Texas Biometric Privacy Law for Robots
Published
Law checked through .
Texas CUBI regulates listed biometric identifiers under the conditions in Business and Commerce Code § 503.001. It addresses commercial-purpose capture, notice and consent, possession, disclosure, security, and destruction, with current AI-related exceptions and subsequent-use rules. A robot's camera image, obstacle detection, face-geometry template, and voiceprint require separate classification. Neither every image nor every behavioral signal is automatically a CUBI biometric identifier. [1]
What counts as an identifier
The statute lists a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. The assessment should identify what the system actually generates and retains. A video of a person and a geometric template used to recognize that person may involve different processing. The robot's product description is insufficient if it does not reveal the derived information. [1, § 503.001(a)]
The data map should include onboard processing, vendor cloud services, recognition databases, and exports. A deployer may believe that no biometric data is stored because it receives only a name or access decision, while the vendor retains a template. The actual capture, possession, and use by each party must be examined separately.
Commercial purpose, notice, and consent
Subsection (b) addresses capturing an individual's biometric identifier for a commercial purpose without first informing the individual and receiving consent. The capture purpose and actual process matter. Consent to enter a building or use a robot should not automatically be treated as informed consent to every identity function. [1]
Subsection (b-1) limits reliance on publicly available images or media as a basis for notice and consent, with its stated condition concerning material made public by the individual. A robotics team should not assume that a face appearing online is freely available for any commercial biometric capture. The statutory wording, actual source, and processing must be reviewed. [1]
Possession, disclosure, security, and destruction
For covered identifiers possessed for a commercial purpose, subsection (c) addresses sale, lease, or disclosure subject to listed exceptions; reasonable care in storage, transmission, and protection; and destruction within the statutory period and conditions. The rule should be applied to the actual identifier and purpose, rather than replaced with a generic corporate retention policy. The employment-related provision also needs its own reading. [1, § 503.001(c)]
The contract should identify which party holds templates, who can disclose them, how consent or other permitted grounds are documented, and how deletion reaches backups or downstream recipients where applicable. Contract language helps implement the duty but does not itself create an exception to the statute. A recommended inventory should track both the original identifier and copies made for a separate function.
Current AI exceptions and later use
Subsection (e) excludes specified activities, including certain AI development, training, evaluation, and offering activities unless the system is used or deployed to uniquely identify a specific individual. It separately addresses identified security-related purposes. The precise activity and purpose must be assessed; a vendor cannot assume that every deployment is exempt merely because it contains an AI model. [1, § 503.001(e)]
Subsection (f) addresses identifiers captured for AI training that are subsequently used for a commercial purpose outside the stated exclusions, including possession, destruction, and penalties. A robotics project should therefore review a transition from training or testing into customer or worker recognition. A new use can change the legal analysis even where the underlying data does not move. [1]
CUBI, TRAIGA, and TDPSA
TRAIGA separately addresses biometric data and certain governmental identification practices, and makes a CUBI violation a violation of the relevant provision. Its definitions and intent or actor conditions should not be substituted for CUBI's text. The laws must be read together. [2, § 552.054]
TDPSA has its own definitions, coverage, exemptions, sensitive-data rules, controller duties, and processor requirements. A conclusion that TDPSA does not cover a particular employer or dataset does not automatically establish that CUBI does not apply. Conversely, CUBI compliance does not necessarily satisfy every applicable TDPSA duty. [3]
Practical robotics examples
A warehouse robot that merely avoids people presents a different inquiry from a robot that identifies workers by face geometry. A hotel robot using a voice command may process ordinary audio, a voiceprint, or both, depending on implementation. An agricultural inspection robot may capture incidental faces without performing identification. These examples require the technical facts before a legal category can be assigned.
Recommended review questions ask what identifier exists, why it is captured, who possesses it, what the person is told, how consent or an exception is established, and when the purpose ends. The system should permit disabling an optional identity feature without assuming that disabling recognition also removes every data obligation. Enforcement under CUBI belongs to the Attorney General under its actual penalty provision; this guide does not invent a private CUBI damages action. [1, § 503.001(d)]
Sources
- Texas Business and Commerce Code § 503.001, all current subsections, including the HB 149 amendments.
- HB 149, § 552.054
- Texas Business and Commerce Code Chapter 541, especially §§ 541.001 through 541.003 and 541.101 through 541.107.
- FTC Biometric Policy Statement