Two Loopholes, Two Patches, Ten Weeks Apart
Meta closed a second loophole in the Ray-Ban Meta capture-indicator LED on August 27, 2026, after people discovered that a wearer could start a recording, then cover the light, and keep filming without any visible signal to bystanders.
Alex Himel, Meta's VP of AR, announced the fix on Threads. Covering the LED before a recording starts had already been blocked for months, that path stayed shut. The new loophole worked because covering the LED mid-recording did not stop the camera, it only hid the warning. The August 27 update changes that: the camera now stops recording the instant the LED is covered while a recording is already running.
This is the second privacy patch to the capture LED in under two months. An earlier update, rolled out roughly in June or July 2026, closed a more physical bypass: wearers who drilled the LED housing out of the frame used to keep a working camera with no indicator at all. That update disabled the camera outright if the LED housing was removed. Himel said Meta will "keep rolling out updates like this to make sure the capture LED can reliably alert bystanders when photos or videos are being captured."
Each fix responds to a specific way people defeated the light. Neither responds to what French regulators had already said about the light itself, two months before the newer of the two fixes.
| Event | What it addresses or status | Date |
|---|---|---|
| LED drilled out of the frame | Camera disabled entirely if the LED housing is removed | Approx. June-July 2026 (earlier update) |
| LED covered after recording starts | Camera now stops recording the instant the LED is covered mid-recording | August 27, 2026 |
| CNIL states the LED is insufficient | French regulator says a technical indicator light cannot substitute for bystander consent | June 2026 |
| EDPB smart-glasses categorization report | Due, pending publication | End of summer 2026 |
| Meta Connect and next-generation glasses launch | Scheduled hardware event | September 23, 2026 |
This is also the second time in weeks that Ray-Ban Meta's capture indicator has drawn scrutiny beyond Meta's own fixes. An earlier complaint from the German group HateAid, reported August 15, 2026, concerned a separate mod market letting people bypass the glasses' camera restrictions in software, a distinct issue from the firmware loopholes closed here.
A Fix for Reliability, Not for Consent
France's CNIL told Meta in June 2026 that the capture LED "have only a limited range and therefore appear insufficient" as a way to warn bystanders, and that wearers must obtain real consent before filming other people regardless of how the indicator behaves.
That statement came before both of the patches described above. It was not a response to the drilling bypass or the mid-recording bypass; CNIL had already said the underlying approach does not work as consent, before either bypass was fixed. CNIL's objection is not that the LED can be tricked, it is that even a perfectly functioning LED does not amount to consent from the person being filmed.
Germany adds a second, separate strand. Hamburg's data protection commissioner has indicated the glasses may already violate German rules against concealed recording equipment, a reading that does not turn on LED reliability either. Italian members of the European Parliament raised a further concern in March 2026, this time about contractors in Kenya reviewing footage captured by the glasses, addressed to Ireland's DPC, Meta's lead EU regulator.
None of these strands ask whether the LED can be defeated. Each asks a different question: who consents, who reviews the footage, and under which law. Making the LED harder to trick answers none of them.
What EU and UK Businesses Should Take From the Timing
European and UK businesses piloting or deploying Ray-Ban Meta or similar smart glasses for retail, warehousing, field service, or customer-facing work are running a device whose legal category is still being written.
A firmware update that makes the capture LED harder to defeat is a genuine engineering improvement. It is not a compliance answer to the consent question CNIL raised in June, and it does not touch the German concealed-recording question or the Irish DPC's Kenya-review inquiry. A business that treats "Meta patched the LED again" as evidence the bystander-consent problem is solved is relying on a claim Meta's own lead EU privacy regulator has already rejected in writing.
The EDPB's report on how to categorize smart glasses under EU law is due by the end of summer 2026, the same window in which Meta is expected to launch its next generation of glasses at Meta Connect on September 23, 2026. A business piloting the current generation now should expect the rules for the whole category, not just this model, to shift within weeks of that launch, and should build its bystander-consent and data-handling practice around what CNIL and Hamburg have already said rather than around what the LED currently does.
We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.
Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.
If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.
Read next: A 50 Dollar Mod Undoes Germany's Glasses Rule | France's Tax Agency Is Exempt From Its Own GDPR Fines
