once the material exists and once somebody has found it. That gap matters more than it used to, because a short clip or a single clear still is now sufficient raw material to generate synthetic images and video. The eSafety Commissioner has described nudify applications that operate on one photograph and return a result in seconds, and reports to eSafety from under-18s about digitally altered intimate images have doubled in 18 months. Between January and March 2026 eSafety received more than 100 reports concerning anonymous accounts targeting schools, almost all involving imagery harvested from school websites and social media.
The Australian Consumer Law may also be relevant. As can be seen from the analysis above, the issue of whether a non-consensual video recording is lawful in Australia requires nuanced analysis. Retailers and manufacturers will need to take care with representations regarding applicable privacy, surveillance, recording and consent laws. Sections 18 and 29 are engaged only where conduct or a representation can be identified, so the key question will be what, if anything, a retailer or manufacturer has actually conveyed, whether through packaging, marketing copy, in-store assurances, or the promotion of an LED indicator as a privacy or compliance feature.
Section 18 prohibits misleading or deceptive conduct and requires no intention to mislead, and section 29 prohibits false or misleading representations about goods, including representations concerning the existence or effect of a condition, warranty, guarantee, right or remedy. Any representation that these devices are lawful to use, or that an LED indicator discharges the wearer's obligations, may be genuinely arguable as a contravention. Two features of the ACL make such a claim easier to run. First, a statement that a device can be used lawfully is arguably a representation as to a future matter under section 4, which is deemed misleading unless the maker had reasonable grounds for making it, with the maker bearing the evidential burden, a burden that could be difficult to discharge given the complexity described above. Second, because the courts assess the dominant message conveyed, a Court or regulator might be less willing to accept a disclaimer that sought to shift the obligation to assess the legality of using the product onto the consumer, particularly where the product is sold at a child’s price-point. The legal position varies between states, varies again between audio and video, and has now been overlaid with a federal tort, so confident assurances of legality could be difficult to sustain.
Exposure under the ACL is not limited to misrepresentation, however, because the consumer guarantees may also be relevant. Where the ordinary use of a device is significantly constrained by privacy, surveillance and recording laws, there could be an argument that the goods are not of acceptable quality within the meaning of section 54, or are not reasonably fit for a purpose the consumer made known within the meaning of section 55. While these arguments remain untested in this context, they broaden the potential exposure of retailers and manufacturers beyond representations about legality, and reinforce the need to take advice before deploying, promoting or selling these devices.
None of the above is intended as a comment on the packaging, marketing or disclaimers of any particular retailer or manufacturer. Whether any specific representation or disclaimer contravenes the ACL would turn entirely on what was actually conveyed or omitted in the individual case, and could only be assessed on the specific facts. The points made here are general and illustrative.
Stalking and harassment provisions under the criminal law focus on the person rather than the place where the stalking occurred. State legislation in several states lists keeping the victim under surveillance as conduct capable of constituting stalking, intimidation, harassment or abuse. A practical limit is that these provisions require a course of conduct, meaning two or more acts or one protracted act, together with an intention to cause harm or fear or constructive knowledge of that likelihood. A single opportunistic recording may not meet the threshold, but sustained targeting of one person could. In practice the most immediate remedy for victims will be a personal safety intervention order or an apprehended personal violence, depending on jurisdiction. Where footage is published, s 474.17 of the Criminal Code (Cth) covers using a carriage service to menace, harass or cause offence, and the adult cyber abuse scheme under the Online Safety Act 2021 (Cth) can compel removal.
However, the statutory tort is the only one of these actions that puts the remedy directly in the hands of the person affected and perhaps most motivated to sue, although protective orders under stalking legislation are also available directly to the person affected.
Facial recognition
Anyone inclined to dismiss concerns about facial recognition on these devices as speculative should bear in mind recent disclosures regarding Meta’s AI glasses.
On 4 June WIRED reported that it had found dormant facial recognition code inside the Meta AI companion app, an app installed on more than 50 million devices, which would have converted faces into biometric signatures stored as numerical vectors and compared each new face entering the wearer's field of view against them. The Electronic Frontier Foundation's Threat Lab independently verified the finding through static analysis. On 5 June, Meta removed the code in an unannounced app update, and it has declined to answer WIRED's questions about whether the feature will return or what became of any data collected during internal testing. A coalition of 75 organisations led by the American Civil Liberties Union had already written to Meta CEO Mark Zuckerberg warning that glasses with this capability could identify strangers at protests, medical clinics and businesses.
While the feature was never shipped, what separated a consumer product from a live stranger-identification tool appears to have been a configuration setting rather than an unsolved engineering problem and technical feasibility does not appear to be in doubt.
Organisational exposure
The statutory tort can be committed by an employee acting in the course of their employment. Where the employment provided the access or proximity that made the wrong possible, vicarious liability arguments follow in the ordinary way, and plaintiff lawyers can be expected to name both the individual and the organisation, since only one of them is likely to carry insurance. On the topic of insurance, while civil liability damages are generally insurable, whether a particular cyber, professional indemnity or management liability policy responds to a third-party privacy tort claim founded on intentional or reckless conduct may be a separate issue where the policy contains exclusions based on intentionality or public policy grounds. Recklessness under clause 7(1)(c) can be individual or systemic, and an organisation that knows staff are wearing these devices and has never turned its mind to the legalities is at risk.
There is a further exposure that sits outside the tort altogether. Covert recording of a colleague can amount to sexual harassment under the Sex Discrimination Act 1984 (Cth), and the Act imposes a positive duty on employers and persons conducting a business or undertaking to take reasonable and proportionate measures to eliminate sexual harassment and hostile workplace environments as far as possible. A recording device worn into a workplace is a foreseeable risk of precisely the type of conduct the duty is directed at, and the Commission’s guidance expects employers to have a policy on respectful behaviour and to enforce it. An employer with no position on personal recording devices may therefore have a positive duty problem as well as a recklessness problem, and that one does not wait for a plaintiff.
The question of fairness underlying the law
When someone lifts a phone to record, it is much more likely that people nearby know. That gesture is what makes consent possible, because it is what allows a person to object, move away, or agree. Smart glasses can remove that knowledge on the part of bystanders, and an LED does not substitute for it, since the person being recorded has to notice a small light, understand what it signifies and respond, in the moment, while a stranger is looking at them, even assuming that the wearer has not disabled or disguised the LED.
What is being lost with these devices is the practical ability to know when one is being recorded, and that ability is the precondition for consenting or refusing to anything. The loss falls most heavily on people least able to absorb it, which includes women in gyms and change rooms, children, and anyone whose safety depends on not being locatable, such as a domestic violence victim.
There will be legitimate uses, for example where members of a sporting team want to analyse performance and everyone consents to the filming. However, most consumer use will be different in nature.
Where this leaves organisations
Anyone considering buying a pair of camera glasses should consider the people who will be standing in front of them. Where they believe they have suffered a serious breach of privacy, any one of those people may now have the legal standing to sue the wearer personally, without proving a dollar of loss, in a jurisdiction where non-economic damages are capped above $478,550, and no regulator will filter that claim before it arrives or attempt to broker a resolution. Where the wearer’s intention is, for example, to create an embarrassing video to post online for entertainment purposes, that person will be exposed to significant financial risk.
Organisations considering deploying, promoting or selling these devices should take advice before committing. In practice that work has four parts. A personal recording devices policy, setting out what staff may wear and where. An exposure assessment for organisations operating across more than one state, since the surveillance and stalking provisions differ materially between jurisdictions. A positive duty gap analysis against the Commission’s standards, which is required whether or not anyone has complained. And written confirmation from their insurance broker on whether the relevant policies respond to a third-party claim founded on intentional or reckless conduct. Boards and partnerships increasingly expect that analysis in writing, and it is considerably easier to prepare before an incident than during one. Decision-makers should also consider whether the organisation is prepared to carry legal responsibility for the footage its people collect and for whatever is subsequently done with it.
Law & Cyber advises organisations on privacy, technology and cyber risk, and prepares device policies, exposure assessments and board briefings of this kind.
Simone Herbert-Lowe, Principal, Law & Cyber. This article is general information only and does not constitute legal advice. If you require advice you should seek advice tailored to your circumstances.