Short answer
Workplace video used for AI training can raise biometric privacy questions when it yields a scan or record of face or hand geometry, a voiceprint, or data processed to identify a person. Illinois and Texas define such identifiers by statute, and the GDPR treats biometric data used for unique identification as a special category. Ask what was captured, from whom, under what notice and consent, and what is derived. This is not legal advice.
Why body-centric data is the sharpest privacy risk
Most rights questions about workplace video are about things: a client's goods, a vendor's manual. Robot-learning data is about bodies. Hands are the content of dexterity data, faces appear in the frame, speech is in the audio, and pipelines derive hand pose, body pose, gaze and landmarks from the pixels. Notice that was adequate for security cameras may say nothing about any of that.
Some statutes are framed around the act of capturing or collecting, not only later use. A cleanup step after capture does not necessarily change how the footage was captured. Redaction and anonymization lower identifiability, but they are not permission, and this page does not treat them as one. Use it to brief counsel; the wider consent picture is in worker consent and identifiable people.
What three laws say, as relevant here
| Law | Definition or trigger | Provisions a data buyer should read |
|---|---|---|
| Illinois Biometric Information Privacy Act, 740 ILCS 14 | Section 10: a biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry | Section 15(a): a publicly available written retention schedule and destruction guidelines, with destruction when the initial purpose is satisfied or within 3 years of the individual's last interaction, whichever occurs first (Illinois General Assembly) |
| Texas Business and Commerce Code, Section 503.001 | A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry | Capture for a commercial purpose requires informing the individual before capture and receiving consent; limits on selling, leasing or otherwise disclosing, with listed exceptions; destruction within a reasonable time and not later than the first anniversary of the date the purpose for collection expires; civil penalty of not more than USD 25,000 per violation, recoverable by the attorney general (Texas Legislature) |
| EU General Data Protection Regulation | Article 4(14) defines biometric data; Article 9(1) includes biometric data processed for the purpose of uniquely identifying a natural person among the special categories | Article 88(1) lets Member States set more specific rules, by law or collective agreement, for employees' personal data in the employment context (European Parliament and Council of the EU, 2016) |
Three cautions on that table. First, the Illinois Act was amended in 2024 (Public Act 103-0769 amended Sections 10 and 20, effective 2 August 2024), and the official page warns that its displayed text may lag pending Public Acts. Second, the Texas destruction wording should be confirmed against the current official text, and the version effective 1 January 2026 adds a definition of "artificial intelligence system" by reference to Section 551.001; ask counsel what that addition means for training uses. Third, both US statutes say "scan" or "record" of geometry. Whether ordinary video, or a landmark or pose track derived from it, falls within those words is a question for counsel, as are exclusions and remedies elsewhere in each statute.
For a data buyer, the Texas limit on selling or disclosing matters directly: a supplier licensing footage that contains such identifiers is disclosing them. Ask which exception, if any, it relies on.
Which data types raise the question
| Data type | Why it can matter | Diligence question |
|---|---|---|
| Face video, landmarks, embeddings | Face geometry is named in both US definitions; embeddings can identify | Are faces visible, and was any face geometry or template computed or stored? |
| Hand video, 3D hand pose, fitted hand shape | Hand geometry is named in both US definitions; dexterity data depends on it | Is raw hand video delivered, or only joint trajectories? Are shape parameters fitted to individuals? |
| Voice in audio | Voiceprint is named in both US definitions | Is audio present, and was speech used to identify anyone? |
| Eye-tracking streams | Near-eye cameras image the eye; retina or iris scans are named | What is stored: gaze direction only, or eye images? |
| Gait and body pose | Not named in the US definitions above; other laws may differ | Is the motion data tied to a named or re-identifiable person? |
| Operator IDs and keys | A pseudonym with its key can link every clip to a person | Who holds the key, and under what access control? |
Hands, faces and voices also appear in egocentric and head-mounted capture; see the head-mounted camera capture specification and 3D hand pose data for what those streams contain.
Diligence by stage
Where and from whom. Which states and countries was the footage recorded in, and who appears: employees, contractors, customers, the public? Employment settings add rules of their own, as GDPR Article 88(1) shows; the wider EU picture, including the AI Act, is in EU AI Act and GDPR considerations.
Notice and consent. Read the actual text and version dates. Did it mention biometric identifiers, hand or face data, voice, derived data and AI training? Did it precede capture? Was it a separate agreement or buried in a handbook?
Retention. Does the supplier have a written retention schedule and destruction guidelines, and does your license carry those limits forward to you? Compare them with Illinois Section 15(a) and the Texas timing rule, with counsel.
Derived data. List every derived stream: landmarks, pose tracks, hand shape fits, embeddings, speaker features. Ask what each is derived from, where it is stored and whether it is delivered.
Identification. Is any biometric template used, or built, to recognize a specific person, such as for time clocks, access control or operator matching? Ask the supplier to say so either way.
Subprocessors. Annotation vendors and cloud tools handle the data too. Which of them see faces, hands or audio?
Design choices that reduce exposure, and their costs
- Camera placement. Wrist and head-mounted views usually show the wearer's hands but not their face; other people in frame remain. Fixed views show everyone.
- Audio. Removing audio at capture removes the voice question; the cost depends on whether your labels or models use speech. Narration for language labels needs its own consent and handling.
- Redaction. Face masking helps, but hands cannot be masked in dexterity data without destroying its value, so hand questions stay. Methods and costs are in redaction in demonstration video.
- Delivering derived trajectories instead of raw hand video. Joint-angle sequences may carry less identifying information than raw video of hands. Whether that changes the legal position is for counsel, and you give up the raw pixels.
- On-device processing. Computing pose at capture and discarding raw frames changes what exists later, along with what a buyer can audit.
Illustrative supplier disclosure schedule
# Illustrative only — synthetic values; fields are examples to adapt, not a supplier offer
biometric_disclosure:
recorded_in: [state_X, state_Y] # list jurisdictions
people_recorded: [employees, contractors]
streams_delivered:
face_video: no (faces masked before storage)
hand_video: yes
audio: no (removed at capture)
eye_images: no
derived_streams: [hand_pose_3d, body_pose] # state source, storage and delivery of each
templates_or_embeddings_created: no
used_to_identify_individuals: no
notice: {document: notice_v3, mentions_biometrics: yes, mentions_ai_training: yes, given_before_capture: yes}
retention: {schedule: published, destroy_by: purpose_end_or_schedule_date}
subprocessors_seeing_raw_streams: [annotator_B]
withdrawal_route: supplier_contact_L01 (synthetic)
Contract and delivery topics
- A supplier representation, with the disclosure schedule attached, that notice and consent were obtained where the supplier says they were.
- Flow-down of the supplier's retention schedule and a duty to delete when it requires.
- A bar on building biometric templates or identifying individuals from the data, and on re-identification.
- Treatment of derived data and model weights; see licensing terms for robotics training data.
- How withdrawal or deletion requests reach you, and a record of what was deleted; see retention, deletion and audit rights.
- Jurisdiction exclusions: a right to leave out clips from places or people your counsel flags.
- Allocation of responsibility if a regulator or individual raises a claim. Counsel should draft this; it is not a clause to copy from a web page.
What this page cannot settle
This page covers only the three laws above. Other states, cities and countries have their own rules, which it does not summarize, and statutes change: the Illinois Act was amended in 2024 and the Texas section has a version effective in 2026. The page does not say that any particular footage is or is not covered, or that any particular consent satisfies any law. Those are legal conclusions that depend on facts and on text beyond what is summarized here. This is not legal advice.
Questions to ask suppliers
- In which states and countries was the footage recorded, and who appears in it?
- What notice or consent did people receive, when, and does it mention biometric identifiers and AI training?
- Is raw face video, hand video or audio included, and could any of it be removed without losing the training value you promise?
- What streams were derived from faces, hands or voices, and are any delivered?
- Was any biometric template or embedding created or stored, by you or a subprocessor?
- Is any of the data used to identify individuals, now or in your other products?
- What is your written retention schedule, and how does it reach me?
- How does a withdrawal request travel from a person to every copy?
Discuss your requirements
If your project involves hand, face or voice data, say which streams it needs and which it must exclude. Describe the requirement to SourceX and it will investigate whether US businesses hold suitable material; SourceX checks the data and the supplier's licensing permissions, agrees pricing and allowed uses in a license, and coordinates delivery and payment. SourceX follows up about potential sources; a request does not guarantee a match, and nothing is contracted until a supplier agrees. For the wider map, see the procurement hub, the humanoid training data guide and SourceX licensing terms.
Explore sourcing and licensing options with SourceX
Sources
- Biometric Information Privacy Act (740 ILCS 14) — definition of biometric identifier, retention schedule requirement, 2024 amendment.
- Texas Business and Commerce Code Sec. 503.001 Capture or Use of Biometric Identifier — capture, disclosure, destruction and penalty provisions.
- Regulation (EU) 2016/679 (General Data Protection Regulation) — biometric data definition, special category, employment-context rules.