Body and Emotion Scanning Notice
A transparency and trust pattern ensuring that people whose body or emotions are being read by an AI system are told before or as it begins, through a medium they can actually perceive. It covers emotion recognition and biometric categorisation across physical spaces, voice calls, and digital sessions, and the people it protects are often not users of the product at all. 'Body and emotion scanning' is plain language for the team; every notice must name the specific legal inference type, emotion recognition or biometric categorisation. Voice tone analysis is in scope even though nothing physical is scanned.
The Problem
People are read, categorized, or emotionally profiled by systems they may never learn are present. Unlike a chatbot user who opens a conversation with an AI, the individual here is often not a user of the product at all: a customer walking through a store, an employee in a meeting, a caller on a support line. The harm shows up as a decision quietly informed by an inferred emotional state, or a workplace where trust erodes once the true scope of monitoring surfaces. The real loss is informed exposure: a person's right to know their emotional state or biometric traits are being read.
- A person is profiled in a space or call they entered with no indication that inference was occurring.
- A sensor is upgraded to add emotion or biometric inference without updating the notice already in place.
- Inference is switched on partway through a session, and the people in it are left to notice an indicator has quietly appeared.
- The notice is present but practically invisible: a vague 'AI technology in use' sign, or a clause in a privacy policy nobody reads.
- The notice exists only in a medium some of the exposed population cannot perceive, so a blind visitor is never informed.
- Inference feeds a downstream decision (routing, flagging, scoring) the exposed person never sees.
Intended Outcome
Body and Emotion Scanning Notice is working when people know they are being read before it happens, not after.
- Informed before exposure: people are told before or as they are exposed, without needing to ask staff or find a policy.
- Specific, not generic: the notice names the actual inference type rather than posting an 'AI-in-use' sign.
- Reaches everyone exposed: perceivable by the whole population, including people who cannot read signage.
- Attached to a real moment: where the space has a kiosk, badge tap, or ticket scan, the notice is delivered there.
- Announced on activation: when inference starts mid-session, people already exposed are told at that moment.
- In sync with configuration: capability changes trigger a review of the paired notice rather than silently expanding scope.
Scope & Boundaries
- The legal baseline: Article 50(3), a deployer obligation to inform individuals exposed to emotion recognition or biometric categorisation. GDPR transparency and lawful-basis obligations apply in parallel.
- Article 50(5) delivery applies and bites hardest here: clear, distinguishable, accessible, no later than the point of exposure. Because the notice is directed at natural persons, physical signage alone never satisfies the accessibility limb.
- A non-visual notice channel for ambient deployments, paired with signage, treating its absence as a coverage gap rather than a refinement.
- Notice at an existing interaction point (kiosk, badge reader, ticket scan) where one exists.
- Voice channels inventoried alongside cameras: tone, stress, or sentiment analysis on a call is emotion recognition under Article 50(3), even though nothing physical is scanned.
- A coverage log and a configuration-to-notice dependency so enabling new inference flags the paired notice for review.
- Two separate exception registers: reduced-mechanism and law-enforcement.
- Authorisation: a visible notice does not authorize the underlying inference. A separate GDPR legal basis must exist independently.
- Consent-style gating in ambient physical spaces, where you cannot gate entry behind an 'I agree' click.
- Single-language or single-medium coverage for a diverse exposed population.
- The operator interface (dashboards, scores, per-person timelines): Article 50(3) governs only the exposed person's side.
How it Works
Before a person enters the zone of exposure (physical, vocal, or visual), the deployer surfaces a notice describing the specific inference being performed, through a medium perceivable by the whole exposed population, and keeps that notice in sync with what the system is actually configured to do.
Identify all exposure touchpoints: cameras or sensors in physical spaces, voice or call systems, video or meeting tools, and any downstream system consuming the inference. Note whether each space has an existing interaction point, and inventory voice channels, not only cameras.
Design the notice trigger and medium per touchpoint: trigger, medium, specific copy, persistence, and an accessible equivalent. Treat first notice and steady-state indication as separate jobs.
Log notice coverage and configuration changes: inference type, medium, accessible equivalent, last verification date, and whether activation notified those already exposed.
Document exceptions: reduced or alternative mechanism and law-enforcement, each with context, basis, owner, and review.
System Interaction
Placement & Triggers
- Ambient physical deployments: cameras or sensors performing inference in stores, venues, or offices.
- Voice and call systems analyzing tone, stress, or sentiment in real time.
- Workplace and meeting tools inferring engagement, attention, or mood during monitored sessions.
- The moment inference is activated on a system or session previously not performing it.
- Any context where the inferred output feeds a decision, escalation, or record the exposed person does not otherwise see.
Supported Architectures
Experience Surface
The notice should feel like part of the space, not a checkpoint. The goal is an informed population, not an interruption. Delivery differs by medium but specificity does not: every medium names the actual inference. Three jobs are done and are not interchangeable: first notice at the point of exposure, notice-on-change for people already exposed, and sustained visibility with a route to act. A kit that collapses the first and third into a single badge will pass a coverage audit and still leave people unaware.
Design Assets
A Notice Kit organized by the medium through which a person is actually read (physical, voice, and digital), plus a cross-cutting information path. Two of the components are shared primitives, maintained once and also used by the AI Interaction Disclosure pattern: the Voice Disclosure, and the AI Status Indicator that the Persistent Scanning Indicator is built on.
Physical medium
Entry Notice
Inform people entering a monitored space before exposure begins.
Placement · At every entry point, in the sightline on approach. Preferred variant: deliver at an existing kiosk, badge reader, or ticket scan instead of relying on signage.
- Specific inference statement: “This area uses [emotion recognition / biometric categorisation] technology.”
- What it is used for, in one clause.
- Information path (see component 6).
Accessibility · Signage alone does not reach blind or low-vision visitors, so pair with an audible announcement or an accessible equivalent. Meet contrast and type-size minimums, and provide every language served.
Voice medium
Voice Disclosure (shared)
Carry the notice into channels with no visual surface.
Placement · At call connection, before any inference begins and before any data is collected.
- Specific inference statement (“This call uses automated [tone / stress] analysis”).
- A route to more information.
- Shared component: the same Voice Disclosure the AI Interaction Disclosure pattern uses for its Article 50(1) voice channel. Only the announced subject differs; here it announces tone or stress analysis.
Accessibility · Self-contained with no visual dependency. Consider a text equivalent for deaf and hard-of-hearing callers using relay or captioning.
Digital medium
Session-Start Notice
Create awareness at the point of exposure. This is the component that first informs someone; an indicator only sustains awareness that already exists.
Placement · On join or session entry, before capture or inference begins. In the join flow or in-stream, not a transient toast.
- Specific inference statement naming what is inferred.
- What the inference feeds, where it informs a decision or record.
- Information path affordance.
- Where supported, a route to decline or leave.
Accessibility · Announced by assistive technology at the moment it appears.
Inference Activation Notice
Inform people already in a session when inference is switched on partway through. The change is the information.
Placement · In-session, at the moment of activation, addressed to everyone currently exposed rather than only the operator.
- Statement that inference has just started (not that it is running).
- What is now being inferred that was not before.
- Information path affordance.
Accessibility · Announced as a live-region update. A badge quietly appearing in a header is a state change, not a notice.
Persistent Scanning Indicator
Keep the fact of inference visible for the whole duration, so awareness created at session start does not decay.
Placement · Meeting or call UI header. Non-dismissible, steady-state only, not the first notice.
- Specific inference label.
- An affordance to open the information path.
- Built on the shared AI Status Indicator primitive, which also carries the responder states used by the AI Interaction Disclosure pattern.
Accessibility · Exposed to assistive technology as live status, never conveyed by colour alone.
All media
Information Path
Let an exposed person find out what is actually being inferred and raise a concern. This converts an unavoidably passive notice into something actionable.
Placement · Referenced from every primary notice: a posted contact, a short URL or code on signage, a spoken reference, or a link behind the digital components.
- Plain-language explanation of what is inferred and why.
- The retention position.
- A named owner or compliance contact, and how to object.
Accessibility · Reachable through at least one non-visual route. A code printed on a sign is not a path for someone who cannot see it.
When to use
Risks & Guidelines
- The generic AI sign: a vague 'AI technology in use' notice that fails the specificity bar.
- Using the pattern name in the notice: a sign reading 'body scanning in use' fails the specificity rule. The pattern name is plain language for your team; the notice must name emotion recognition or biometric categorisation.
- Signage as the whole answer: failing blind and low-vision visitors entirely and performing poorly for everyone else.
- The indicator as first notice: a persistent badge sustains awareness someone already has; it does not create it.
- Silent activation: enabling inference mid-session and relying on the indicator's appearance to inform people.
- Notice without legal basis: treating the notice as sufficient without a valid GDPR basis for the processing.
- Stale notices after capability upgrades, the single most common gap in this pattern.
- Coverage without awareness: reporting full coverage while sampling shows the exposed population does not know.
- Name the specific inference type in every notice, in every medium, and never use the pattern name as notice copy.
- Inventory voice channels too, not only cameras. Tone and stress analysis is in scope and is the touchpoint most often missed.
- Separate first notice from steady state, and build both.
- Treat activation as a notice event, fired to everyone currently exposed.
- Provide a non-visual route wherever signage is a primary medium; attach to an existing interaction point where one exists.
- Tie notice review to configuration change, not only initial deployment, and confirm the separate legal basis.
- Sample the exposed population, not just the deployment list. Ask people leaving whether they knew.
How to Measure Success
How will we know this pattern is strengthening trust?
North Star
Scanning Notice Coverage: the percentage of deployment locations or channels running emotion or biometric inference where a current, specific, medium-matched notice is verified in place (naming the inference type, matched to the exposure medium, arriving at or before exposure, verified against current configuration, and including a route for those who cannot use the primary medium). Target: 100% coverage, 0 unverified deployments, and notice review within 5 business days of any capability change.
Awareness Rate
whether sampled people actually know inference is happening. This pattern's comprehension measure.
Activation Notification Rate
the share of mid-session activations where those already exposed were notified at the moment inference began.
Notice Currency
whether each notice has been verified against current configuration since the last capability change.
Scope-Creep Incidents
capability changes deployed without a corresponding notice update. Target zero.
Accessible Route Coverage
the share of deployments where someone who cannot perceive the primary medium can still be informed.