Robot cameras, microphones and GDPR at events

Often, yes: a hired robot with cameras and microphones can process visitors' personal data, so the GDPR can apply whenever people are identifiable. In practice, find out exactly what the robot captures, switch off what you do not need, tell visitors, and get the data terms in writing; anything involving face recognition or emotion analysis needs your data protection officer or lawyer first. This guide is general information, not legal advice.

What a robot can capture

Pepper. The specification published by Maxtronics lists two 2D cameras (in the mouth and on the forehead), a stereo camera pair behind the eyes, four microphones on the head and a 2-megapixel camera on the tablet.
Unitree G1. Unitree lists a depth camera, a 3D LiDAR and a four-microphone array.
Software features. The NAOqi software used on Pepper and NAO includes face detection with optional recognition of people after a learning stage, and a module that estimates age, gender, smile and facial expression.
People behind the robot. If the robot is teleoperated, ask whether an operator watches a live camera feed and whether it is recorded.
Manufacturer services. Unitree's G1 user manual says its optional maintenance service involves Unitree accessing fault, detection, positioning and debugging information, and describes the user as the controller of that information. Ask which outside services the unit connects to.

Cameras used only for navigation still deserve a note: what is processed, whether anything is stored, and who can see it.

When the GDPR comes in

Personal data is any information relating to an identified or identifiable person (Article 4(1) GDPR). The European Commission names publishing a person's photo on a website and CCTV recording as examples of processing.
No identification, no GDPR. The European Data Protection Board (EDPB) notes that the GDPR does not apply where no individual can be identified, directly or indirectly – for example, a camera set up so that it collects no information about people.
The household exemption in Article 2(2)(c) covers only a person's purely personal or household activity, which a company event is not.
Roles. The controller decides the purposes and means of processing and may use only processors that offer sufficient guarantees, under a contract (Articles 4 and 28); parties deciding together are joint controllers (Article 26). Agree in writing who is who.

Faces, biometrics and emotions

This is where the rules are strictest.

Biometric data comes from specific technical processing of physical, physiological or behavioural characteristics that allows or confirms someone's unique identification, such as facial images (Article 4(14)). Processing it to uniquely identify a person is prohibited unless an exception applies, such as explicit consent (Article 9).
Photos are not automatically biometric. Recital 51 says photographs count only when processed through specific technical means that allow unique identification.
Classifying versus recognising. The EDPB's video guidelines say detecting age or gender without creating templates to identify people falls outside Article 9, but recognising returning visitors falls inside it. For facial recognition by private organisations, the EDPB expects explicit consent from everyone captured in most cases, and calls a system unlawful if it captures non-consenting passers-by, even if their templates are deleted quickly.
Demonstrations. The EDPB gives the example of a museum exhibition demonstrating facial recognition, where taking part can be valid consent if the consent rules are met. A face-recognition demo should therefore be opt-in, in a clearly separated area.
EU AI Act. Regulation (EU) 2024/1689, as published, prohibits AI systems that infer people's emotions in workplaces and education institutions, except for medical or safety reasons (Article 5(1)(f)), and requires deployers of emotion-recognition or biometric-categorisation systems to inform the people exposed (Article 50(3)). The prohibitions have applied since 2 February 2025 and most other rules from 2 August 2026; check the current text with your lawyer.

Unless you have a specific, advised plan, ask the supplier to switch off face recognition and face-analysis features for your event.

Microphones and voice

The EDPB's guidelines on virtual voice assistants describe voice data as inherently biometric personal data, note that recordings can capture other people's voices and background noise, and say accidentally collected data without a legal basis should be deleted. For an event robot that means: prefer processing without recording, ask whether speech is sent to a cloud service, and find out who that provider is and how long audio is kept. See speech and languages for the practical side.

Telling visitors

Article 13 GDPR lists what people must be told when data is collected from them, including who the controller is, the purposes and legal basis, recipients, the retention period and their rights, including the right to complain to a supervisory authority.

For video, the EDPB recommends layers: a first-layer sign before the monitored area, at roughly eye level, showing the purposes, the controller's identity, the rights and the most significant impacts such as retention or sharing; and a second layer with the full information, ideally reachable by QR code and also available on paper. A sign alone does not make monitoring something visitors can reasonably expect, the EDPB adds.

For a robot, that means a sign at the robot zone, a line on its screen if it has one, and full information at the stand or registration desk.

Recording, retention and assessments

Storage limitation (Article 5(1)(e)): keep identifiable data no longer than necessary. The EDPB says video footage should in most cases be deleted after a few days, with more justification needed beyond 72 hours. For a robot demo, the simplest answer is often no recording at all.
Publishing footage online is a separate processing that needs its own legal basis, according to the EDPB.
Impact assessment. A data protection impact assessment (DPIA) is required for high-risk processing, including large-scale systematic monitoring of a publicly accessible area (Article 35(3)(c)); the European Commission lists this among the minimum cases. In Czechia the supervisory authority is the Office for Personal Data Protection (ÚOOÚ).
Children. Legitimate-interest assessments must weigh children's interests particularly (Article 6(1)(f)), so take extra care at school events.

Checklist: questions for the supplier

Which cameras and microphones does the unit have, and which are active?
Is anything recorded or stored? Where, for how long, and who has access?
Does any data leave the robot (cloud speech, remote operation, maintenance access)?
Are face recognition and age or emotion estimation switched off?
Who is controller and who is processor? Is there a data processing agreement?
What signage and screen text do you recommend, and who provides it?
How is data deleted after the event, and will you confirm it in writing?

Our safety page raises the same questions, and you can list privacy requirements when you send a request.

FAQ

Does the GDPR apply to a robot with cameras at our event?

It can, whenever the robot processes information about identifiable people, for example by recording video or recognising faces. Where nothing allows anyone to be identified, the EDPB says the GDPR does not apply; ask your data protection officer to check your set-up.

Can the robot recognise returning visitors?

That is biometric identification. The EDPB expects explicit consent from everyone captured in most cases and considers systems that scan non-consenting passers-by unlawful, so most events should keep it switched off.

Do we need a sign next to the robot?

If the robot collects personal data, visitors must receive the information listed in Article 13 GDPR. The EDPB recommends a first-layer sign before the area plus full information elsewhere.

Who is responsible for the data, us or the supplier?

It depends on who decides why and how data is processed: one controller with a processor, or joint controllers. Agree the roles in writing and take legal advice.

Sources

How this guide was made: prepared with AI assistance; every factual statement was checked against the sources listed above on 12 October 2026. Spotted an error? Write to info@humanoid4rent.com.