Australia Opens Privacy Investigation Into App Behind Kmart’s Smart Glasses

Australia’s privacy commissioner Carly Kind has opened a formal investigation into Shenzhen Qingcheng, maker of the HeyCyan app used with Kmart’s Anko smart glasses. A company representative told ABC News that engineers had fixed security flaws. But outside analysts found many repairs ineffective or incomplete as of October 2, leaving a gap between the company’s assurances and their findings.

Unanswered questions and exposed data

Kind said Shenzhen Qingcheng ignored multiple attempts to obtain information, without even acknowledging the regulator’s communications. The investigation also follows concerns arising from third-party analysis of the technology and the company’s privacy policy. Its silence distinguished it from the other companies her office contacted.

An earlier ABC investigation identified more than a dozen serious security flaws in the HeyCyan app and website. Independent testing found that sensitive information, including email addresses, dates of birth, images and videos, was exposed to hackers. Nearby attackers could also take over the glasses through Bluetooth without a password.

Cybersecurity analysts at NSB Cyber and Abstract Shield found several improvements after the company’s response, but many fixes remained incomplete or did not work. Kind also raised concerns about possible facial recognition use. That is a concern under examination, not a confirmed capability.

From requests to compulsory answers

The formal inquiry gives the commissioner power to compel Shenzhen Qingcheng to provide information about compliance with Australian law. If the company continues ignoring the regulator, Kind can seek a court injunction to limit supply of its products. Those are enforcement options, not sanctions already imposed.

Kmart, importer BDI Technology, Meta and Google faced preliminary inquiries but are not subjects of this investigation. Kind has nevertheless notified retailers and the Australian Retail Council, urging sellers to reconsider making the affected products available.

Responsible retailers might want to consider whether it is appropriate to continue making these products available.

Carly Kind, Australian privacy commissioner, speaking to ABC News

Why the software provider is the target

The inquiry also highlights a boundary in Australian privacy law. As Kind explained in comments reported by the Guardian, the Privacy Act applies to companies and Commonwealth agencies, not individuals using the devices. Retailers and manufacturers may have no obligations under that law if they collect no personal information connected to the glasses.

Instead, Kind said the software provider is likely to collect and hold information for privacy-law purposes. That distinction puts the handling of recorded information at the center of this inquiry, rather than making every seller or wearer subject to the same legal duties.

Proposed government reforms would replace a test of whether collection is reasonably necessary for an entity’s activities with a fair-and-reasonable test. Kind said that would require consideration of genuine choice over collection and children’s best interests. She argued the changes would raise the bar for surveillance wearables; they remain proposed reforms, not rules already in force.