Consent and Privacy for Robot Pretraining Data at Scale

A single-task dataset might involve a handful of operators in one controlled space. A pretraining dataset built for a generalist robot policy is the opposite: many contributors, many homes or workplaces, many bystanders who never opted into anything, captured over weeks or months to reach the breadth a foundation model needs. Every one of those capture sessions is a separate point where consent has to be documented correctly, and every session includes people in the frame who are not the contributor — family members, coworkers, strangers walking past a storefront window. At ten sessions the risk of a missed release or an unblurred bystander is manageable by inspection. At the scale a pretraining corpus requires, it is not, which is exactly why consent has to be a documented, checkable pipeline rather than an assumption carried over from a smaller shoot.

The scale problem is not only about the number of people, it is also about the number of independent failure points. A missed release, an unblurred face in a single frame of a single clip, or a household layout that inadvertently identifies an address are each individually small, but a pretraining corpus assembled from thousands of episodes multiplies those small failure points into a real probability that at least one slips through an ad hoc process. Treating consent and de-identification as a pipeline with defined stages — rather than a judgment call made once per shoot — is what keeps that probability low as volume grows, because each stage is checked the same way regardless of whether it is episode one or episode ten thousand.

This is general information about how consent and privacy are typically handled for commercial pretraining data, not legal advice. Confirm the specific requirements for your jurisdiction and use case with counsel.

On Firsthand, a documented consent chain starts before any camera rolls: a written release is signed, identity is verified, and the terms of use — including that the footage may be used to train commercial models — are agreed in advance, not inferred after the fact. See consent requirements for AI training data for a fuller walkthrough of what that chain needs to cover and how it differs from the dataset’s commercial license. Consent answers whether the person doing the recorded activity agreed to be recorded and to how the footage will be used; the license is the separate grant covering what the buyer can legally do with the resulting dataset.

Identity verification and a written release matter for a second reason beyond documenting agreement: they establish who the consent actually came from, which is part of what a data card later records. A release that cannot be tied to a verified contributor is not a usable artefact if a claim is ever raised, because there is no way to confirm the person granting rights was the person actually recorded. That is why the consent chain treats verification and the release as a single step rather than two optional ones — a signature alone, without a verified identity behind it, does not close the gap a buyer needs closed.

Personally identifiable information in egocentric and robotics video mainly means faces, licence plates, on-screen text, and spoken names or numbers — see PII in robotics data for the full breakdown of what counts and how each type is handled. De-identification is the irreversible removal of those identifiers at the pixel level, so a downstream user cannot reverse it. On Firsthand this runs as an automated detect-track-blur pipeline, confirmed by a human reviewer: a model returns a bounding box and confidence score for each face on every frame, per-frame boxes are linked into a track so coverage survives turns and occlusion, and each tracked region is blurred into the output pixels rather than masked with a switchable layer. The same detect-track-redact structure covers licence plates and legible screens.

The distinction between blurring into the output pixels and masking with a switchable layer matters more than it sounds. A switchable overlay can be toggled off by whoever holds the file, which means the original identifiable frame still exists somewhere and the protection depends on that party’s good faith. Irreversible pixel-level blurring destroys the original identifying information at the source, so there is nothing left to toggle back on — the protection does not depend on trusting a downstream party’s access controls. That distinction is why de-identification, done this way, holds up as a privacy control even after the dataset has left the provider’s hands.

De-identification does not substitute for consent — it reduces the risk that an un-consented bystander is identifiable, but it does not replace a documented release from the actual participant performing the recorded activity. That is why the pipeline includes a human review step: after automated detection and blurring, a reviewer confirms no un-consented person is identifiable in any frame, and any clip where a bystander cannot be adequately covered is discarded rather than delivered with a residual risk. For household capture, that means checking every room a task passes through, not only the room the task is centered on. For workplace capture, it means the same standard applies to coworkers who walk into frame incidentally, not only to the person performing the task under contract.

Household and workplace capture also raise a related risk that blurring alone does not fully address: the scene itself can be identifying, independent of any face in it. A distinctive kitchen layout, a company logo on a badge left in frame, or an address visible on mail on a counter can narrow down who or where a household is even with every face blurred. Firsthand’s human review step is where that case-by-case judgment happens — a reviewer looks at whether the scene as a whole, not just the people in it, could identify a specific person or place, and flags or discards clips where it plausibly could.

A documented consent chain is only useful to a buyer if it survives delivery as checkable artefacts, not as a one-time assurance. See provenance, consent and licensing for the underlying release language, de-identification pipeline, and how commercial egocentric licensing compares with public dataset licences. Firsthand warrants the consent chain for every delivered episode and indemnifies against claims arising from it, backed by a per-episode data card that lists the consent artefact IDs behind that specific footage — so a buyer can point to exactly which release and review record covers any given clip, rather than relying on a provider’s word after the fact.

Consent and de-identification are stages in the same seven-stage pipeline every Firsthand program runs — contributor recruiting, capture, per-batch QA, anonymization, and licensed delivery — rather than a separate compliance pass bolted on afterward. Because the release, identity verification, and de-identification pipeline are built into that flow rather than added after the fact, a custom pretraining program still ships a median first validated batch in 48 hours where coverage is already deep, with rejected items recaptured at Firsthand’s cost. Speed comes from a warm, repeatable pipeline, not from skipping the consent or review steps.

Consent and license solve two different problems that both have to hold before a commercial robot model can safely train on the data. Consent establishes that every person in the footage agreed to be recorded and to how it would be used; license establishes what the buyer can legally do with the resulting footage once that consent exists. See how to license pretraining data for commercial robot models for the license side of this question, and buyer-owned training data explained for what "buyer-owned" specifically means: a perpetual, irrevocable commercial license backed by a documented consent chain and a data card, rather than a revocable subscription to a dataset the provider still controls. Public egocentric pretraining datasets are frequently research-only, which is a licensing problem — but a permissive commercial license sitting on top of an undocumented consent chain is a separate and often invisible problem underneath it. Both need to be checked.

• Is there a written release signed before capture, or is consent inferred from participation?
• Does the provider warrant the consent chain and indemnify against claims arising from it, or is that risk left entirely with the buyer?
• What personal data is removed — faces, plates, screens, speech — and is the removal irreversible at the pixel level?
• Is de-identification confirmed by a human reviewer, or only by an automated pass with no verification step?
• Does each delivered episode carry a data card linking it to a specific consent artefact, or is consent documented only at the batch level?
• What happens to a withdrawal request — is the limit (delivered footage cannot be recalled) stated up front, or left ambiguous?
• Is the commercial license perpetual and buyer-owned, or a revocable subscription to a dataset the provider still controls?

A pretraining data provider that can answer all of these with documented artefacts — not just a verbal assurance — is the one whose dataset can actually withstand scrutiny once a commercial model has shipped on top of it.