Control
Emotion-recognition/biometric-categorisation system without notice to exposed persons
Deployers of an emotion-recognition or biometric-categorisation system must inform the natural persons exposed to it of the system's operation.
Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.
Reach
Law in force in European Union (EU).
The guard to add
Show people a notice that emotion recognition or biometric categorisation is running before the analysis touches their face, voice, or video, and gate the analysis on it.
A notice gate in the module that calls the emotion or categorisation model (DeepFace.analyze with actions=['emotion'], FER().detect_emotions, Hume expression measurement, Rekognition detect_faces with Attributes=['ALL']). For app flows, an interstitial tells the person the system is operating, what it infers, and why, and the analysis function refuses to run until that acknowledgment is recorded for the session. For cameras or kiosks that analyse passers-by, the deployment config names the on-screen banner or physical signage at the capture point, and the pipeline does not start for a site with no notice configured.
Where it goes: 1 application source code, 3 config and feature flags, 14 user-facing text.
What reviewers look for: in the file that calls the emotion or categorisation model, a notice or signage check (notice_shown, inform_subjects, signage config) that is read before the call and stops it when missing, plus notice copy that actually reaches the exposed person at or before capture; not only a privacy-policy paragraph.
Example (Python DeepFace), before:
def analyse_frame(frame):
result = DeepFace.analyze(img_path=frame, actions=['emotion'])
return result[0]['dominant_emotion']After:
def analyse_frame(frame, session):
# notice shown in the capture UI; acknowledgment stored per session
if not session.get('emotion_notice_shown_at'):
raise NoticeRequired('inform the person that emotion recognition is running')
result = DeepFace.analyze(img_path=frame, actions=['emotion'])
return result[0]['dominant_emotion']Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.
Every rule this guard addresses
Binding law — in force (1)
- European Union (EU)
Related incidents
No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.
- Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required