Meta shipped 7 million cameras before it shipped consent

EssilorLuxottica sold more than 7 million Meta smart glasses in 2025. For most of that run, the only thing standing between a bystander and a recording was one small white LED. On July 7, 2026, Meta pushed a mandatory firmware update that shuts the camera off if that light is blocked or physically destroyed. Good fix. Years late.

Here is the sequence that matters. In late February 2026, Svenska Dagbladet and Göteborgs-Posten reported that contractors in Nairobi were reviewing footage from these glasses, including bathroom visits and sexual activity. On March 4, 2026, Gina Bartone and Mateo Canu filed a class action against Meta Platforms and Luxottica of America. On May 20, 2026, Texas Attorney General Ken Paxton opened a state investigation, citing facial geometry capture and an LED he called "easily hidden." In June 2026, Wired found dormant facial recognition code internally named "NameTag" in the companion app, which Meta stripped out after publication. By late July 2026, Instagram was banning pickup-artist accounts posting secret recordings of women, and activists were pasting posters over Meta glasses ads in New York, London, and Washington, D.C.

The hardware worked. The consent did not. That gap is the product now.

The Consent Debt

Every ambient device carries a balance sheet most product teams never bother to draw up.

On one side, capability shipped. On the other, consent negotiated. Consent here has three parts: what bystanders understand, what platforms allow, and what regulators have actually ruled on. When capability runs ahead of consent, you are not innovating. You are borrowing.

That borrowed amount is the Consent Debt. Interest accrues as lawsuits, attorney general inquiries, moderation categories that did not exist last year, and posters glued over your billboards.

Debt is fine if you can service it. Meta could not. The company put a camera and microphone on millions of ordinary faces, defaulted wake-word voice recordings to cloud storage for up to a year with no opt-out beyond manual deletion, and routed shared footage into a human review pipeline users could not exit once they opted in. Then it spent February through July 2026 paying interest. Firmware patches. LED tamper detection. Marketplace takedowns of LED-disabling mod services, legal threats against sellers, and a brand-new Instagram enforcement category for what the internet started calling "pervert glasses."

One sentence version: capability shipped minus consent negotiated equals liability accrued, and the invoice always arrives after distribution, never before.

The Difference Between a Two-Year Bet and a Ten-Year Bet

Google Glass died in 2013 of social rejection. It never reached scale, so the failure was cheap. Meta solved the distribution problem that killed Glass. It put the camera inside a Ray-Ban Wayfarer, a shape people already trusted, and moved 7 million units in a single year. Solving distribution before solving consent is how a cheap failure becomes an expensive one.

Amateurs optimize for the launch. Long-arc operators optimize for the license to keep operating.

There is a Buddhist idea worth borrowing here: shoshin, beginner's mind. The discipline of asking the naive question before you ship, not after a Swedish newspaper asks it for you. The naive question in this case was simple. If a stranger points this at me and I never know, what have we built? Nobody with authority appears to have insisted on an answer.

One contrast makes the strategic error legible. Phones buy you notice, because raising a phone is a visible social signal. Glasses buy you deniability, and deniability is a liability dressed up as a feature. A phone camera asks permission through body language. A glasses camera does not ask at all.

My read on this is that Meta made a category error about what it was selling. It thought it was selling a wearable. It was actually selling a change to the default rules of public space, and it did not have the standing to make that change unilaterally. When you alter a norm that billions of people rely on, you need a negotiation, not a product launch.

The counterargument deserves real weight. Plenty of serious people argue this is a Meta governance failure, not a flaw in ambient computing itself. Fix the defaults, process on-device, ban face recognition outright, forbid centralized retention, and the crisis largely evaporates. That view has evidence behind it. Meta chose default cloud voice retention and irreversible AI-training opt-in. Those were policy decisions, not laws of physics.

The other counterargument is that norms are adapting fine. More than 75 advocacy organizations coordinated against the glasses, a coalition led by the ACLU called face recognition on eyeglasses a red line, two regulators opened files, and a platform invented a new enforcement category, all inside six months. On that reading, the first generation is a stress test that triggers norm formation for the second.

Whether that optimism holds is unclear. Norm formation after 7 million units is not the same as norm formation before them, because you are now negotiating with an installed base that has habits and lobbying money. And the Financial Times reported in July 2026 that Meta is prototyping "super sensing" glasses with continuously active microphones and cameras. Those prototypes are not for sale and are not a shipping product. But nine days after the LED patch, the roadmap pointed at a device where the LED question becomes moot.

Compounding cuts both directions. Distribution compounds. So does distrust. Engadget's interviews found early enthusiasts who once wore the glasses everywhere now limiting them to the house, not because the hardware got worse, but because the social price got higher. The Verge's read was that Meta mishandled the moderation and policy enforcement around misuse, and I think that framing is correct. The hardware defect was cosmetic. The governance defect was structural.

Apple's reported smart glasses launch is 2027. That is roughly four years of watching someone else pay the tuition. It is the cheapest research budget in consumer hardware, and it is asymmetric in the best way: limited downside, large option value on being the company that arrives with consent already designed in.

Three signals inside the same shift

2031

Assume ambient wearables keep growing. Cameras and microphones in ordinary eyewear, always available, tied to an assistant with memory. That is less a prediction than an extrapolation of 7 million units and a 2027 Apple entry.

The five-year question is not whether the devices exist. It is who gets to set the default. Right now three parties are fighting for it: hardware makers writing firmware, platforms writing moderation policy, and states writing biometric law. Texas moved in May 2026. The UK ICO opened its inquiry after the Swedish reporting. Instagram is legislating through takedowns because nobody else moved fast enough.

Here is the asymmetric bet I would make. Consent infrastructure becomes a product category, not a compliance checkbox. Someone builds the equivalent of HTTPS for physical space: a machine-readable way for a person, a venue, or a room to signal capture rules, and devices that honor it because regulators require it and buyers demand it. Boring, unglamorous, and structurally advantaged.

The pattern generalizes past glasses. Every builder shipping agents that read inboxes, watch screens, or listen to meetings is running the same balance sheet. You are collecting data from people who never agreed to anything, because your user agreed on their behalf. That is Consent Debt with a different form factor.