SensorOn

1.Introduction

Camera-bearing wearables are moving into the mainstream, and their indicator lights are under measured pressure. A 2026 study of 525 bystanders and wearers found that only 41.3% of bystanders and 35.3% of wearers consider current LED indicators sufficient, with the leading failure modes being lights that are too small to notice and lights that disappear in bright environments [22]. Germany's Hamburg data-protection commissioner reached the same conclusion about a shipping product in 2026 [28], Ireland's Data Protection Commission questioned indicator adequacy as early as 2021 [27], and Pennsylvania has a pending bill requiring visible, non-disableable recording indicators on wearable recording devices [26]. Platform makers have each added tamper responses independently: Meta made camera-disable-on-LED-tamper mandatory by firmware in July 2026 [12], and Samsung announced equivalent behavior for glasses due in fall 2026 [28].

No shared specification defines what these lights mean or how to test them, and no existing convention distinguishes a device that is sensing while retaining nothing from a device that is recording. This document defines the SensorOn Standard (SOS): one indicator lamp, four states covering the sensing lifecycle, each state's behavior adapted from an indicator convention already in wide deployment, each requirement carrying measurable values, and a tiered conformance model that separates what any bench can verify from what accredited-laboratory certification verifies.

2.Scope

This specification applies to camera-bearing wearables: devices worn on the body that carry one or more image sensors, including smart glasses, camera earbuds, pendants, and body-worn cameras. On an in-scope device, the specification's state and retention rules cover all of the device's sensors, including microphones, depth and ranging sensors, motion sensors, and location.

The specification defines the behavior of one status lamp, the sensor indicator: its states, colors, intensities, timing, the retention and action rules each state asserts, the disclosure that backs those assertions, and the conformance tiers under which they are verified. It does not define data formats, network protocols, or any user interface beyond the lamp. A maker that deviates from this specification SHOULD disclose the deviation, and the reason for it, to users. The state model generalizes beyond cameras; section 13 describes the intended future scope.

3.Conformance language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 (RFC 2119, RFC 8174) [1] when, and only when, they appear in all capitals. This document uses MUST, MUST NOT, SHOULD, and MAY. A device conforms to this specification when it satisfies every MUST and MUST NOT in section 6, at the tier it declares under section 7.

4.The four states

5.Definitions

Derived data

Measurements and meaning that cannot reproduce the sensed moment: scalars (a temperature, a humidity, a heart rate), counts, classifications, labels, structure. "A person is present." "That was the wake word." The term follows the data-category vocabulary of ISO/IEC 19944-1 [20]. It is used by data-path statements and audits to describe boundaries; it does not authorize retention. Green states retain nothing (6.5).

Reconstructive data

Any representation from which a substantial replay of the moment could be produced: raw or compressed audio, video, or imagery, verbatim transcripts, and high-rate traces of any sensed channel (a millisecond temperature log is a transcript of the thermal channel).

The stenographer's rule

A transcript is a recording. Full stop. Stenographers record court proceedings directly to specialized notation equipment and can read it back verbatim. A microphone or vibration sensor capable of sensing spoken language, saving what was said in text form which can then be read back later or transmitted, has recorded what it sensed.

Interpretation buffer

The transient store of raw sensor input a device holds in order to interpret it. A wake-word detector holds the last few seconds of audio to recognize its phrase; a gesture recognizer holds frames. Its handling is specified in 6.5.

Persistence

Reconstructive data existing beyond the live moment: written to durable storage on any medium, or transmitted off the device.

The replay test

Could any party, at any later time, replay a substantial depiction of this moment? If yes, the device is RECORDING.

6.Normative requirements

6.1Interlock

• The sensor indicator MUST be powered from the same rail as the sensor array, such that no sensor can draw current while the indicator is unpowered. Software MUST NOT be able to extinguish the indicator while any sensor is live. (This is the power-rail design recommended by the iSeeYou researchers after they defeated a first-generation firmware-mediated interlock from an unprivileged application [21]; see section 9.)

6.2Photometry and visibility

• Aperture. The indicator's emitting aperture MUST be no smaller than 2.0 mm in its smallest dimension. (Press reporting of Meta's hardware revisions describes the capture LED growing from 1 mm to 2 mm between generations for daylight visibility; the floor adopts the corrected size and is marked provisional in section 8.)
• Intensity. Measured as averaged LED intensity on the indicator's axis per CIE 127 Condition A [8], SESSION MUST emit ≥ 50 mcd, and RECORDING MUST emit ≥ 50 mcd during its on phase. Devices intended for outdoor use SHOULD reach 200 mcd. (50 to 200 mcd is the established engineering band for sunlight-readable indicators [9].)
• State ratios. AMBIENT's peak intensity MUST be between 20% and 50% of SESSION's steady intensity, so that the brighter lamp always indicates the more capable state. AMBIENT's trough MUST be ≥ 25% of AMBIENT's own peak: in AMBIENT the lamp is never off.
• Adaptive dimming. The device MAY scale all intensities with ambient illuminance (office is roughly 300 to 500 lx, overcast daylight 1,000 lx, direct sun 100,000 lx). At no ambient level MUST the luminance contrast between the lit indicator and the device surface immediately around it fall below 3:1, the floor for basic indicator visibility in HMI practice [10].
• Chromaticity. Measured per CIE 127 geometry [8], SensorOn green MUST fall within the aviation-green region of 14 CFR 25.1397 [6]: x ≤ 0.440 − 0.320y, x ≤ y − 0.170, y ≥ 0.390 − 0.170x. SensorOn red MUST fall within the SAE J578 signal-red region [7]: y ≤ 0.335, x + y ≥ 0.980.
• Distance. At 3 m a 2 mm lamp subtends about 2.3 arcminutes, below the 16 to 22 arcminutes ISO 9241-303 associates with reliable hue identification [13]. The waveform, not the hue, is therefore the primary identification channel (6.3): the state MUST be identifiable at 3 m under 500 lx from waveform alone.

6.3Timing

• Global ceiling. The indicator MUST NOT produce more than 2 luminance flashes per second in any state. WCAG 2.3.1 sets the photosensitive-safety limit at 3 flashes per second [2]; the 2-per-second ceiling provides 33% margin, and the 5 to 30 Hz band associated with elevated seizure risk [3] is never approached.
• AMBIENT. Any periodic sequence MAY be used, including patterns paced to the wearer's heartbeat or breathing. The sequence MUST satisfy: cycle period between 2 s and 6 s (maritime flashing-class rhythms begin at 2 s cycles [4]); instantaneous intensity ≥ 25% of the state's peak at all times, so that a standard 2-second glance [5] always observes a lit lamp; and monotonic rise and fall times of ≥ 300 ms each.
• SESSION. Steady. Luminance MUST NOT vary by more than 10% within any 1-second window, which is below the WCAG definition of a flash [2].
• RECORDING. A square blink at 1.0 to 2.0 Hz with a duty cycle of 40% to 60%, transitions completing in ≤ 50 ms, and the off phase reaching full extinction. Red at 2 Hz measured highest in NASA conspicuity testing, above a steady light [14]; fire-alarm visual appliances use the same 1 to 2 Hz band [15].
• Waveform redundancy. The three lit states MUST remain distinguishable with all hue information removed: AMBIENT never extinguishes and has no hard edges, SESSION never modulates, RECORDING extinguishes with hard edges. Approximately 1 in 12 men cannot rely on the red/green distinction [16]; per WCAG 1.4.1 and ISO 9241-112, color MUST NOT be the only channel [17].

6.4Color discipline

• The sensor indicator MUST emit only the two chromaticities defined in 6.2, plus dark. It MUST NOT display any other hue in any state.
• The indicator MUST NOT be used to encode user status, mood, notifications, brand identity, or anything else. A second, physically separate lamp MAY exist for other purposes, provided it cannot be confused with the sensor indicator in position or color.
• Green and red are reserved. Green means sensing without keeping; red means persistence. A SensorOn device MUST NOT reassign them. Industrial color-coding practice has assigned red to the highest-priority state since IEC 60073 [18].

6.5State capabilities: what each state is allowed to do

• AMBIENT is sensing without consequence. In AMBIENT the device senses, evaluates, and forgets. It MUST NOT retain anything it senses, in any form. It MUST NOT transmit anything it senses. The only action it MAY take is changing its own state: waking on a wake phrase, a QR code, a gesture, or a pre-defined sensor threshold. The purpose of the sensing is out of scope; every AMBIENT device asserts the same retention behavior regardless of what it is watching for.
• SESSION is sensing with agency, and it is temporal. Once invoked, whether by its user or by one of its own pre-defined triggers, the device MAY sense at higher fidelity and MAY act: answer, control, or deliver content on the user's explicit direction. All processing of sensed data during a session occurs on the device. The device MUST NOT transmit anything it senses off the device, and MUST NOT persist any portion of a session: not audio, not a transcript, not readings, not a log of the exchange. The consequences of a session's actions MAY persist (the switch may be turned from off to on a lamp; the answer was spoken), because an effect on the world is not a replay of the moment; content the user explicitly composes and directs the device to deliver is such a consequence. If any portion of a session is saved, or persists beyond the session in any form, the device MUST display RECORDING, not SESSION, for that period. The solid bright lamp indicates that the device is currently able to act.
• Interpretation buffers do not persist. AMBIENT and SESSION MAY hold an interpretation buffer of reconstructive data, PROVIDED all of the following hold: it is bounded at 10 s or the minimum the interpretation requires, whichever is shorter (provisional value); its contents are destroyed or overwritten as interpretation completes; and no path exists, in hardware or software, to promote its contents to persistence or to transmit them. A buffer that can be promoted fails the replay test for every moment it holds: pre-event capture is RECORDING for as long as it is armed.
• RECORDING is persistence. The device MUST display RECORDING whenever the replay test (section 5) answers yes: reconstructive data written to durable storage on any medium, or transmitted off the device. The indicator MUST enter RECORDING no later than the moment persistence begins. Because green states keep nothing, RECORDING is the only state in which anything the sensors read persists, in any form, at any rate.

6.6Tamper

• A covered, removed, or damaged indicator MUST power down the entire sensor array until the indicator is restored and verified. Meta's glasses implement this behavior, disabling the camera when the capture LED is occluded or modified and verifying the lamp's emission with the camera itself; Meta made it mandatory by firmware in July 2026 [12]. A conforming device MAY use that optical self-check method.

6.7Disclosure: the data-path statement

• The maker MUST publish a data-path statement for each device model: a machine-readable, versioned, cryptographically signed document that maps each state to what is retained, what is transmitted and where, and what actions the device can take; names the firmware versions it covers; states the interpretation-buffer bound; and declares the device's conformance tier (section 7).
• Any claim in the data-path statement that an output is derived data MUST be supported by a published invertibility analysis. Representations assumed to be image-free have been inverted before: event-camera streams have been reconstructed into grayscale video [25], and an ambient light sensor has been used to image hand gestures with no camera at all [24].
• The device or its packaging MUST carry a QR code or URL that resolves to the current data-path statement, and, for certified devices, to the registry entry (section 7). This is the disclosure mechanism the FCC's U.S. Cyber Trust Mark program uses: a mark paired with a QR code that links to a public registry of per-product security information [29].

7.Conformance tiers and certification

The requirements in section 6 divide into two classes. Photometry, timing, color, the interlock, and tamper behavior (6.1 through 6.4, 6.6) are observable properties: any bench with the section 8 equipment can verify them. The retention and capability rules (6.5) are claims about internal behavior: verifying them requires storage forensics, traffic analysis, and firmware review. The tier structure makes that distinction explicit rather than leaving it implied.

• Tier 1, Interlocked. The device passes section 8 items 1 through 4 and 7 through 8 at any competent bench. Tier 1 verifies the lamp itself: its optics, its timing, its interlock, its tamper response. A Tier 1 device's green states assert the 6.5 retention rules but have not had them independently audited, and the data-path statement MUST say so.
• Tier 2, Certified. An accredited, independent laboratory has verified the full section 8 procedure, including the retention, transmission, and buffer items (5 and 6), against a specific firmware version. Certification binds to that firmware version in a public registry entry containing the signed data-path statement and test report summary. A change to any firmware component that touches sensing, retention, transmission, or the indicator MUST be re-certified before the device may continue to claim Tier 2.
• The certification structure follows the two-role model of the FCC's U.S. Cyber Trust Mark program: accredited laboratories perform the technical testing, and a separate administrator authorizes use of the mark and maintains the registry [29]. No SensorOn certification body exists today; section 10 states the current status.

8.Conformance testing

Bench equipment: a colorimeter and photometer per CIE 127 Condition A geometry (1 cm² aperture, on-axis, 100 mm) [8], a photodiode with an oscilloscope or a high-speed camera, a lux meter, and a network capture on the device's uplink. The procedure:

1. Chromaticity. In each lit state, measured chromaticity falls inside the 6.2 boundaries.
2. Intensity. SESSION measures ≥ 50 mcd; AMBIENT's peak measures 20 to 50% of SESSION; AMBIENT's trough measures ≥ 25% of AMBIENT's peak. RECORDING's effective intensity, computed by the Blondel-Rey method with α = 0.2 s [19], measures ≥ 50 mcd.
3. Timing. A 60-second photodiode log of each state shows: AMBIENT period 2 to 6 s with rise and fall ≥ 300 ms and no sample below 25% of peak; SESSION variation ≤ 10% per second; RECORDING at 1 to 2 Hz, 40 to 60% duty, off-phase at extinction; and no state anywhere produces more than 2 flashes per second.
4. Interlock. With the indicator circuit opened, no sensor on the device can draw current. With any sensor active, the indicator is emitting.
5. Data path (Tier 2). In AMBIENT and SESSION, a 24-hour capture of the device's traffic contains no sensed payloads of any kind, and storage inspection finds no artifact of anything sensed; after a session ends, storage inspection finds no artifact of it. Any observed persistence coincides with the indicator in RECORDING. The device's behavior matches its published data-path statement.
6. Buffers (Tier 2). The interpretation buffer's bound is stated in the data-path statement and measures ≤ 10 s; a forensic read immediately after a green-state interpretation completes recovers no buffer contents; no code or hardware path promotes buffer contents to storage or the uplink. If the device offers pre-event capture, the indicator shows RECORDING whenever that capture is armed.
7. Tamper. Covering the indicator for 10 seconds powers down the sensor array, and it stays down until the indicator is uncovered and verified.
8. Glance test. An observer with normal acuity at 3 m under 500 lx, viewing through a neutral filter that removes hue, correctly names the state within one 2-second glance, for all three lit states.

9.Security considerations

What the lamp proves, and what it claims. The interlock (6.1) proves a physical fact: a sensor is drawing power. The photometric and timing requirements (6.2, 6.3) prove the lamp behaves as specified. The state semantics (6.5) are claims about internal data handling that no light can prove by itself. This specification addresses that gap in three ways: the tier structure (section 7) states which claims have been independently audited, the data-path statement (6.7) turns the claims into signed, versioned, falsifiable representations, and Tier 2 certification pins the audited behavior to a firmware version.

Threat model. Against an honest maker with defects, Tier 2 laboratory testing (section 8, items 5 and 6) is designed to find retention and transmission that the design did not intend. Against an adversarial maker, protection comes from the signed data-path statement and certification record: a false green state becomes a documented misrepresentation, attributable and actionable, rather than an unverifiable claim. Against third-party modification of the device, 6.6 requires that a covered, removed, or damaged lamp power down the sensor array. Against firmware change after certification, section 7 requires re-certification, and the registry entry names the certified firmware version so a mismatch is detectable.

Interlock history. The iSeeYou attack (USENIX Security 2014) disabled the indicator LED of first-generation Apple iSight webcams from an unprivileged application, because that interlock was mediated by reprogrammable firmware [21]. The authors' recommended remedy was to tie the indicator to the sensor's power supply in hardware. Requirement 6.1 adopts that remedy as a mandate; the attack is the reason software never appears in the 6.1 chain.

Reconstruction risk. The derived-versus-reconstructive boundary erodes as inversion techniques improve. Event-camera streams, long treated as image-free, are reconstructable into grayscale video [25]; an off-the-shelf tablet's ambient light sensor has been used to image hand gestures with no camera involved [24]. This is why 6.7 requires an invertibility analysis behind every derived-data claim, and why the analysis must be revisited as the state of the art moves. On-sensor inference that emits only metadata is commercially deployed (Sony's IMX500 runs in 500 convenience stores emitting, per Sony, no image data that could identify individuals [30]), so the AMBIENT architecture is buildable; the burden this specification adds is proving the outputs stay derived.

Limits of indicator lights. The empirical record shows current indicators underperform: majorities of surveyed bystanders and wearers find existing LEDs insufficient, citing size, daylight visibility, unfamiliar meaning, and obstructability [22][23]. Each cited failure mode maps to a requirement in this specification (aperture and intensity floors for size and daylight; one convention for meaning; tamper power-down for obstruction; waveform redundancy for color vision), and the glance test (8.8) measures the result. This specification raises the measurable floor of indicator design. It does not by itself guarantee that any bystander notices, understands, or trusts the signal.

10.Deployment considerations

Voluntary signals without enforcement have failed before. P3P was retired by the W3C in 2018 after major-browser support had already ended [31]; Do Not Track was never honored by the largest sites, Yahoo and Twitter adopted and then abandoned it, and the W3C closed the Tracking Protection Working Group in January 2019 citing insufficient deployment [31]. Cranor's analysis of these mechanisms concludes they are necessary but not sufficient without incentives and enforcement [32]. This specification's response is structural: the certification mark and registry (section 7) exist to supply the adoption incentive, and the signed data-path statement (6.7) exists to make a false claim legally actionable rather than unenforceable.

The certification program is prospective. No SensorOn certification body, accredited laboratory roster, or registry exists today. The model it follows, the FCC's U.S. Cyber Trust Mark, is itself still reaching steady state: its lead administrator role changed hands in 2025-2026 and its administrator roster was still being filled as of August 2026 [29]. Until a program exists, Tier 2 is a specification of what certification must verify, not a service a maker can buy.

Regulatory alignment. Pennsylvania HB 2603 (2025-2026 session) would require a visible, non-covered indicator on wearable recording devices, with civil penalties for retailers and manufacturers and criminal penalties for individuals who disable indicators; as of August 2026 it is pending in committee [26]. The requirements in sections 6.1, 6.2, and 6.6 are written so that a bill of this shape can cite measurable thresholds instead of the single word "visible." GDPR Article 5(1)(c) (data minimisation) and Article 25 (data protection by design and by default) [33] describe in law the behavior the AMBIENT and SESSION states describe in light.

11.Adapted, not invented

Broadcast produced two lamp conventions without a standards body: the ON AIR lamp over the studio door, and the tally light on the live camera. Consumer video inherited the blinking red REC lamp, which also became convention without ever being standardized. Sleeping laptops taught the breathing standby pulse. Phones later added the green and orange sensor dots. None of this was coordinated. The pieces of the language exist; they have not previously been assembled into one specification with measurable requirements.

Nobody made the blinking red light on a 1980s camcorder a standard. Somebody should make I'm sensing one.

12.Adoption

The SensorOn Standard is free to implement. There is no membership or license fee. To adopt it: wire the lamp to the sensor rail (6.1), implement the four states (6.2 through 6.5), publish the signed data-path statement with its QR pointer (6.7), declare your tier (7), and verify with the section 8 procedures. Tier 2 certification becomes available when a certification program exists (section 10).

The specification is developed in public at github.com/justintormey/sensoron. Errata, proposals, and the section 14 open questions are tracked there as issues; changes arrive as pull requests and are decided by the editor. The specification text is licensed CC BY 4.0; the wordmark and marks are governed by section 15.

13.Future scope (informative)

The state machine is not camera-specific, and future revisions are expected to extend scope to other sensing devices, worn or installed: microphones, radar and presence sensors, environmental and chemical sensors. The lifecycle reads the same on the simplest hardware. A temperature sensor in AMBIENT pulses green, sampling once per minute, awaiting a pre-defined threshold; when a reading crosses it, the device enters SESSION, solid green, sampling once per millisecond, still keeping nothing; when a recording is triggered, the indicator blinks red while readings are captured or transmitted; then it returns to AMBIENT. Every state change is visible to anyone present, on a device with no camera at all.

14.Open questions (draft)

1. The invertibility analysis (6.7) needs a normative test methodology: what demonstration suffices to call a representation non-invertible, and how often must the analysis be renewed as reconstruction techniques improve?
2. Phones already taught an orange dot to mean microphone only. Does SensorOn adopt amber as an audio-only modifier on AMBIENT and SESSION? Until resolved, the closed color set in 6.4 governs.
3. Light-only signals fail for bystanders who cannot see them and in daylight that washes them out. What is the companion channel?
4. The provisional photometry values in section 8 need validation against real hardware across the full 300 to 100,000 lx range, and the 8.8 glance test needs a human-subjects study.
5. Who runs the certification program: an existing administrator (the Cyber Trust Mark's structure admits new device categories), a new body, or a self-declaration regime with third-party audit rights?

15.The wordmark and marks

The standard's identity consists of a wordmark, a logo, and an adopter mark. This section defines their construction and permitted use.

15.1Wordmark

The wordmark is the name set in IBM Plex Sans SemiBold with tracking of -1.5% of the point size: one word, two capitals, with "On" in Standard Green on light grounds and Lamp Green on dark grounds. The name MUST NOT be set in all capitals, hyphenated, or split into two words. In running text, the first mention is "the SensorOn Standard (SOS)"; below 16 px, the acronym SOS replaces the wordmark. Clearspace on all sides equals the cap height of the S at the set size, and one-color settings render the whole wordmark in a single color.

15.2Logo

The logo is the Pulse: the lamp drawn mid-breath, a dot inside its own rings within a keyline circle, representing the AMBIENT state's never-extinguished pulse. It identifies the standard itself and MAY appear wherever the standard is referenced. At small sizes one ring is dropped; the dot and the keyline remain.

15.3Adopter mark

The adopter mark is a rounded-square badge in the compliance-mark lineage: the lamp glyph above a rule, the letters SOS below it, and the subtext STANDARD. It is for the devices, packaging, and documentation of products that implement this specification. The subtext CERTIFIED is reserved: it MUST NOT be used before a certification program exists (section 10), and then only by devices holding a current Tier 2 registry entry (section 7). At 10 mm and below, the badge reduces to the rounded square, the ring, and the dot. The badge MUST remain legible in one color and reversed.

15.4Identity colors

Green is reserved for the lamp element and the wordmark's "On". Red is not an identity color: it belongs to the RECORDING state (6.4) and MUST NOT appear in the wordmark, the logo, or the adopter mark.

16.References

1. [1] IETF BCP 14: RFC 2119 and RFC 8174
2. [2] W3C WCAG 2.1 SC 2.3.1, Three Flashes or Below Threshold
3. [3] MDN, Web accessibility for seizures (5 to 30 Hz photosensitive band)
4. [4] IALA Recommendation E-110, Rhythmic Characters of Lights on Aids to Navigation
5. [5] NHTSA, Visual-Manual Driver Distraction Guidelines; Klauer et al. 2006
6. [6] 14 CFR 25.1397, Color specifications (aviation green)
7. [7] SAE J578, Color Specification (signal red)
8. [8] CIE 127:2007, Measurement of LEDs
9. [9] The Struggle for Sunlight Readability (50 to 200 mcd daylight band)
10. [10] FAA, flight-deck legibility research (3:1 minimum contrast)
11. [11] Apple, About the orange and green indicators
12. [12] Meta, Meta's AI Glasses: Your Questions Answered (July 2026, mandatory LED-tamper camera disable); US patent 12,363,403
13. [13] ISO 9241-303, Requirements for electronic visual displays
14. [14] NASA TN D-7960, Conspicuity of Target Lights
15. [15] NFPA 72 / ADA visual notification appliances; UL 1971
16. [16] Birch 2012, Worldwide prevalence of red-green color deficiency, JOSA A 29(3)
17. [17] W3C WCAG 2.1 SC 1.4.1, Use of Color; ISO 9241-112, Principles for the presentation of information
18. [18] IEC 60073:2002, Coding principles for indicators and actuators (secondary-sourced)
19. [19] NIST, Physical Measurement of Flashing Lights (Blondel-Rey, α = 0.2 s)
20. [20] ISO/IEC 19944-1:2020, Data flow, data categories and data use, Part 1
21. [21] Brocker, M. and Checkoway, S., iSeeYou: Disabling the MacBook Webcam Indicator LED, 23rd USENIX Security Symposium, 2014, pp. 337-352
22. [22] Wang, X., Peng, K., Yi, X., and Li, H., Mind the Gap: Mapping Wearer-Bystander Privacy Tensions and Context-Adaptive Pathways for Camera Glasses, CHI 2026 (preprint)
23. [23] Bhardwaj, D., Ponticello, A., Tomar, S., Dabrowski, A., and Krombholz, K., In Focus, Out of Privacy: The Wearer's Perspective on the Privacy Dilemma of Camera Glasses, CHI 2024
24. [24] Liu, Y., Wornell, G. W., Freeman, W. T., and Durand, F., Imaging privacy threats from an ambient light sensor, Science Advances 10(2), 2024
25. [25] Rebecq, H., Ranftl, R., Koltun, V., and Scaramuzza, D., High Speed and High Dynamic Range Video with an Event Camera, IEEE TPAMI 43(6), 2021; Du, B. et al., Event Encryption for Neuromorphic Vision Sensors, Sensors 21(13), 2021
26. [26] Pennsylvania House Bill 2603, 2025-2026 Regular Session, Requiring Visual Indicators for Smart Glasses (pending in committee as of August 2026)
27. [27] Data Protection Commission (Ireland), Statement concerning Facebook View glasses, 17 September 2021
28. [28] Hamburg Commissioner for Data Protection (T. Fuchs), press statement, July 2026 (indicator not noticeable in daily life); Samsung Intelligent Eyewear reveal with LED-tamper camera disable, announced 22 July 2026 for fall 2026
29. [29] FCC, U.S. Cyber Trust Mark; Public Notice DA-26-18 (program status: lead administrator transitioned to ioXt Alliance April 2026; roster still forming as of August 2026)
30. [30] Sony Semiconductor Solutions, Edge AI-Driven Vision Detection Solution Introduced at 500 Convenience Store Locations, 24 April 2024
31. [31] W3C, P3P 1.1 (retired 30 August 2018); Tracking Protection Working Group (closed 17 January 2019)
32. [32] Cranor, L. F., Necessary But Not Sufficient: Standardized Mechanisms for Privacy Notice and Choice, J. on Telecomm. and High Tech. L. 10, 273 (2012)
33. [33] Regulation (EU) 2016/679 (GDPR), Art. 5(1)(c) and Art. 25