Biometrics, Children, and Vulnerable Users

Identify the person, information, and purpose

The assessment should distinguish navigation, identification, assistance, recording, advertising, research, and model development. A camera detecting an obstacle and a system generating a face-geometry template to recognize a child perform different functions. Voice recordings, voiceprints, ordinary images, movement data, and linked health information also require separate classification.

A useful record identifies whose data is captured, whether the person is a customer, visitor, employee, patient, or child, who determines the processing purpose, and what information leaves the device. A manufacturer's cloud service and the local deployer can have different roles. Consent to receive a service should not be assumed to cover every later use of the resulting records. [1; 2]

Texas biometric identifiers

CUBI lists retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry. Commercial-purpose capture, disclosure, security, retention, and destruction must be analyzed under the actual provisions. An ordinary photograph is not automatically the same as a face-geometry record. Gait and generic behavioral metrics should not be added to CUBI's list by inference. [1, § 503.001(a) through (c)]

The current statute includes AI-related exclusions and a subsequent-commercial-use provision. The purpose of uniquely identifying a specific individual can matter to the AI-development exception. Public availability also does not automatically establish the notice and consent addressed by subsection (b-1). These provisions must be read together before describing a hospital or school robot's recognition feature as permitted or prohibited. [1, § 503.001(b-1), (e), and (f)]

TDPSA and children

TDPSA applicability depends on entity coverage and data exemptions. When the Act applies, sensitive data includes specified categories and data collected from a known child, with the statutory child definition and COPPA connection. Covered processing may require consent and a data protection assessment. Health and education settings require careful examination of the actual exemptions rather than assuming that every record at such a facility is excluded. [2, §§ 541.001 through 541.003, 541.101, and 541.105]

The controller should identify whether the robot needs to retain identifiable information to perform its task. Data minimization is not simply deleting video while retaining a reusable identity template. Access controls, processor contracts, and permitted secondary uses should cover derived information as well as the original stream where the law treats it as personal data. [2, §§ 541.101 and 541.104]

COPPA and connected robots

COPPA applies to covered operators of child-directed websites or online services and operators with the required actual knowledge of collecting personal information from children under 13. A connected toy or robot can involve an online service, but physical interaction alone does not resolve the rule's elements. Part 312 addresses notice, parental consent, parental rights, security, and retention. The current amended text should be used rather than an outdated compliance summary. [3, §§ 312.2 through 312.10]

The operator should map the child's interaction through the device, application, cloud account, voice processing, analytics, and third-party disclosure. A parent creating an account does not automatically answer whether the required notices and verifiable parental consent cover the actual collection and uses. Exceptions are provision-specific and should not be assumed merely because the feature is educational. [3]

Health care, accessibility, and truthful claims

A patient-facing robot can involve HIPAA-regulated information, medical-device functions, or Texas practice obligations depending on its role. Those issues require their own analysis. TRAIGA also has a specific disclosure provision for AI used in relation to health care service or treatment, including timing and an emergency rule. It should not be generalized to every private social robot interaction. [4, § 552.051]

Public accommodations must separately consider accessibility and effective communication under applicable law. A person unable to use the robot's screen should not be presumed to have consented through a default button or a companion's action. Alternative service, appropriate communication methods, and safe physical interaction should be assessed for the actual facility. [5; 6]

FTC authority can reach unfair or deceptive claims within its jurisdiction. Promises that a robot is private, anonymous, safe for children, or incapable of retaining conversations should match its actual design and vendor practices. The FTC biometric policy statement identifies enforcement concerns but is not itself a new biometric statute. [7; 8]

Hypothetical school deployment

A school proposes a reading robot that records speech and recognizes returning pupils. The program should separately analyze school authority, the vendor's online service, COPPA roles, actual biometric processing, student records, parental communications, and retention. Calling the robot a classroom tool does not answer those questions. The assessment should also identify how a pupil can receive the educational service without an unnecessary identification feature.