Privacy, ethics and social impact

Robots that interact with people are, almost by definition, data-collection machines. To navigate a hospital, a robot maps it, including the people in it. To respond to speech, it listens. To recognize a user, it may store their face. And robots act physically in the world, so their decisions affect safety, livelihoods and dignity in ways that purely digital systems do not. This lesson covers privacy risks and the privacy laws that apply to robots in Canada and the United States, design methods for protecting privacy, frameworks for robot ethics, and the wider social impact of robots on work and society.

How robots affect privacy

Privacy concerns with robots go beyond those of smartphones or websites. Robots move, so their cameras and microphones can reach spaces, such as bedrooms, bathrooms and hospital rooms, that fixed cameras usually do not. They collect data passively and continuously, often about bystanders who never agreed to anything. Their social presence can lead people to disclose more than they would to a form or an app: studies have found that people may share personal information with social robots readily, sometimes without considering where it goes. They can be connected to cloud services and remotely accessed, by manufacturers, employers or attackers. And they create detailed maps of private spaces, which can reveal the layout, contents and routines of a home.

Workplace robots raise questions of employee monitoring. A collaborative robot logs every cycle, every pause and every intervention, which can be used to measure an individual worker's pace. Used carefully, such data help identify ergonomic problems; used carelessly, they can intensify work and erode trust. Ontario, for example, has required since 2022 that employers with 25 or more employees have a written policy on the electronic monitoring of employees, describing whether and how they monitor and for what purposes. Labour unions and works councils in many countries negotiate limits on how robot data may be used to evaluate workers.

Privacy law in Canada and the United States

In Canada, the Personal Information Protection and Electronic Documents Act, PIPEDA, governs how private-sector organizations collect, use and disclose personal information in the course of commercial activity, except where a province has substantially similar legislation. PIPEDA is built around ten fair information principles, including accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. Quebec, Alberta and British Columbia have their own private-sector privacy laws. Quebec's Law 25, which modernized its privacy legislation in phases between 2022 and 2024, requires a person in charge of protecting personal information, privacy impact assessments for certain projects, privacy-protective default settings, and specific rules for technology that can identify, locate or profile a person: organizations must inform people when such technology is used and, in general, such functions must be off by default. Biometric databases must be disclosed to Quebec's privacy regulator, the Commission d'accès à l'information. Health information is also governed by provincial health privacy laws, such as Ontario's PHIPA. Proposals to replace PIPEDA with a new federal law have been introduced in Parliament in recent years; check the current status. The United States has no comprehensive federal equivalent; it relies on sector-specific laws such as COPPA and on a growing number of state privacy laws.

Robots sold across the border must satisfy both sets of rules, and the strictest rule often becomes the design default. Robots marketed in the European Union also face the General Data Protection Regulation and, for certain uses, the EU Artificial Intelligence Act, adopted in 2024, which phases in obligations for high-risk AI systems, including some safety components of machinery, and prohibits some practices outright, such as certain emotion recognition in workplaces and schools.

Privacy by design

Privacy by design, a framework developed by Ann Cavoukian when she was Information and Privacy Commissioner of Ontario, asks designers to build privacy into systems from the start rather than adding it later. Its seven principles include being proactive rather than reactive, privacy as the default setting, privacy embedded into design, full functionality (positive-sum rather than zero-sum), end-to-end security, visibility and transparency, and respect for user privacy. Quebec's Law 25 and the EU's GDPR both include privacy-by-default requirements that echo these principles.

For robots, privacy by design translates into concrete techniques. Process data on the robot rather than sending raw video to the cloud. Keep only what is needed: a navigation map need not keep faces, and a person detector can output positions without storing images. Blur or mask faces and screens in recorded images. Retain logs only as long as needed and delete them automatically. Give users visible indicators when cameras or microphones are active, and physical shutters or switches. Make privacy settings easy to find and protective by default. Secure remote access with strong authentication and encryption, and patch vulnerabilities, since a hacked home robot is a camera on wheels.

Statistical privacy techniques can protect aggregated data. A dataset is k-anonymous if every record shares its combination of quasi-identifiers, such as age band, postal code prefix and ward, with at least \( k - 1 \) other records, so that no one can be singled out by those attributes. Differential privacy goes further, adding calibrated random noise to statistics so that the presence or absence of any single person changes the result only slightly. The Laplace mechanism adds noise with scale \( \Delta/\varepsilon \), where \( \Delta \) is how much one person can change the statistic and \( \varepsilon \) is the privacy budget; smaller \( \varepsilon \) means stronger privacy and noisier results.

# k-anonymity check on robot interaction records and a differentially private count
import numpy as np
rng = np.random.default_rng(430)
n = 300
age_band = rng.choice(["18-39", "40-64", "65-79", "80+"], n, p=[0.2, 0.3, 0.3, 0.2])
ward = rng.choice(["A", "B", "C", "D", "E"], n)
postal = rng.choice(["K1A", "K2B", "K2C", "K7L", "M5V"], n, p=[0.3, 0.3, 0.2, 0.15, 0.05])
keys = np.array([f"{a}|{w}|{p}" for a, w, p in zip(age_band, ward, postal)])
_, counts = np.unique(keys, return_counts=True)
print(f"k with age, ward, postal prefix: {counts.min()} (groups of size 1: {np.sum(counts == 1)})")
keys2 = np.array([f"{a}|{w}" for a, w in zip(age_band, ward)])   # drop postal prefix
_, c2 = np.unique(keys2, return_counts=True)
print(f"k after dropping postal prefix: {c2.min()}")
true_count = int(np.sum(age_band == "80+"))
for eps in (0.1, 1.0):
    noisy = true_count + rng.laplace(0, 1 / eps, 5)
    print(f"epsilon {eps}: true {true_count}, noisy releases {np.round(noisy).astype(int)}")

k with age, ward, postal prefix: 1 (groups of size 1: 19)
k after dropping postal prefix: 10
epsilon 0.1: true 67, noisy releases [52 71 68 63 76]
epsilon 1.0: true 67, noisy releases [68 66 68 67 68]

Frameworks for robot ethics

Isaac Asimov's Three Laws of Robotics, introduced in his science fiction in the 1940s, are often quoted, but they were written as a plot device that generates dilemmas, and they cannot be implemented: concepts such as harm and obedience are too ambiguous to program, and the laws conflict in practice. Modern robot ethics instead draws on established ethical theories, such as consequentialism, deontology and virtue ethics, and on practical frameworks and standards.

Several ethical issues recur in HRI. Deception and attachment arise with social robots (lesson 5). Responsibility is unclear when a robot causes harm: is the manufacturer, the programmer, the operator or the owner at fault? Philosophers have described possible responsibility gaps where no one seems fully accountable, which is one reason standards require traceability, logging and clear human oversight. Bias can enter through training data, as when person detectors perform worse for some skin tones or body types, or recognition systems fail for people with disabilities (lesson 10). Robot design can reinforce stereotypes, such as default female voices for assistant robots and male-coded designs for security robots. Autonomy and paternalism must be balanced in assistive robots, which should support users' choices rather than override them. Military and policing uses of robots raise questions of lethal force and accountability that are debated internationally and are beyond the scope of this course.

Social impact: work and society

The effects of robots on employment are debated. Robots substitute for some tasks, complement others and create new ones, such as robot technicians, integrators and fleet supervisors. Economic studies give mixed pictures. A widely cited study by Daron Acemoglu and Pascual Restrepo, published in 2020, estimated that in US local labour markets between 1990 and 2007, each additional industrial robot per thousand workers was associated with a reduction of about 0.2 percentage points in the employment-to-population ratio and about 0.4 per cent in wages. Studies in other countries and periods have found smaller or different effects, sometimes with job losses in manufacturing offset by gains in services. The distribution of effects matters: workers in routine manual jobs, often without post-secondary education, are most exposed, while gains accrue to owners of capital and to skilled workers.

HRI design choices influence how robots affect work. Designs that keep workers in skilled, meaningful roles, that remove dangerous or repetitive tasks rather than the most rewarding ones, and that are introduced with training and worker involvement tend to produce better outcomes than designs that simply minimize labour. Governments and unions in Canada and the United States have debated retraining programs, transition support and the taxation of automation; these are policy questions on which reasonable people disagree, but HRI designers should understand that their choices are part of them. Beyond work, robots in public spaces raise questions about who gets to decide where robots operate, how sidewalks and public spaces are shared, and who benefits from the convenience they bring.

An ethics checklist for HRI projects

A short checklist helps bring these issues into everyday design work. Who are all the stakeholders, including bystanders and workers who did not choose the robot? What data does the robot collect, and is each item necessary? Which laws apply in each jurisdiction where the robot will be used? Could the robot deceive, manipulate or create unhealthy dependence? Who is accountable if it causes harm, and can its decisions be reconstructed from logs? Does it work equally well for people of different skin tones, ages, body types, languages and abilities? How will it affect workers' jobs, pace and autonomy? Answering these questions early, documenting the answers and revisiting them as the design evolves is a practical way to act responsibly.

# Privacy configuration for a deployed service robot (listing)
privacy:
  camera:
    on_robot_processing: true
    store_raw_images: false
    face_blur_in_logs: true
    active_indicator_led: true
  microphone:
    wake_word_only: true
    cloud_transcription: opt_in
  maps:
    remove_people_from_saved_maps: true
  logs:
    retention_days: 7
    worker_level_productivity_reports: disabled   # aggregate only, per policy
  remote_access:
    require_mfa: true
    session_recording: true