The Australian Information Commissioner has commenced an investigation into the privacy practices of Shenzhen Qingcheng Future Technology Co. Ltd (Shenzhen Qingcheng), the maker of the ‘HeyCyan’ Smart Glasses phone application. HeyCyan is the software used in the Anko smart glasses sold by Kmart, as well as in low-cost products for sale on Big W Marketplace and Amazon.
The OAIC has been monitoring the roll out of smart glasses since early 2026, and in August 2026 received correspondence from the Attorney-General requesting the Privacy Commissioner examine the privacy implications of smart glasses devices. From 12 August 2026, preliminary inquiries were issued to various manufacturers and distributors of smart glasses, including Meta, Kmart, Google and Shenzhen Qingcheng. These entities were asked to provide:
- clarification on how the smart glasses work including how they record information;
- who has access to the recorded information; and
- where the recorded information is stored.
The Privacy Commissioner has published a blog today summarising the outcomes of the preliminary inquiries. The OAIC did not receive a response from Shenzhen Qingcheng, which is based in China, in relation to the preliminary inquiries.
“In the absence of any response from Shenzhen Qingcheng to the OAIC’s preliminary inquiries, I have no assurance that it is protecting personal data of Australians as required by the Privacy Act,” said Privacy Commissioner Carly Kind.
“The failure of Shenzhen Qingcheng to respond to the OAIC’s inquiries raises concerns about the entity’s practices, procedures and systems to protect the personal information it holds, as required by APP 1.
“In those circumstances I considered it was important to commence an investigation so that I could utilise my full range of powers to examine this issue, including issuing compulsory information gathering notices.”
In addition to the opening of an investigation into Shenzhen Qingcheng, the Privacy Commissioner has written to retailers of devices using the HeyCyan app to express her concerns.
“The Australian community has expressed its concern about the proliferation of smart glasses and other surveillance wearables. Given the particular risks the OAIC has identified with the HeyCyan app, I would urge responsible retailers to consider whether it is appropriate to continue making these devices available,” Commissioner Kind said.
In line with the OAIC’s Privacy regulatory action policy, the OAIC will await the conclusion of the investigation before commenting further.
Background: HeyCyan application
- The HeyCyan application is required to use the full functionality of numerous lower-cost Smart Glasses models which are manufactured in China and distributed under various brand names.
- During its preliminary inquiries the OAIC found that these glasses were sold through numerous retailers, including Kmart’s Anko branded smart glasses, glasses sold via Big W’s marketplace, and glasses sold via Amazon and other retailers.
- Users of these smart glasses must connect their smartphone to the “HeyCyan” application to enable certain features such as listening to music, answering calls and utilising HeyCyan’s voice assistant.
- Using this feature involves information gathered by the glasses being collected via the HeyCyan app for processing.
- Following its investigation, the OAIC has a range of options if satisfied that an interference with the privacy of one or more individuals has occurred:
- This includes making a determination, which can include declarations that an APP entity take specified steps to ensure that the relevant act or practice is not repeated or continued, and to redress any loss or damage suffered by reason of the act or practice. If the investigation finds serious or repeated interferences with privacy of individuals, then the Commissioner has the power to seek civil penalties from the Federal Court of Australia.
About Commissioner-initiated investigations
The Commissioner is authorised to investigate an act or practice that may be an interference with the privacy of an individual or a breach of Australian Privacy Principle 1 under section 40(2) of the Australian Privacy Act 1988.
