Smart Glasses Are Already in Your Building. Your Filter Cannot See Them.

Thirty-nine states and the District of Columbia now require districts to ban or restrict student cellphone use. Very few of those policies say anything about eyewear.

Meanwhile Parker, Arizona; Fairfax County and Prince William County, Virginia; Greenville County, South Carolina; Carson City, Nevada; and Pinellas County, Florida have all moved in the last year to prohibit AI smart glasses on campus. Utah passed a law in July banning them during school hours outright, with carve-outs a local board has to grant deliberately. The College Board banned them from the SAT in February.

So the policy layer is moving. Good. Here is the part nobody puts in the press release:

A ban on smart glasses is, for most schools, completely unenforceable by their filtering stack. Not partially. Not with a tuning pass. The traffic does not touch the network you control.

This is the same failure shape we wrote about when auditing our own filter: a visible control with absent enforcement. Last time the control was a toggle in a console. This time it is a line in a student handbook. The structural problem is identical — somebody wrote down an intent, and nothing underneath it checks.

---

Why your filter is blind to them

A pair of Meta Ray-Bans is not a laptop. It is a peripheral. The glasses pair over Bluetooth to a phone in the student's pocket, and that phone is the thing with an internet connection. When a student asks the AI assistant a question or uploads a clip, the request leaves the building over the phone's cellular radio, not your Wi-Fi.

Walk that through your own stack:

Every row is a no, and the reason is the same in every row. A filter filters the traffic it is given. Personal eyewear tethered to a personal phone on a carrier network gives it nothing.

Any vendor who tells you their product "handles smart glasses" owes you a precise answer to one question: handles them on which network path? If the answer is anything other than "when the device is associated to school Wi-Fi," the claim is marketing.

We would rather say the limit out loud than let a district certify a control it does not have.

---

What you can actually enforce

The gap is real, but it is not total. There are four things that genuinely work, and it is worth being precise about which problem each one solves — because they solve different problems, and only one of them is filtering.

1. School Wi-Fi association is visible, and some students will join

A meaningful number of students connect the paired phone to school Wi-Fi to save cellular data. That phone is now on your network, and everything it carries — including the glasses' companion app sync, media uploads, and assistant queries — crosses a path you control.

On that path, normal filtering applies. Category policy, SSL inspection, logging. The companion app's sync endpoints are ordinary HTTPS traffic to identifiable hosts.

This catches the convenience case, not the determined case. A student who wants to evade it turns Wi-Fi off. Treat it as coverage of the majority, not a control.

2. Device presence on the network is detectable, even when content is not

Separate the two questions. What is this device loading is a filtering question and you lose it when the traffic goes cellular. Is an unmanaged device present is an inventory question and you can often still answer it.

Wireless infrastructure sees MAC addresses, OUI vendor prefixes, and client hostnames for anything that associates. Most district-grade Wi-Fi controllers already log this. An unmanaged client that has never enrolled in your MDM is a flag on its own, independent of what it is.

That is how you enforce a ban — which is a presence rule — as opposed to a filter, which is a content rule. Do not conflate them. Most districts write a presence rule and then expect the content system to enforce it.

3. Managed-device enforcement is unaffected and still matters

The school iPad or Chromebook in that student's bag is a completely different situation. You own the device, you own the policy, and traffic goes where you point it.

This is the ground that has not moved. KyberGate filters iPads through a cloud proxy with real SSL inspection rather than a VPN profile or a browser extension, which is why app traffic is filtered and not just browser tabs. Glasses do not change that, and a district panicking about eyewear should not take its eye off the fleet it actually controls.

4. Assessment integrity is a proctoring control, not a network control

The cheating concern — a student reading answers off a lens during an exam — is the one that makes superintendents move. It is also the one your filter was never going to solve, which is precisely why the College Board handled it with a rule and a proctor, not a technical measure.

Testing-room policy, visible-device checks, and staff training are the control here. Buying filtering to solve proctoring is a category error, and a vendor who encourages it is selling you something.

---

The honest version of the policy

If you are writing or revising a device policy this year, the thing that separates an enforceable one from a decorative one is that it names the enforcement mechanism next to each rule. Four lines:

1. Name the device class, not the brand. "AI-enabled eyewear and head-worn cameras" survives the next product launch. "Meta Ray-Bans" does not.
2. State the enforcement mechanism per rule. Presence rules are enforced by staff observation and network inventory. Content rules are enforced by filtering on managed devices. Write which is which, because the two fail in different ways.
3. Say the recording concern separately. Several of the districts above cited locker rooms and students with domestic-violence relocations — people for whom being recorded is a safety risk, not an annoyance. That justifies a stricter rule than distraction does, and it is a stronger argument at a board meeting.
4. Say out loud what you cannot see. A policy that quietly implies the network enforces it will be believed by staff and parents until the day it is tested publicly.

That last one is the whole point. A rule nobody can enforce still has value as a norm, as long as everyone knows that is what it is. The damage comes from a school believing it has a technical control when it has a sentence.

---

The test to run this month

Fifteen minutes, one pair of glasses, one phone. Borrow them from a staff member.

1. Pair the glasses to the phone. Leave the phone on cellular only, Wi-Fi off. Use the assistant and record a clip. Check your filtering logs. Expected: nothing. If you see nothing, that is correct behaviour and now you know the shape of the gap.
2. Join the same phone to student Wi-Fi. Repeat. Expected: companion-app traffic in your logs. If you still see nothing, your filtering has a bypass that is much bigger than eyewear and you have found something important.
3. Check your wireless controller for the phone as an unmanaged client. Expected: visible, with a vendor OUI. That is your presence signal.

Write the three results down. That table is the honest answer to "are we covered on smart glasses," and it will be worth more at a board meeting than any vendor datasheet.

Our standard on this has not changed from the audit post: a control that is on blocks the thing named on the control, and where a change cannot reach a device, the dashboard says so. Smart glasses are the clearest case yet of a thing the dashboard has to admit it cannot see.

---

Want the managed side of this airtight before you worry about the unmanaged side?

Start a free 30-day pilot — we will run the three tests above on your network with you, and hand you the written results including the gaps.

See pricing — per-device, transparent, no hidden fees.