Robot Sensors, Maps, Telemetry, and Personal Data

Map the information before classifying it

Record the sensor, account or device identifier, accuracy, frequency, recipient, and derived score. A phone's movement does not necessarily prove that its owner was driving. A vehicle identifier can connect telemetry to an identifiable person; removing the person's name may leave the information linkable. [1]

For a robot fleet, that inventory should follow information beyond the machine. A camera stream may pass through a remote-support system, diagnostic vendor, cloud store, analytics provider, and training pipeline. A map may acquire customer-account information, while apparently technical logs may record a worker's identity or a patient's room. These are examples of possible data flows, not assumptions about every system.

The inventory should distinguish raw sensor records, derived information, and operational decisions. A business cannot evaluate a promise to retain no video solely by checking the robot's local storage if a vendor preserves the stream elsewhere. Recommended records identify the purpose, recipients, retention trigger, access, and deletion path for each copy.

Determine whether the TDPSA applies

Section 541.002 generally reaches a person doing business in Texas or producing products or services consumed by Texas residents, processing or selling personal data, and not qualifying for the stated small-business exclusion. The chapter separately excludes listed entities, including state agencies and political subdivisions, specified financial and healthcare entities, nonprofits, higher education institutions, and listed electric-sector entities. Information exclusions appear in Section 541.003. [1]

The Act's consumer is a Texas resident acting in an individual or household context, not an individual acting in a commercial or employment context. It also excludes specified information collected and used within employment, agency, or independent-contractor roles. A fleet should distinguish employee records from consumer, passenger, customer, or bystander information rather than apply one exemption to its entire database. [1, §§ 541.001(7), 541.003(15)]

Small-business status is not an exemption from every data law. Section 541.107 separately restricts sale of sensitive data by the described small businesses without prior consent. CUBI and Chapter 521 must also be tested independently. [1] [2] [3]

Location and other sensitive data

TDPSA personal data is information linked or reasonably linkable to an identified or identifiable individual, including specified pseudonymous data. The definition excludes deidentified and publicly available information as the statute defines them. A public setting does not, by itself, establish every condition of the publicly available information definition. [1, § 541.001]

Precise geolocation data identifies an individual's specific location with precision and accuracy within a radius of 1,750 feet, subject to the definition's exclusions. It is a category of sensitive data. A location record of an unlinked machine and a location history linked to an identifiable passenger should therefore be classified on their actual facts. [1]

Covered processing of a consumer's sensitive data requires consent under Section 541.101(b)(4), with the specified treatment for known children's data. Section 541.105 requires documented data protection assessments for sensitive-data processing and other listed activities, including sale and targeted advertising. Processing necessary for navigation does not automatically authorize a separate use for underwriting, advertising, or model development. The Act's purpose restrictions and exceptions must be applied. [1]

Controller, processor, and independent use

The controller determines the purposes and means of processing. A processor processes on the controller's behalf. Section 541.104 makes the distinction factual and tied to the particular processing. A vendor may perform an instructed diagnostic service while proposing a different use of the same information for its own business purpose. The contract's label should be compared with those actual activities. [1]

Covered controller-processor contracts must include the statutory processing instructions, purpose, data types, duration, party obligations, and additional requirements. The processor must assist with consumer requests, security and breach obligations, and assessments as prescribed. The amended security-assistance provision expressly addresses applicable personal data collected, stored, or processed by an AI system. [1, § 541.104]

Recommended robotics terms identify whether video, maps, telemetry, and derived data may be used for training; which entities receive them; how support personnel access them; and what happens when the service ends. A data ownership label alone does not answer these permitted-use and statutory-role questions.

Rights, notice, security, and minimization

Covered consumers have rights under Section 541.051, including specified access, correction, deletion, portability, and opt-out rights. The chapter sets response and appeal procedures, and its provisions for authorized agents and opt-out technologies should be included in the applicable request process. A fleet's data architecture must support the rights that apply to its processing. [1]

Sections 541.101 and 541.102 require covered controllers to limit collection to adequate, relevant, reasonably necessary data for disclosed purposes, maintain reasonable security appropriate to the data, and provide the prescribed accessible privacy notice. The chapter separately addresses disclosures for sale and targeted advertising. A general statement that the robot collects operational information can be inadequate to describe materially different actual practices. [1]

Biometrics have a separate statute

CUBI defines biometric identifier as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. A photograph, a detection that a person is present, and a record of face geometry should not automatically be treated as the same thing. The system's actual measurements and uses matter. [2]

Section 503.001 requires advance information and consent for covered commercial capture, restricts disclosure, prescribes protection, and ties destruction to purpose expiration with stated qualifications. The 2026 text includes AI-related exclusions in subsection (e) and a subsequent-use provision in subsection (f). The exclusions should be read carefully, including the unique-identification limitation, rather than converted into a blanket exemption for robots using AI. [2]

The TDPSA's biometric-data definition is different and contains its own exclusions, including the specified treatment of photographs and recordings. A finding under one statute is not automatically a finding under the other. [1] [2]

Retention, deidentification, and incidents

Retention should serve a defined purpose and an applicable legal requirement. There is no universal period for keeping all business data. A recommended schedule identifies record category, system, legal or business basis, retention trigger, period, owner, hold override, and disposal method. [1] [2] [6]

The TDPSA's deidentification provisions require more than substitution of a device identifier. Section 541.106 includes reasonable measures, a public commitment, contractual recipient obligations, and oversight of commitments. Recurring home or work locations and accessible linking records can matter to whether location traces remain identifiable. [1]

A security event should be tested separately under Chapter 521. Its notice trigger concerns unauthorized acquisition compromising sensitive personal information as defined there. Exposure of a map or movement record can be serious without automatically satisfying that definition. The actual information and circumstances determine whether individual, Attorney General, maintainer, or other notice duties arise. [3]

Drones and government records

Chapter 423 can regulate image capture by a drone even when the TDPSA analysis produces a different result. It defines image broadly and contains its own surveillance, use, protected-site, and exception provisions. A lawful data-processing arrangement does not supply the missing basis for a prohibited capture. [4]

Government agencies excluded from the TDPSA still face public-records and other duties. Under Chapter 552, records collected, assembled, or maintained in connection with official business can be public information, subject to applicable confidentiality and exceptions. The presence of a private vendor or a trade-secret label does not make every robot record confidential. [5]

Hypothetical delivery fleet

A delivery operator keeps routes for navigation and shares trip-level information with a support vendor. The vendor proposes retaining linked customer locations to develop a separate commercial dataset. The operator should evaluate the new purpose, controller and processor roles, sensitive-data consent, assessment, notice, and transfer terms. Removing customer names is not sufficient if account keys or location patterns still identify people. [1]