Robot cameras and GDPR: what EU regulators say about video at public events

A robot with cameras that moves through a public event is, in data protection terms, a mobile video device. The European Data Protection Board's guidelines on video devices apply wherever people can be identified. The organiser or supplier therefore needs a lawful basis, clear signage, short retention and, often, an impact assessment. Facial recognition and emotion analysis also bring in the EU AI Act.

Why a robot's cameras count as video processing

Most humanoids, robot dogs and service robots carry cameras and depth sensors so they can navigate, avoid people and react to them. Many also stream video to a remote operator or record it for later review. When those images show people who can be identified, the General Data Protection Regulation (GDPR) applies, whatever the device looks like.

The European Data Protection Board (EDPB), which brings together the EU's national data protection authorities, set out how the GDPR applies to cameras in Guidelines 3/2019 on processing of personal data through video devices. A draft was adopted for public consultation on 10 July 2019 and the final version 2.0 on 29 January 2020. The text does not mention robots. Applying it to them, as this article does, is an interpretation, but its reasoning is meant to carry across: the Board says its examples are not exhaustive and its general reasoning applies to all potential areas of use.

The guidelines also mark the outer edge of the rules. According to the EDPB, the GDPR does not apply where no one can be identified, directly or indirectly. One of its examples is a car parking camera built so that it captures no information about passers-by. A robot whose sensors only produce low-resolution depth data for obstacle avoidance, without storing or transmitting images, may sit closer to that example than one that streams full HD video to an operator's tablet. Which case applies depends on the actual configuration, not on the marketing description.

Legitimate interest and what visitors can expect

For private organisers, the usual legal basis for video is legitimate interest under Article 6(1)(f) GDPR. The EDPB describes a three-part test: the interest must be real, the processing must be necessary for it, and it must not be overridden by the rights of the people filmed.

Two passages matter for roaming robots. First, the Board says video surveillance is not a necessity by default when other means can achieve the purpose. A robot that only needs to avoid collisions may not need to record at all. Second, the test for reasonable expectations is objective. It asks whether a neutral third party would expect to be monitored in that situation. The EDPB names places where people relax or talk, such as seating areas, restaurant tables and leisure facilities, as areas where visitors can expect not to be filmed, and where their interests will often outweigh the controller's.

The Board adds that a sign alone does not change what people can reasonably expect. For events this is significant. A robot that walks into a lounge, a catering area or a networking zone takes its cameras into exactly the spaces the guidelines treat as sensitive. A camera fixed above an entrance does not do that.

Signage when the camera keeps moving

The guidelines recommend a layered approach to transparency. The first layer is a warning sign that shows the purpose, the identity of the controller, the existence of data subject rights and the most significant effects of the processing. It also points to a fuller second layer, such as a web page or printed notice. The EDPB says the sign should be placed so that people understand the situation before they enter the monitored area. It should be roughly at eye level, and people must be able to tell which area is covered so that they can avoid it or adjust their behaviour.

That assumes a fixed field of view. A robot's field of view moves with it, so the "monitored area" can be the whole hall. In practice this pushes organisers towards notices at every entrance, information on the robot itself, and clear statements of whether it records, streams or does neither. The guidelines also say the sign should mention anything that might surprise people, such as footage being passed to third parties. Remote operation or cloud processing by the robot's maker could fall into that category.

Retention and impact assessments

On storage, the EDPB says footage should in most cases be deleted after a few days, ideally automatically. The longer the period, especially beyond 72 hours, the stronger the justification the controller must give. Event footage kept for marketing is a different purpose from footage kept for security, and each needs its own justification and retention period.

The guidelines also point to Article 35(3)(c) GDPR, which requires a data protection impact assessment (DPIA) for systematic monitoring of a publicly accessible area on a large scale. National authorities publish their own lists of processing that needs a DPIA, so the answer can differ by country. A single robot at a small reception is unlikely to be treated like a stadium camera network. A fleet streaming video across a large exhibition is a closer call.

Facial recognition: where Article 9 GDPR begins

The sharpest line in the guidelines concerns biometric data. If a system creates templates from faces to uniquely identify people, it processes special category data under Article 9 GDPR. For private uses such as marketing, that will in most cases require explicit consent from everyone captured.

The EDPB's examples are directly relevant to robots that "remember" guests. A hotel that recognises consenting VIPs by face would act unlawfully unless every other guest scanned in the process had also consented. A shop that recognises faces to tailor adverts is unlawful if it captures non-consenting passers-by, even if their temporary templates are deleted at once. For a concert hall, the Board says biometric and non-biometric entrances must be clearly separated.

Simple classification is treated differently. The EDPB says a system that estimates age or gender to choose content, without creating templates to identify anyone, falls outside Article 9 unless it processes other special category data. The rest of the GDPR still applies to it.

What the AI Act adds

The EU AI Act, Regulation (EU) 2024/1689, adds a second layer. Its definitions, published by the European Commission's AI Act Service Desk, include publicly accessible space: any physical place, publicly or privately owned, that an undetermined number of people can enter, even where conditions for access apply. A ticketed trade fair fits that description.

The prohibitions in Article 5 have applied since 2 February 2025, according to Article 113. Three of them are relevant here:

• Emotion recognition is banned in workplaces and education institutions, except for medical or safety reasons. A robot reading the moods of visitors at a public show is not caught by this ban. A robot used at a staff event or a school visit may be, and where exactly the line falls has not yet been tested in court.
• Biometric categorisation that infers sensitive traits such as race, political opinions, religion or sexual orientation from biometric data is banned, apart from narrow carve-outs such as labelling lawfully acquired datasets.
• Real-time remote biometric identification in publicly accessible spaces is banned for law enforcement purposes, with narrow exceptions. This ban targets police use, not private organisers. Private use of such systems remains subject to Article 9 GDPR.

Even where they are not banned, remote biometric identification, sensitive-attribute categorisation and emotion recognition are listed as high-risk in Annex III. Systems used only to verify that a person is who they claim to be are excluded. The Commission's AI Act overview says that, after the Digital Omnibus amendments, those Annex III rules apply from 2 December 2027. Separately, Article 50(3) requires anyone deploying emotion recognition or biometric categorisation to inform the people exposed to it. The Commission lists August 2026 as the start of the transparency rules. For more on the timeline, see our explainer on which AI Act deadlines apply to robots.

The Commission published guidelines on prohibited AI practices on 4 February 2025. It describes them as non-binding, with authoritative interpretation left to the Court of Justice of the EU. This article is general information, not legal advice. National authorities and courts may take a different view of specific deployments.

What this means for event organisers

• Ask what the cameras actually do. Find out whether the robot records, streams to an operator, sends data to the cloud, or only processes sensor data on board. The GDPR analysis depends on these answers. Our guide to cameras, microphones and visitor privacy covers the practical questions.
• Agree who the controller is. Settle in writing whether the organiser, the brand or the supplier decides why footage is processed, and put it in the brief. Our guide on what to include in a request to a robot supplier can help.
• Keep robots out of the sensitive spaces the EDPB identifies, such as seating, dining and rest areas, unless their cameras are disabled or produce no identifiable images.
• Treat face recognition and mood detection as separate decisions. They need explicit consent under the GDPR and may trigger AI Act obligations. A robot can perform at most events without either.
• Plan privacy alongside physical safety. Signs, routes and exclusion zones are usually decided together. See the planning guide for safety at public events with robots.

Frequently asked questions

Does the GDPR apply to a robot's navigation cameras?

It applies whenever the robot processes images or other data that can identify a person, directly or indirectly. The EDPB's video guidelines say the GDPR does not apply where no one can be identified, for example a parking camera built so it captures no information about passers-by. Whether a robot falls inside or outside the GDPR therefore depends on its configuration: whether it records, streams or stores identifiable images.

Is a sign at the entrance enough when a robot films visitors?

Not on its own. The EDPB recommends a layered approach, with a first-layer sign showing the purpose, the controller and visitors' rights, linked to fuller information. It also says that a sign does not change what people can reasonably expect, so filming in places such as seating or dining areas can still fail the legitimate interest balancing test even when signs are displayed.

Can a robot recognise guests by their faces at an event?

Under the EDPB guidelines, facial recognition that creates templates to uniquely identify people processes special category data under Article 9 GDPR. For private purposes that will usually require explicit consent from everyone the camera captures, not only the guests who signed up. The AI Act also lists remote biometric identification as high-risk. This is general information, not legal advice.

Is emotion recognition by a robot banned under the AI Act?

The AI Act bans emotion recognition in workplaces and education institutions, except for medical or safety reasons, and this ban has applied since 2 February 2025. Outside those settings it is not banned, but it is listed as high-risk in Annex III, and Article 50(3) requires deployers to inform the people exposed to it. Where staff events fall has not yet been settled by the courts.

How this article was made: written by the humanoid4rent editorial team with AI assistance; every factual statement was checked against the sources listed below on 2026-10-31. Spotted an error? Write to info@humanoid4rent.com.