Australian Privacy Regulator Investigates Developer Behind HeyCyan Smart Glasses App

Key Takeaways

• OAIC Opens Formal Investigation: Australia's privacy regulator is investigating Shenzhen Qingcheng Future Technology, the Chinese developer behind the HeyCyan smart glasses application.
• Developer Failed to Respond: Shenzhen Qingcheng did not answer regulatory inquiries about how its application collects, stores and handles personal information.
• Major Retailers Sell Affected Devices: HeyCyan is used in smart glasses sold through Kmart, Big W Marketplace, Amazon and other retailers.
• Retailers Urged to Reconsider Sales: Privacy Commissioner Carly Kind has written to retailers expressing concerns about the application and asking them to consider whether to continue selling the devices.

Deep Dive

Australia's privacy regulator has opened an investigation into the developer of an application used in inexpensive smart glasses sold through Kmart, Big W Marketplace and Amazon, after the company failed to answer questions about how the devices collect and handle personal information. Privacy Commissioner Carly Kind said the company's failure to cooperate with preliminary inquiries had left her without assurance that it was protecting Australians' personal information as required by law.

“In the absence of any response from Shenzhen Qingcheng to the OAIC’s preliminary inquiries, I have no assurance that it is protecting personal data of Australians as required by the Privacy Act,” Kind said.

HeyCyan is used with several models of lower-cost smart glasses manufactured in China and distributed under different brand names. The OAIC identified the application in Kmart's Anko smart glasses and in products sold through Big W Marketplace, Amazon and other retailers. The application enables certain functions of the glasses, including listening to music, answering telephone calls and using HeyCyan's voice assistant. According to the regulator, these features involve information gathered by the glasses being collected through the application for processing.

Where that information is stored, who can access it and how it is protected were among the questions the OAIC put to Shenzhen Qingcheng. The company, which is based in China, provided no response.

The regulator had been monitoring the introduction of smart glasses into the Australian market since early 2026. In August, the Attorney-General wrote to the Privacy Commissioner requesting an examination of the technology's privacy implications. Beginning August 12, the OAIC sent preliminary inquiries to several manufacturers and distributors, including Meta, Google, Kmart and Shenzhen Qingcheng. The regulator sought explanations of how the devices operated, what information they recorded and where that information was kept.

Shenzhen Qingcheng's failure to respond raised concerns about its practices and systems for protecting personal information, Kind said, particularly its obligations under Australian Privacy Principle 1.

“The failure of Shenzhen Qingcheng to respond to the OAIC’s inquiries raises concerns about the entity’s practices, procedures and systems to protect the personal information it holds, as required by APP 1,” she said. “In those circumstances I considered it was important to commence an investigation so that I could utilise my full range of powers to examine this issue, including issuing compulsory information gathering notices.”

The investigation will allow the commissioner to use formal powers to obtain information about the company's privacy practices. The OAIC has not determined that Shenzhen Qingcheng breached Australian privacy law or improperly handled information collected through its application.

Retailers Urged to Reconsider Sales

Kind has also written to retailers selling smart glasses that use HeyCyan, expressing concern about the application's privacy risks and urging them to consider whether the products should remain available.

“The Australian community has expressed its concern about the proliferation of smart glasses and other surveillance wearables,” she said. “Given the particular risks the OAIC has identified with the HeyCyan app, I would urge responsible retailers to consider whether it is appropriate to continue making these devices available.”

The commissioner has not ordered retailers to withdraw the devices, and the OAIC has not announced any findings of wrongdoing against the businesses selling them.

The warning nevertheless brings retailers into a matter that began with questions directed at the software developer. The OAIC's preliminary inquiries found that HeyCyan was used across numerous smart glasses models sold under different names, meaning consumers purchasing devices from different retailers may be relying on the same application to operate them. The regulator has not disclosed whether any retailer intends to discontinue sales.

The investigation comes as smart glasses and other wearable recording devices attract closer scrutiny from Australian privacy authorities. Their ability to collect information while being worn in everyday settings has prompted questions about how that information is handled and what protections apply to individuals whose personal information may be captured.

The OAIC's immediate concern is whether Shenzhen Qingcheng's practices comply with the requirements of the Privacy Act 1988. Its attempts to obtain information from the developer through preliminary inquiries have so far been unsuccessful.

Investigation Could Lead to Enforcement Action

The commissioner has opened the investigation under Section 40(2) of the Privacy Act 1988, which authorizes investigations into acts or practices that may interfere with an individual's privacy or breach Australian Privacy Principle 1. That principle requires organizations covered by the law to take reasonable steps to establish practices, procedures and systems that support compliance with Australia's privacy requirements.

If the investigation establishes an interference with privacy, the commissioner may issue a determination requiring the company to take specified steps to prevent the conduct from continuing or recurring. Such a determination may also require measures to address loss or damage suffered by affected individuals.

Where serious or repeated interferences with privacy are established, the commissioner may seek civil penalties through the Federal Court of Australia. No such findings have been made against Shenzhen Qingcheng, and the OAIC has not announced any penalties or enforcement determinations.

The regulator said it would not comment further until the investigation concludes, in accordance with its published privacy regulatory action policy.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.