What If Smart Glasses Had to Ask Before Revealing Your Face?

A person walking past a camera cannot negotiate a recording they have not noticed. Yet many privacy proposals for smart glasses still begin there: the bystander must recognise the device, understand what it is doing and take action before an identifiable image is kept or shared.

The CHI 2026 paper See Me If You Can: A Multi-Layer Protocol for Bystander Privacy with Consent-Based Restoration reverses that starting point. Faces are blurred by default. Revealing an original face is a separate operation that requires the recorded person's consent, not simply the wearer's preference.

Published in the Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems, the paper is by Yahya Khawaja, Shirin Rehman, Alexander Ponticello, Divyanshu Bhardwaj, Katharina Krombholz, Muhammad Hamad Alizai and Naveed Anwar Bhatti, with affiliations at Lahore University of Management Sciences and CISPA Helmholtz Center for Information Security.

The contribution combines a technical prototype with a qualitative study of 18 participants: nine wearers and nine bystanders. It does not establish a universal public preference or announce a shipping feature. It offers a concrete way to examine who should control access to an identifiable face, and what happens when that control is no longer assumed to belong to the person holding the camera.

The figure illustrates the study's three-tier design. Its caption uses the researchers' first-person wording; the protocol is their proposal, not a NearLens feature. The architecture is described in the paper's protocol-design section.

Tier 1 runs on the glasses. The system detects faces, encrypts each person's original facial region using a separate key and applies a blur to the visible recording. The companion phone receives blurred media alongside protected material needed for possible later restoration. A wearer is not supposed to be able to reveal the originals merely by choosing a different display setting.

Tier 2 is optional and runs on the companion phone. Instead of leaving a blurred patch, the system uses AI-generated identities and facial landmarks to create replacement faces. The aim is to retain some expressions and visual coherence without displaying the original identity. It is an alternative to restoration, not permission to expose a real face.

Tier 3 allows selective restoration. A trusted intermediary identifies an enrolled bystander, sends a consent request and releases the relevant decryption key only after approval. The phone restores that person's face locally. Approval from one person does not unlock the faces of everyone else in the frame.

Someone who has not enrolled with the intermediary cannot receive a restoration request through this mechanism. Their face remains protected by default. That is a consequential distinction: joining a platform is required to enable restoration, not to qualify for the initial face protection.

The protocol does not avoid all processing of an original face. It must detect the face, derive a matching representation and encrypt the original facial region before producing the protected output. Its privacy claim concerns how that information is made accessible, not the absence of any initial capture.

Restoration requires recoverability. Encrypted face regions remain on the wearer's phone for a limited period, while the intermediary controls the ability to release their keys. The paper describes automatic deletion when consent is not requested or granted within a fixed time window, but does not turn that into a universally specified retention period.

This split is intended to prevent either side from holding everything needed to reconstruct a face on its own. Under the proposed architecture, the intermediary receives encrypted face representations, wrapped keys and request metadata, not the recorded photographs or videos themselves. It decrypts the matching representation to identify a registered person and handle consent.

That is less exposure than sending the entire recording to a server. It is not zero exposure. Face matching, identity enrolment, key management and metadata about a recording still create responsibilities for the intermediary. Keeping media local and keeping every part of a system local are different claims.

The AI component is unusually important here because it is being used to alter what a recording reveals, rather than simply extract more information from it. The implementation selects an AI-generated identity and uses face-warping methods and MobileFaceSwap to place it over the protected region.

But the phrase identity-neutral describes the design objective, not proof that the entire person is unrecognisable. The participants' responses to synthetic replacement were mixed. Some thought a plausible alternative face would discourage viewers from trying to identify a blurred person. Others worried about resemblance, distracting artifacts and misleading representations.

People familiar with a subject may still recognise their hairstyle, clothing, movements, body shape or location. A realistic synthetic face can also make an altered recording look unaltered. That creates a separate obligation to communicate that a replacement occurred, especially when a clip could be interpreted as evidence of what a particular person did.

Nor does the paper establish that these recordings become AI training data. Its documented AI use is face processing and synthetic replacement within the proposed workflow. Claims about model training, retention by an unrelated service or commercial reuse would require separate evidence.

The technical evaluation used a Raspberry Pi 4 Model B and camera module as a stand-in for wearable-class hardware. The researchers compared its capabilities with the Snapdragon AR1 Gen 1 platform. This supports an argument about feasibility; it is not a measurement of an integrated privacy pipeline running on retail Ray-Ban Meta glasses.

The face-detection results were close to the comparison system, EgoBlur, on the study's curated dataset. They were not perfect, and face-detection performance is not the same thing as a guarantee against recognition. A missed face can remain visible; an obscured face can still belong to a recognisable person.

Synthetic replacements were compared with a baseline that applied face swapping directly to unblurred faces. The reported image-quality metrics favoured that baseline. The privacy-preserving version therefore involved a real quality tradeoff rather than demonstrating that the information removed by blurring could be recovered without cost.

The prototype also increased energy use, processing latency and storage requirements when bystanders were present. Those engineering costs matter, but laboratory measurements on a development board do not establish battery life, thermal behaviour or continuous performance in a consumer glasses frame.

The participant study used Meta Ray-Ban Stories for capture, followed by processing and a custom web interface to demonstrate the protocol. Wearers first borrowed glasses for at least a week to become familiar with recording. They were not testing the integrated privacy protocol throughout that onboarding period.

During the demonstration, consent approval was simulated as granted. Participants could experience the restoration workflow, but the study did not observe real recipients negotiating requests over time. Its evidence is strongest as an account of initial perceptions grounded in a prototype, not as a field trial of a deployed consent network.

The interviews exposed a disagreement that a product setting alone cannot resolve. Bystanders treated protection as something they should receive without having to ask. All nine supported mandatory implementation through regulation. Wearers recognised the benefits but often wanted to decide when the protection applied.

Some wearers described relief: automatic protection could reduce the guilt or uncertainty of accidentally recording a stranger. Others felt that blurred crowds damaged the personal quality of a memory or made a video less suitable for sharing.

The researchers also recorded a sharper objection. One wearer said they would not activate the protocol if the decision were left entirely to them. That does not mean all wearers would behave this way. It does show why making a safeguard available is not equivalent to making it effective for people who never get to touch the settings.

A context-dependent design might reduce unnecessary friction, but context is disputed. A wearer may regard a private event as permission to record normally; a guest may still want to remain unidentifiable. Inferring relationships and sensitive settings can itself require additional data collection. The authors explicitly recognise that risk.

The study found that willingness to request or grant restoration depended on relationships, purpose and setting. A family memory and a request from an unknown recorder were not treated as interchangeable. Participants wanted to understand who was asking and why their original face was needed.

That creates a tension inside the request itself. More context can support a better-informed decision, but timestamps, locations, requester identities and explanations can expose more information to the intermediary. The paper leaves the exact metadata package open rather than presenting a settled solution.

Refusal also has a social cost. Wearers anticipated that a declined request from a partner or friend could be interpreted as a lack of trust. Repeated requests could become burdensome. A person may technically be able to refuse while still feeling pressured to agree.

The discussion proposes contextual preferences and ways to reduce consent fatigue, including constraints on time, location, purpose and trusted contacts. These are design directions, not validated evidence that standing permissions are always appropriate or that social pressure disappears.

There is another boundary worth keeping explicit: the implemented consent operation releases an identifiable face. It is not a complete permissions system governing publication, redistribution, future analysis or every later copy of the restored recording. Once the wearer can access the original face, those downstream questions require additional controls and governance.

Audio is outside the implemented protection. A blurred or synthetic face does not conceal a voice or the content of a private conversation. The authors identify reliable speaker-specific protection as a technical limitation, and participants asked for stronger measures such as masking or muting.

Facial landmarks used for synthetic replacement are transmitted to the companion phone without encryption. The protocol adds noise to reduce identification risk, but the authors acknowledge residual possibilities of re-identification. The matching representations used for consent also remain sensitive even though they are not ordinary photographs.

The trust model has limits. Direct compromise of the glasses' firmware and side-channel attacks are outside scope, as is collusion between the intermediary and a malicious wearer. The paper also recognises that a determined person could simply choose an unrestricted recording device. The design should be assessed within those assumptions, not advertised as protection against every possible recorder.

The consent-matching prototype used a small reference database. A working demonstration does not establish reliable matching, resistance to abuse or manageable request volumes at population scale. Key compromise, false matches and retention policies need scrutiny beyond a polished consent screen.

Finally, all 18 participants lived in Pakistan and were recruited from a university community. Interviews were conducted in English and Urdu, with the researchers providing English translations where needed. The findings are valuable within that context, but do not represent a global survey or long-term behaviour across cultures and settings.

The most useful contribution is a change in responsibility. Instead of treating privacy as something a bystander must request after noticing a device, the prototype makes access to an original face conditional. It asks the system to enforce a boundary that recording etiquette often leaves to goodwill.

That is distinct from device awareness. Knowing that compatible camera glasses may be nearby can help someone understand a situation; it cannot blur footage on another person's device or enforce their consent decision. Likewise, the absence of a detected signal does not establish that no recording device is present.

For manufacturers, the paper supports a more demanding set of questions than whether an indicator light is visible: what leaves the camera, what remains recoverable, who controls restoration, what happens after refusal, and whether audio and contextual identifiers are protected too.

For readers, the careful conclusion is neither that AI has solved bystander privacy nor that protection is technically impossible. This study demonstrates a plausible direction and makes several of its compromises inspectable. The next standard should be evidence that the boundary survives missed detections, social pressure and everyday use, not merely that a face can be made blurry.