The Office of the Australian Information Commissioner has opened a formal investigation into Shenzhen Qingcheng, the maker of the HeyCyan software used in low-cost smart glasses sold through Kmart and other marketplaces, after testing found serious security and privacy flaws.
Who launched the probe and what is it investigating
It may also make retailers rethink the stock they sell. The Office of the Australian Information Commissioner (OAIC) is investigating Shenzhen Qingcheng Future Technology. This company makes the HeyCyan smartphone software. HeyCyan runs several low-cost smart glasses sold at Kmart, Big W Marketplace, and Amazon in Australia www.nine.com.au.
Independent testing reported by Australian media found multiple serious security flaws in the HeyCyan phone app. The ABC report said testers found exposed email addresses, dates of birth, images and video; the ability for nearby attackers to hijack devices over Bluetooth without a password; and evidence some data were being sent to servers in China www.abc.net.au.
Privacy Commissioner Carly Kind said she had "no assurance that it is protecting personal data of Australians as required by the Privacy Act." Shenzhen Qingcheng did not answer the OAIC’s preliminary questions. Because of this, the commissioner started the investigation. This lets the regulator use compulsory information-gathering powers www.smartcompany.com.au.
The OAIC had been monitoring the rollout of camera-equipped smart glasses since early 2026 and acted after the Attorney-General, Michelle Rowland, asked in August that the issue be prioritised. The regulator contacted Meta, Google, Kmart and other distributors as part of preliminary inquiries before opening the formal probe.
HeyCyan is used by a number of low-cost, AI-enabled smart glasses models and provides functions such as connecting devices over Bluetooth, capturing images, video and audio, playing music, making calls and interfacing with an AI assistant. Those features are needed for full functionality across different hardware sold under varied brand names.
The OAIC asked multiple retailers and importers preliminary questions. The ABC report says Shenzhen Qingcheng is the only firm under formal investigation. This is because it did not respond to repeated outreach.
What does this mean for regulators, markets and users?
The OAIC’s formal investigation gives the regulator statutory powers that can translate into concrete enforcement outcomes. The office can issue compulsory notices for information, make declarations ordering a company to stop practices that put privacy at risk, provide redress for losses and damages, and, if it finds serious or repeated offences, seek civil penalties through the Federal Court.
Privacy law carries potential monetary penalties of up to A$50 million per contravention under the Privacy Act. The commissioner noted fines can in principle be applied per individual affected and the OAIC said that approach would be the target “should our concerns be borne out” in its inquiry.
In the short term, regulators have already pushed retailers to reassess stock. The OAIC has written to the Australian Retail Council and to individual sellers warning them the company is under investigation and urging “responsible retailers” to consider whether it is appropriate to continue making these devices available. Retailers face reputational risk and inventory decisions that could include suspending sales, pulling listings on marketplaces, or requiring software fixes from suppliers. Analysts and retail-sector commentary say that risk falls on local sellers that source white-label electronics when third-party software operates outside domestic compliance frameworks.
Independent testing showed clear risks to consumers. Personal information like email addresses and birth dates was exposed. Stored images and videos could be accessed by third parties. Devices could be controlled by attackers nearby via Bluetooth without any authentication. Privacy advocates warn that camera-equipped glasses cause consent problems. Bystanders cannot realistically give consent to being filmed. Tom Sulston, head of policy at Digital Rights Watch, said cheaper camera glasses make this consent problem worse.
The company behind HeyCyan disagreed with some findings. It said engineers fixed security flaws. However, cybersecurity analysts told reporters that some fixes were incomplete as of early October. This uncertainty creates risks for investors and retailers. Further findings could lead to product removals or court orders. These could limit supply while the OAIC uses its compulsory powers.
On policy, Canberra has so far declined a blanket import ban but is considering tighter restrictions on camera-enabled glasses inside government workplaces. That signals a narrower regulatory response is under active consideration while the OAIC inquiry proceeds, according to the ABC report.
Taken together, the OAIC’s formal investigation places Shenzhen Qingcheng at the centre of legal, commercial and technical scrutiny and pressures retailers to justify continued sales of devices dependent on HeyCyan. The next decisions to watch are whether the OAIC uses its compulsory information powers and whether major retailers suspend sales or remove listings while the regulator completes its inquiry.
This article was created with AI assistance.
