Meta Smartglasses Can Covertly Film Kids & Spain Fines 23andMe (07/21/2026)

A pair of ordinary-looking glasses can now record the people around you, including children, without anyone knowing, and the maker’s position is that it is up to individuals not to misuse it. That is the tension in almost every privacy story worth reading: a capability ships to everyone, the burden of restraint gets pushed onto the public, and the harm lands on whoever cannot defend themselves. Spain answered a different version of that question this week by fining 23andMe for failing to protect data it collected, and an EU court drew a line protecting the tools people use to protect themselves.

Top 5 Critical Privacy Alerts

1. Meta Smartglasses Make Covert Filming of Children Easy

A Guardian commentary warns that Meta’s camera smartglasses let any wearer covertly film the people around them, children included, and notes Meta’s position that it is for individuals to ensure they do not actively exploit the technology (The Guardian). Putting the duty of restraint on the person holding the camera is how you guarantee the restraint fails, because the whole design removes the visible signal that once told a parent their child was being recorded.

Operator Note: Always-on wearable cameras erase the social cue that recording is happening. If your facility or event has any expectation of privacy, a device policy that names smartglasses is now worth writing, because the old assumption that a camera is visible no longer holds.

2. Spain Fines 23andMe Nearly $3 Million

Spain’s data protection authority fined 23andMe nearly $3 million over the cybersecurity failings that enabled the 2023 breach, which affected more than 2,600 Spaniards out of 6.9 million people worldwide (The Record). Regulators across jurisdictions are now billing 23andMe separately for the same failure, and genetic data is the one category where the harm does not fade, because you cannot reissue a genome.

3. An EU Court Rules VPNs Are Lawful Tools

An EU court ruled that VPNs are lawful technical tools, in a landmark decision arising from a copyright case (TechRadar). This matters beyond copyright, because the same tool that frustrates a rights holder is the one a journalist, an abuse survivor, or an ordinary person uses to keep their traffic private, and a ruling that treats the tool as lawful protects all of those uses at once.

4. AI Chatbots Give Unreliable Election Advice

Research conducted during the Hungarian election found that AI chatbots provided inaccurate, inconsistent, and unreliable voting guidance, in some cases recommending parties that were not even running (The Guardian). People are already treating these systems as trusted advisors, and a confidently wrong answer about who is on the ballot is the kind of error that erodes an election rather than a shopping cart.

5. Rhode Island Enacts an AI and Healthcare Privacy Law

Rhode Island passed a new law governing the use of artificial intelligence by healthcare entities and the privacy of the patient data those systems touch (Data Protection Report). Healthcare is where AI decisions carry the highest stakes for a person, and a state drawing rules around AI in care is the sort of specific, sector-first regulation that tends to set the template others copy.

Additional Privacy Alerts

Privacy Laws & Regulations

• EU Regulators Outline GDPR Rules for AI Web Scraping: European regulators published guidance on the GDPR requirements that apply when AI systems scrape personal data from the web to build training sets. Alston & Bird
• Connecticut Extends AI Regulation to Subscriptions: Connecticut moved to bring subscription services under its AI regulation, widening where the rules apply. Inside Privacy

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.