Emotion recognition and biometric categorisation
Where these systems are lawfully deployed, everyone exposed to them must be told. In workplaces and educational settings, emotion recognition is prohibited under Article 5 — not a disclosure question but a ban.
What the law requires
Article 50(3) requires deployers of emotion recognition or biometric categorisation systems to inform the people exposed to them, and to process personal data in line with the GDPR.
The Art. 5 prohibition is the more serious one and comes first: emotion recognition in the workplace and in education has been banned since 2 February 2025, with narrow medical and safety exceptions. Disclosure does not make a prohibited use lawful.
Biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is also prohibited outright.
Website-facing cases are usually candidate-screening tools, sentiment analysis on video interviews, or retail analytics from in-store cameras described on the site.
What our scanner looks for
- Vocabulary associated with emotion recognition, sentiment-from-face analysis, and biometric categorisation across your pages.
- Whether the surrounding context indicates you deploy such a system, or merely write about it — a consultancy explaining the rules is not a deployer.
- Whether disclosure to affected people is present where deployment is indicated.
How to fix it
- 1First establish whether the use is prohibited. Emotion recognition applied to employees or students is banned, and the fix is to stop, not to disclose.
- 2For lawful deployments, inform people before exposure — at the point of application for a screening tool, on entry signage for a physical space.
- 3Document your GDPR lawful basis and complete a DPIA. Biometric processing is special-category data.
- 4If you only write about these systems, nothing is required. Our scanner flags this for review rather than as a finding for exactly that reason.
Deadlines and penalties
The Art. 5 prohibitions have applied since 2 February 2025 and carry the highest penalty tier — up to €35 million or 7% of worldwide annual turnover. The Art. 50(3) disclosure duty became enforceable on 2 August 2026.
Free, no account needed. We'll show you every page where this applies, with the evidence.
Common questions
We analyse customer support sentiment from text. Is that emotion recognition?
Article 3's definition centres on inferring emotions from biometric data — face, voice, physiological signals. Text sentiment analysis is generally outside it, though voice-based emotion detection in call centres is squarely inside.
We use video interview screening. What should we do?
If it infers emotional state from face or voice in an employment context, treat it as prohibited and take advice before continuing. This is the single highest-penalty area a website scan can surface.
This page describes technical indicators and the obligations they relate to. It is not legal advice. A website scan detects indicators, not legal compliance — which is why our reports say “no issues detected” and never “compliant”.