Analysis of 7 AI smart glasses reveals that Meta requests the most dangerous permissions

A comparison of 7 AI smart glasses brands reveals that the app linked to Meta’s specs requests more dangerous permissions than those of its China-made rivals.

Smart glasses are often considered a privacy nightmare because they can be used to record people without their consent, earning them the derogatory term “pervert glasses.”

But this may be just the tip of the iceberg, as privacy risks also extend to their wearers.

A Cybernews analysis shows that mobile apps linked to these wearables request intrusive permissions and contain embedded trackers.

Our researchers examined 7 AI smart-glasses brands from US tech giant Meta and Chinese manufacturers Rokid, RayNeo, INMO, Solos, Even Realities, and Halliday, as well as their accompanying apps.

The analysis also reveals that some brands lack clear measures to prevent tampering with the indicator light, and their data retention practices are opaque.

All apps require dangerous permissions

Any pair of smart glasses needs to be connected to a manufacturer’s mobile app to unlock its full functionality, and users must grant permissions, such as handling calls or accessing the gallery.

Cybernews analysis, using data from a non-profit audit platform Exodus Privacy, shows that the Meta AI app requires the most permissions (70), followed by Even Realities (61), Solos AirGO (55), and Hi Rokid (53).

While Halliday requests only 32 permissions, 12 of them – or 38% – are dangerous, referring to Android’s label for anything that requires explicit runtime consent but not proof of misuse.

Such permissions grant an app additional access to restricted data or allow it to perform restricted actions that more substantially affect the system and other apps. They often require access to private user data, which includes potentially sensitive information.

Meta also leads the list of dangerous permissions, requesting 18, which account for 26% of all permissions asked. They include access to read external storage and sms, as well as to record audio.

INMO and Solos track your activity the most

Cybernews looked into whether AI smart glasses apps have embedded trackers, which are third-party software components collecting data about a user’s device, location, or behavior.

Despite requesting the most dangerous permissions, Meta has only one detected tracker: Facebook Flipper, the company’s own debugging tool, not a third-party ad/analytics software development kit (SDK).

INMO Global and Solos AirGo have the most trackers, 6 embedded in each, according to Exodus Privacy data. The former has the widest tracker set, including Huawei’s analytics, advertising, and locations.

Interestingly, Solos AirGO has embedded 3 separate Meta/Facebook trackers for analytics, login, and share, alongside its own Google Firebase Analytics and CrashLytics.

Only one AI smart glasses app, Hi Rokid, has no trackers detected.

Prevention of tampering with the indicator light

Cybernews researchers compared the glasses brands against 9 privacy criteria drawn from Apple’s reported approach to its own AI glasses.

Each brand scored 0-2, based on data from public sources, including privacy policies, product pages, and independent reviews. A score of 0 meant weak or no privacy protection, 1 represented partial protection, and 2 signaled strong protection.

The criteria include camera indicator, on-device processing, facial recognition, AI training, human review, dedicated documentation, and data retention.

​Only 2 devices – Meta and Rokid – have a confirmed response when the warning LED is covered, while RayNEO and Solos don’t address the issue.

The capture LED, usually installed on the front of the smart glasses frame, illuminates during active recording to warn others. However, opaque tape or custom stickers can hide the indicator, enabling covert filming.

Amid growing backlash over non-consensual videos filmed by Meta glasses, the company announced new measures to protect against tampering with the LED. A software update released in late August stops the device from recording when the light is covered.

Sensitive footage is going to the cloud

All 7 apps included in the analysis process have their AI features in the cloud. None of them runs any core feature, such as voice, translation, or image analysis, locally on the glasses themselves.

Reliance on cloud processing may result in the loss of control over data handling, potentially allowing the use of sensitive material for AI model training.

Cybernews analysis sheds light on obscure data retention practices, with 5 of 7 devices analyzed not specifying any retention limit.

Only Even Realities disclose an immediate-deletion default for captured voice, while Meta caps some data at 30 days to a year.

As governments scramble to write rules for the public use of smart glasses, already imposing or mulling over bans in certain places, manufacturers themselves lack clear documentation on how to address the privacy risks posed by their wearables.

Only 3 devices included in the analysis, Meta, Rokid, and Even Realities, have a privacy document specifically written for the glasses.

In comparison, INMO and Solos have only a dedicated section within a general company policy, while RayNeo and Halliday rely entirely on a generic company-wide policy without any specific mention of their glasses.

Risks may only grow in the future

Researchers around the world are still uncovering the privacy risks of smart glasses.

A recent ABC News Australia investigation into ultra-cheap smart glasses purchased from retailers like Temu found that strangers can connect to them and take control of the devices.

Experts and the public also worry about the possibility of facial recognition function in smart glasses, which wasn’t detected in any of the devices tested.

Wired reported in August that a complete but inactive face-recognition pipeline is already embedded in Meta’s AI companion app, Stella. The company described the technology as an “ongoing exploration” of potential features and denied rumors of a product release.