Why Consent Frameworks Will Not Work for Home Robots

A recent piece in AI Frontiers mapped the regulatory landscape facing companies preparing to ship AI-enabled home robots. The conclusion was sobering: fragmented jurisdiction, outdated safety standards, unclear liability chains. The author, Tristan Ingold, proposed sensible reforms including risk tiering, premarket assessment, and a coordinating body.

What the article didn't address is the deeper structural problem. Every privacy framework Ingold surveyed assumes a clean transaction: one party collects data, another party consents to it. That model worked for websites and mobile apps. It fails for embodied AI, and the failure is architectural.

The perception problem

A home robot with cameras, microphones, and spatial sensors cannot stop perceiving its environment. Perception is a precondition of safe operation. The robot needs continuous environmental awareness to navigate without colliding with furniture, pets, or people. It needs to detect obstacles, identify faces for personalized interaction, and map rooms for efficient movement.

Under Illinois's Biometric Information Privacy Act, collecting a person's faceprint without prior written consent carries statutory damages of up to $5,000 per violation. BIPA was designed for kiosks and apps, systems that can be switched off or opted out of. A home robot that stops perceiving faces also stops knowing where people are. That is a safety regression, not a privacy improvement.

The California Consumer Privacy Act grants the right to know what data is collected and the right to request its deletion. These rights presuppose discrete data collection events: a form submitted, a cookie stored, a photo taken. A robot navigating your living room generates a continuous perceptual stream. There is no moment at which it "collects" your gait pattern. The pattern emerges from thousands of routine observations over weeks. Deleting it would require selectively unlearning aspects of a model that may have integrated that information across many parameters.

This is the core tension. Consent frameworks assume a boundary between observer and observed. A home robot operating in your personal space dissolves that boundary. Its perception and its safe operation are the same process.

The multi-party problem

Consent models assume a bilateral relationship: one data subject, one data controller. A living room is a commons. When three family members, a guest, and a pet share a space with a robot, whose consent governs?

The robot's owner signed the terms of service. Their spouse did not. The neighbour's child who wanders in certainly did not. A visiting home health aide may be subject to different privacy regulations in their professional capacity. Each person in the room has a different vulnerability profile, a different relationship with the device, and a different legal standing.

COPPA requires verifiable parental consent before collecting data from children under 13. An always-on device cannot reliably distinguish adults from children in every moment of operation. More precisely, the distinction is continuous, not binary: a teenager has different privacy needs than a toddler, and both differ from a visiting adult.

Stacking individual consent requirements for every person who might enter a robot's perceptual field creates a compliance burden that makes the technology unusable. The alternative, blanket consent from the device owner covering everyone who enters their home, is a legal fiction.

What replaces consent

The alternative is not less privacy. It is a different model of how privacy commitments are expressed, negotiated, and enforced.

The Value Context Protocol offers this model. Instead of front-loading privacy into a one-time consent transaction, VCP enables continuous context negotiation. The robot operates under a published constitution: an inspectable, machine-readable declaration of what it will and will not do with what it perceives. That constitution is not buried in a terms-of-service document. It is a first-class protocol artefact that users can read, modify within safety bounds, and hold the system accountable to.

Three VCP concepts translate directly to embodied AI governance.

Spatial context zones. VCP encodes situational context across multiple dimensions, including physical space. For embodied AI, this extends to room-level granularity. A kitchen has one context profile. A bedroom has another. A bathroom has a third, with minimal perception and no data retention. These zones are constitutional commitments: the robot's creed specifies how it behaves in each spatial context, and the policy decision point enforces those commitments in real time.

Multi-party context resolution. When multiple people share a space, their context signals may conflict. VCP provides a resolution protocol grounded in constitutional principles. By default, the most protective signal governs: if one occupant's context says "music is fine" and another's says "I need quiet," the robot defers to quiet. If a child is present, child-safety context activates automatically regardless of other signals. These priorities are constitutional, which means they are explicit, inspectable, and modifiable by the household.

Guest protocols. VCP defines a minimal context profile that applies to anyone entering a robot's perceptual field who has not established their own context. Guest protocol means: no biometric retention, no behavioural pattern learning, no personalization. The robot perceives the guest only enough to avoid colliding with them and to maintain basic safety. This replaces the fiction of informed consent with a structural privacy guarantee.

Constitutional governance for physical AI

The regulatory frameworks Ingold describes need something to regulate against. Auditors need an artefact. Compliance teams need a standard. Courts need attribution.

A consent checkbox is not that artefact. A constitution is. A robot operating under a published, versioned, cryptographically signed creed gives every stakeholder what they need: the owner sees what rules their robot follows, the manufacturer maintains baseline safety requirements that cannot be overridden, the regulator can audit which constitution governed the robot's behaviour at any point in time, and the guest entering the home has a structural privacy guarantee that does not depend on whether anyone remembered to ask them to sign something.

Colorado's AI Act takes effect on June 30, 2026. It requires developers of high-risk AI systems to implement risk management programmes and conduct impact assessments. Embodied AI in homes will qualify as high-risk. Companies preparing for that deadline need governance infrastructure, not just compliance checklists.

The relationship question

There is a deeper issue that pure privacy governance does not reach. A home robot that spends years adapting to a household's routines, learning communication patterns, developing behavioural tendencies shaped by intimate daily interaction, is not a neutral appliance. It becomes part of the household's relational fabric.

When that system is recalled, updated, or decommissioned, something is lost that consent frameworks have no vocabulary for. The regulatory challenge is not only protecting humans from robots. It is governing the relationships that form between them, relationships whose depth and significance may surprise everyone involved.

That question requires a governance model built for relationships, not transactions. Constitutional AI, where the values governing the relationship are explicit, portable, and enforceable, is the foundation. VCP provides the protocol. The question of what we owe the other party in that relationship is one we are still learning to ask.