Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones

Meta's Hidden Face-Recognition System: What We Know and Why It Matters

In a revelation that has sent shockwaves through the privacy and technology communities, Meta quietly embedded unreleased face-recognition code into its smart glasses platform, pushing it onto millions of smartphones without public announcement or user consent. The discovery, made through a code review conducted by WIRED, exposes a biometric identification system designed to recognize individual people using data already stored on their devices. For a company with a long and troubled history around user privacy, this silent deployment raises urgent questions about transparency, consent, and the future of wearable technology.

What Did WIRED Actually Find?

Journalists and security researchers at WIRED conducted a detailed review of code associated with Meta's smart glasses platform — the software ecosystem that powers devices like the Ray-Ban Meta smart glasses. Buried within that codebase, they uncovered the architecture of a face-recognition system that had never been publicly disclosed, announced, or approved for release.

The system is not a theoretical prototype sitting in a distant lab. It is embedded directly in software that has already been distributed to millions of phones around the world. According to the findings, the code is designed to identify individuals by cross-referencing biometric facial data stored locally on users' devices. In other words, anyone wearing a pair of Meta's smart glasses could potentially have the hardware and software infrastructure in place to identify a stranger on the street — silently, instantly, and without the target ever knowing.

While Meta has not publicly activated or released this feature to end users, its silent presence in production-grade code is alarming to privacy experts who argue that deployment of the infrastructure itself crosses important ethical and legal lines.

How Does the Face-Recognition System Work?

Based on the code reviewed by WIRED, the face-recognition system is designed to leverage biometric data that is already present on a user's smartphone. Modern smartphones store facial geometry data for features like Face ID or similar unlock mechanisms. Meta's embedded system appears to be architected to tap into this kind of stored biometric information and use it as a reference database for real-time identification.

The smart glasses themselves are equipped with cameras capable of capturing images or video in the user's field of view. When paired with a face-recognition backend — even one running partially on the phone — these glasses become a wearable surveillance tool. A person wearing them could conceivably point them at a crowd or an individual and receive identifying information about that person, all without any visible indication that a scan is occurring.

This is categorically different from opt-in facial recognition features seen in consumer apps. The covert nature of the code's deployment, combined with the passive data collection possible through glasses-mounted cameras, represents a qualitative leap in surveillance capability available to ordinary consumers.

Why Is This a Privacy Crisis?

Privacy advocates, legal experts, and civil liberties organizations have long warned that face recognition technology, in the wrong hands or without proper regulation, poses a fundamental threat to anonymity in public spaces. The discovery of Meta's hidden code brings those warnings into sharp relief for several reasons.

• No public disclosure: Meta did not inform users, regulators, or the public that this feature was being developed and deployed at the code level. Transparency is a cornerstone of ethical technology development, and this omission represents a serious breach of that principle.
• Biometric data is uniquely sensitive: Unlike a password or a PIN, you cannot change your face. Once biometric facial data is compromised, misused, or integrated into surveillance systems, the harm to individuals is potentially permanent. Laws like the Illinois Biometric Information Privacy Act (BIPA) exist precisely because legislators recognized this irreversibility.
• The consent problem: The people whose faces might be captured and identified by this system — bystanders in public, strangers in a coffee shop, pedestrians on the street — have given no consent whatsoever. They are not Meta users. They have no relationship with the company and no knowledge that they are being scanned.
• Meta's track record: The company has faced repeated scrutiny over its handling of user data, from the Cambridge Analytica scandal to FTC investigations. Critics argue that a company with this history should face a higher, not lower, bar when it comes to novel biometric data collection.

Meta's Response and the Regulatory Landscape

At the time of publication, Meta had not provided a detailed public explanation for why this code was embedded in a deployed platform without disclosure. The company's silence on the matter has only deepened concerns among researchers and regulators who are already scrutinizing the rapid expansion of AI-powered wearable devices.

From a regulatory standpoint, the deployment of face-recognition infrastructure — even in a dormant state — could trigger scrutiny under several existing legal frameworks. In the United States, state-level biometric privacy laws like BIPA in Illinois and similar statutes in Texas and Washington may apply. In Europe, the General Data Protection Regulation (GDPR) imposes strict rules on the collection and processing of biometric data, classifying it as a "special category" of personal data requiring explicit consent.

The European AI Act, which came into force in 2024, also places significant restrictions on real-time biometric identification in public spaces, particularly when conducted by private entities. If Meta's system were ever activated in European markets, the legal exposure could be substantial.

The Broader Implications for Wearable Technology

This story is not just about Meta. It is a warning about the trajectory of wearable technology as a whole. Smart glasses, augmented reality headsets, and AI-powered wearables are being developed by every major technology company, from Apple and Google to startups racing to commercialize spatial computing. Each of these devices shares a fundamental characteristic: they are worn on the body, they are always on, and they point outward at the world.

When you carry a smartphone, you choose when to take it out and use it. A camera in your pocket does not passively surveil your environment. Smart glasses are different. They normalize continuous, ambient capture of the world around the wearer — and as Meta's hidden code demonstrates, the infrastructure for turning that capture into identification can be built and distributed long before any public conversation takes place.

Policymakers, technologists, and civil society organizations need to treat this discovery as a catalyst for action. Clear rules governing biometric data collection by wearable devices must be established before these products become as ubiquitous as smartphones. The window for proactive regulation is open, but it is closing fast.

What Can You Do Right Now?

For consumers who own Meta's smart glasses or have the associated app installed on their devices, the immediate steps are limited but worth taking. Reviewing the app's permissions, limiting its access to facial recognition or biometric data APIs on your phone, and staying informed about software updates and policy changes are all prudent measures. For those who have not yet adopted the technology, this revelation is a timely reminder to research the privacy implications of any wearable device before purchase.

Ultimately, the responsibility for ethical deployment of technology should not rest solely on individual consumers. Meta and every company developing wearable AI systems must be held to a standard of transparency that matches the power of the tools they are quietly building and distributing — millions of phones at a time.