Logistics and distribution
Texas biometric law (CUBI) and AI dashcams: rules for Texas fleets
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Texas's Capture or Use of Biometric Identifier Act, known as CUBI, may apply when an AI dashcam captures a record of a driver's face geometry for a commercial purpose. Fleets with driver-facing cameras should confirm what the system actually measures, give notice and get consent where required, limit disclosure, and keep face-derived data out of any licensing package.
Key takeaways
- CUBI generally requires notice and consent before a biometric identifier is captured for a commercial purpose, and it limits selling or disclosing those identifiers.
- The key question for a fleet is what the driver-facing camera computes, not whether a camera exists.
- Face-based driver identification carries more biometric risk than road-facing recording or object detection.
- CUBI is enforced by the Texas attorney general rather than through private lawsuits, a key difference from Illinois's BIPA.
- Face templates, identity matches and driver-facing video usually stay out of any data licensing package.
What does CUBI require, in plain terms?#
CUBI requires a business that captures a biometric identifier for a commercial purpose to tell the person first and get their consent, then to protect the identifier, limit who receives it and destroy it once the purpose ends. Biometric identifiers under the statute include items such as a record of hand or face geometry, a fingerprint, a voiceprint and a retina or iris scan.
The statute is short, and its broad terms leave room for interpretation, which is why counsel reads it against the specific technology. Texas lawmakers have also amended biometric and AI rules in recent sessions, so the current text should be checked rather than an older summary. The attorney general has used CUBI against large technology companies in recent years, and those settlements drew national attention, so the lack of private lawsuits does not make it a paper risk.
- Notice: inform the individual before the identifier is captured.
- Consent: obtain the individual's consent before capture.
- Disclosure limits: do not sell, lease or otherwise disclose the identifier except in narrow circumstances the statute lists.
- Care: store, transmit and protect the identifier with reasonable care, at least as carefully as other confidential information.
- Destruction: destroy the identifier within a reasonable time after the purpose for collecting it ends, within the outer limit the statute sets.
- Enforcement: the Texas attorney general enforces the statute and can seek civil penalties for each violation.
Do AI dashcams capture biometric identifiers?#
An AI dashcam captures a biometric identifier only if it creates or stores something that counts as a record of face geometry or another listed identifier, and that depends on the features switched on. A camera that simply records the cab for later review is a different case from one that maps facial landmarks to detect drowsiness or to recognize which driver is behind the wheel.
Vendors describe these features in marketing terms such as distraction alerts or automatic driver assignment. Ask the vendor in writing what each feature computes, and use the answers to place each feature in the table below.
- Which features use the driver-facing lens, and which are switched on for our account?
- Does any feature create or store a facial template, landmark map or face embedding, and for how long?
- Is that processing done on the device, in the vendor's cloud or both?
- Does the vendor use our drivers' footage or derived data to train or improve its own models?
- How is face-derived data deleted when a driver leaves, and will the vendor confirm deletion in writing?
- Who at the vendor can view cab video, and is that access logged?
| Camera feature | What it typically does | CUBI question to resolve |
|---|---|---|
| Road-facing recording | Records traffic, roads and pedestrians ahead | Usually not about the driver; bystanders' faces may appear |
| Driver-facing recording on events | Saves cab video when an event triggers | Whether stored video alone is treated as a biometric record |
| Distraction and drowsiness alerts | Tracks head pose, eye closure or phone use | Whether facial landmarks are mapped and retained |
| Automatic driver identification | Matches a face to a driver profile to assign trips | Most likely to involve face geometry; highest scrutiny |
| Seatbelt and object detection | Classifies posture or objects in the cab | Usually object detection; confirm nothing face-based is stored |
How do Texas fleets respond in practice?#
Texas fleets respond to CUBI by narrowing what the cameras compute, documenting notice and consent, and tightening who can see the outputs. The aim is to keep the safety benefit of driver-facing cameras while removing features that create biometric records without a clear need.
Common steps include switching driver assignment back to ELD or app login where face matching is not needed, adding a biometric notice and consent form to the onboarding packet, and setting a retention schedule for any face-derived data. Fleets also restrict who can export cab video and record each export.
Contracts matter as much as settings. The vendor agreement should turn the answers to those questions into commitments: what the vendor may do with face data, whether model training on your footage is allowed, and how deletion is confirmed when a driver leaves or the contract ends.
What about passengers, trainers and drivers who cross state lines?#
Passengers, driver trainers and team drivers are captured by the same cameras as the assigned driver, and each may need notice. Fleets that allow authorized riders or run training programs should cover them in their consent process, not just the employee in the seat.
Drivers who live or run in other states raise a second set of questions. Illinois's Biometric Information Privacy Act, known as BIPA, has its own written-policy and consent rules and allows private lawsuits, and other states have biometric provisions in their privacy laws. A Texas fleet with lanes into those states should review its program against each one that may apply.
How does CUBI shape what a fleet can license?#
CUBI shapes data licensing by keeping biometric identifiers, and anything that could rebuild them, out of the package. The statute's disclosure limits alone make face templates and identity matches a poor candidate for any third-party use, and driver-facing video sits close enough to that line that most packages exclude it.
That still leaves useful material. Harsh braking, following distance and speeding events, reviewer verdicts and coaching outcomes do not depend on a driver's face, and forward-facing clips can be prepared with bystanders' faces blurred.
| Data | Typical licensing posture |
|---|---|
| Face templates and driver identity matches | Exclude |
| Driver-facing video | Exclude in most packages |
| Distraction or drowsiness flags without video | Review with counsel; may work as pseudonymous event labels |
| Road-facing video with bystanders blurred | Possible after preparation and review |
| Harsh braking, speeding and following distance events | Commonly licensable after driver de-identification |
| Coaching outcomes and reviewer verdicts | Possible once free-text notes are cleaned |
Illustrative: a Texas dry van carrier reviews its cameras#
Illustrative: a fictional dry van carrier based in Texas installed AI dashcams with driver-facing lenses across its fleet. Some of its drivers run lanes into Illinois. The general counsel asks the vendor what each feature computes and learns that automatic driver identification is matching faces to stored profiles.
The carrier turns off face matching and assigns drivers through ELD login instead, keeps distraction alerts after the vendor confirms how landmark data is handled, adds a biometric notice and consent form for drivers and trainers, and sets a destruction schedule for any remaining face-derived data. When the carrier later scopes a data licensing package, it excludes all driver-facing content and limits the package to de-identified event records and coaching outcomes.
How SourceX approaches biometric questions#
In the SourceX five-step transaction, biometric statutes are reviewed in the Rights step, before any field list is drafted, and face-derived data is excluded by default in Preparation. The supplier approves the final field list and a sample before anything is delivered.
The SourceX Evidence Packet records the privacy decisions behind each package, including which camera feeds and derived outputs were excluded, so a buyer and the fleet can both show what was and was not licensed.
Frequently asked questions
Does CUBI apply to drivers who are our employees?
Employment does not by itself take a fleet outside the statute. Monitoring drivers for safety and assigning trips are business purposes, so capturing a biometric identifier for them can fall within CUBI's commercial purpose language. Counsel should review how the statute applies to your specific camera features and workforce.
How is CUBI different from Illinois's BIPA?
Both require notice and consent before capture and limit disclosure. The largest difference is enforcement: BIPA allows private lawsuits, while CUBI is enforced by the Texas attorney general. BIPA also has specific written-policy requirements. Fleets with drivers in both states usually build one program that meets the stricter elements of each.
Does Texas's consumer privacy law also cover driver biometrics?
Usually not for employee drivers. Texas's broader consumer privacy law treats biometric data as sensitive, but it generally does not cover people acting in an employment context. That tends to leave CUBI as the main Texas statute for driver-facing cameras, though counsel should confirm how both laws apply to your workforce and any non-employee riders.
Can a driver refuse to consent to a driver-facing camera?
A driver can decline, and how the fleet responds raises employment law questions as well as biometric ones. Some fleets offer a configuration without face-based features for drivers who decline. Others treat the camera as a condition of the job. Review the options with employment counsel before setting a policy.
Does blurring faces in video solve the biometric issue for licensing?
Blurring removes faces from the frames a buyer sees, but it does not delete templates or landmark data the system may have stored, and blurring can fail on some frames. For licensing, fleets commonly exclude driver-facing video and face-derived outputs entirely rather than rely on blurring.
Do we need biometric consent to license data with no biometric content?
If the package contains no biometric identifiers and nothing that could rebuild them, CUBI's consent rules are not the concern for that package. Other requirements may still apply, such as driver notices, labor agreements and general privacy laws, so the rights review continues.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.