Is this emotion recognition under the EU AI Act?

The Immersion SDK doesn’t identify or infer emotions or intentions. It computes two behavioral predictors from cardiac rhythms. We describe it as a prediction engine, not an emotion-recognition system. Your counsel should confirm the classification for your specific use, and we’ll support that review.

Is heart rate biometric data?

Heart rate isn’t a biometric identifier: it can’t identify a person the way a face or voiceprint can, so BIPA-style consent doesn’t apply. The Immersion SDK never stores or writes heart-rate data at all; it’s used in memory on the device and discarded.

Is this neural data under state privacy laws?

The Immersion SDK doesn’t measure nervous-system activity. It measures cardiac rhythm from whatever sensor your app reads and infers a score from it. Several state laws exclude data inferred from non-neural information; definitions vary by state, so confirm with counsel for the states you operate in.

Do I need a Data Protection Impact Assessment (DPIA) or a consent screen?

Not because of the Immersion SDK. It requires no HealthKit or Health Connect permission, no biometric consent, and no emotion-recognition disclosure, and no health data leaves the device. Your app supplies the sensor data; if reading them needs a permission, that’s your app's requirement, not the Immersion SDK's. Whether your overall app needs a DPIA depends on everything else it does.

Can I use this in a workplace or education app?

The EU AI Act bans emotion recognition from biometric data in workplaces and schools. The Immersion SDK isn’t an emotion-recognition system, but this is exactly the setting where you should have counsel confirm before shipping. We’ll help.

What does Immersion receive from my users?

Nothing personal. One activation call with your company ID, key, and app identifier, plus an anonymous count of active devices for billing. No heart rate, no scores, no names, no locations.

Why would heart rate tell you anything about the brain?

When an experience matters, the brain releases oxytocin into the bloodstream at the same moment it acts in the brain. Oxytocin binds to the vagus nerve and to receptors in the heart and changes its rhythm in real-time. The Immersion SDK decodes that change. It’s the body's response to the brain, read from a wearable.

Five methods compared · 11 min read

How do I measure emotion in my app?

You have five options: point a camera at the face, listen to the voice, read heart-rate variability from a sensor, ask, or use the Immersion SDK. Three of them collect data that regulators now treat as biometric, health, or emotion-recognition input, with the consent screens, disclosures, and litigation exposure that follow. One is lawful but too weak to act on. One adds no additional regulatory risk to your company at all. The Immersion SDK measures the body's response to what the brain is doing, on the device, and returns two behavioral predictors, Value and Psychological Safety. It’s a prediction engine, not an emotion-recognition system, and it doesn’t collect a face, a voice, or health data.

You probably don't need emotion labels.

You’re asking how to measure emotion, but what you almost certainly need to know is whether an experience landed, and whether it will change what the user does next.

That’s a different measurement.

Named emotions are contested science and a regulated category; how much an experience mattered to the person is neither, and it’s the one that predicts behavior. The Immersion SDK measures the body's response to what the brain is doing and turns it into two scores.

What each method collects, and what the law calls it

Every red cell is a legal obligation you take on: a biometric identifier you must consent and retain, health data you must protect, or an emotion-recognition system you must disclose and, in workplaces and schools, can’t deploy at all. The Immersion SDK is the only row without one.

Option	Passive	Timing	Biometric identifier	Health data leaves device	Emotion-recognition system	Predicts behavior
Facial coding	Partly	Seconds after the internal response; only when the expression surfaces.	Yes	No	Yes	Unreliable.
Voice prosody	No	Only while the user is speaking; nothing between utterances.	Yes	No	Yes	Weak.
Heart-rate variability (HRV)	Yes	1 to 5 minutes late. HRV needs a window of beats before it can say anything, so the reading arrives after the moment that caused it has passed.	No	Yes	Yes	Poor for valence, and late.
Surveys and self-report	No	Minutes to days after the moment.	No	No	No	Weak.
Immersion SDK	Yes	Instant.	No	No	No	Strong.

What each method makes you liable for

None of this is hypothetical. Every rule below is in force, every settlement below has been paid, and every one of them is cited.

Facial coding

Biometric identifier + emotion recognition

Facial geometry is a biometric identifier under Illinois BIPA and Texas CUBI (written consent, retention policy, private right of action in Illinois; $650M Facebook, $1.4B Meta, $1.375B Google). Under GDPR Article 9 it’s special-category data once it identifies. Under the EU AI Act, inferring emotion from a face is an emotion-recognition system: banned in workplaces and schools since February 2025, subject to a duty to inform users since August 2026, and high-risk from December 2027. California's ADMT rules name "analysis of facial expression" expressly.

In practice: A consent screen before the camera turns on, a biometric retention policy, an AI Act risk file, and a per-user disclosure that you’re reading their face, which is also the moment the reading stops being reliable.

Immersion vs facial coding

Voice prosody

Voiceprint + emotion recognition

A voiceprint is a biometric identifier under BIPA, and 2026 has brought a wave of voiceprint class actions against AI products. Inferring emotion from voice is an emotion-recognition system under the EU AI Act with the same ban, disclosure duty, and high-risk classification as facial coding. Recording users also triggers wiretap and consent rules that vary by state.

In practice: Microphone permission plus biometric consent plus a disclosure that you’re analyzing how they sound. Coverage is limited to the moments they talk.

Immersion vs voice prosody

Heart-rate variability (HRV)

Health data + emotion recognition, without the science to justify either

Heart rate from HealthKit or Health Connect is health data under Apple and Google policy and under GDPR Article 9 once it is stored against a person; shipping it to a cloud for "emotion analysis" moves it across a border it didn’t need to cross. And because a heart-rate stream is physiological data, a model that infers emotion from it is still an emotion-recognition system under the EU AI Act. On-device processing doesn’t change that classification. What HRV gives you in return is arousal, not value.

In practice: The moment you label the output an emotion, you inherit the same file as facial coding: health-data handling under Apple 5.1.3, Google Health Connect policy, and GDPR Article 9; an emotion-recognition system under the EU AI Act, banned outright in workplace and education apps, with a per-user disclosure duty everywhere else and the high-risk regime from December 2027. On-device processing changes none of it. And what you get for that file is a stress score that can’t tell an important moment from a boring one, delivered minutes after either one happened.

Immersion vs heart-rate variability (hrv)

Surveys and self-report

No legal obligations. A scientific limit.

Surveys are lawful and simple. They’re also late, thin, and biased, which is usually why a developer is asking this question in the first place. Response rates fall as apps mature, and the people who answer aren’t the people who left the event.

In practice: Cheap to build, hard to trust, and impossible to act on in the moment.

Immersion vs surveys and self-report

The Immersion SDK

A prediction engine, not an emotion-recognition system.

No biometric identifier, so BIPA and its cousins don’t apply. No health data stored or transmitted, so nothing crosses a border that Apple, Google, or GDPR Article 9 would care about. No named emotions inferred, so it’s not an emotion-recognition system under the EU AI Act. It calculates from whatever sensor your app already reads and computes two behavioral predictors inside your app: a prediction engine that draws no inference from a face, a voiceprint, or a brain scan.

In practice: The Immersion SDK asks your users for nothing. It requires no HealthKit or Health Connect permission and no entitlement of its own: your app hands it samples from whatever source it already has (a BLE fitness sensor, a watch, a file) and it hands back Value and Safety. A BLE fitness strap feeding fitness data into your app needs no health permission at all. If your app reads heart rate through HealthKit or Health Connect, that permission is your app's requirement, not the Immersion SDK's. No biometric consent, no emotion-recognition disclosure, no health data leaving the device.

No biometric identifier collected
No health data stored or transmitted
No named emotions inferred
No face, voice, or brain scan
No permissions or entitlements of its own
Scored on the device, instantly, every second
Predicts memory and behavior, 85–98%

Create a free account Verify our privacy claims Why heart rate?

Regulatory summaries on this page are for orientation, not legal advice. Confirm classification for your own app with counsel; we’ll support that review.

Is it emotion recognition? Is heart rate biometric? Do I need a DPIA?

Is this emotion recognition under the EU AI Act?: The Immersion SDK doesn’t identify or infer emotions or intentions. It computes two behavioral predictors from cardiac rhythms. We describe it as a prediction engine, not an emotion-recognition system. Your counsel should confirm the classification for your specific use, and we’ll support that review.
Is heart rate biometric data?: Heart rate isn’t a biometric identifier: it can’t identify a person the way a face or voiceprint can, so BIPA-style consent doesn’t apply. The Immersion SDK never stores or writes heart-rate data at all; it’s used in memory on the device and discarded.
Is this neural data under state privacy laws?: The Immersion SDK doesn’t measure nervous-system activity. It measures cardiac rhythm from whatever sensor your app reads and infers a score from it. Several state laws exclude data inferred from non-neural information; definitions vary by state, so confirm with counsel for the states you operate in.
Do I need a Data Protection Impact Assessment (DPIA) or a consent screen?: Not because of the Immersion SDK. It requires no HealthKit or Health Connect permission, no biometric consent, and no emotion-recognition disclosure, and no health data leaves the device. Your app supplies the sensor data; if reading them needs a permission, that’s your app's requirement, not the Immersion SDK's. Whether your overall app needs a DPIA depends on everything else it does.
Can I use this in a workplace or education app?: The EU AI Act bans emotion recognition from biometric data in workplaces and schools. The Immersion SDK isn’t an emotion-recognition system, but this is exactly the setting where you should have counsel confirm before shipping. We’ll help.
What does Immersion receive from my users?: Nothing personal. One activation call with your company ID, key, and app identifier, plus an anonymous count of active devices for billing. No heart rate, no scores, no names, no locations.
How do I measure emotion in my app?: You have five options: facial coding, voice prosody, heart-rate variability, surveys, or the Immersion SDK. The first four each carry a regulatory or scientific cost. The Immersion SDK takes a different approach: it measures the body's response to what the brain is doing, on the device, and returns two behavioral predictors, Value and Psychological Safety. It’s a prediction engine, not an emotion-recognition system.
Why would heart rate tell you anything about the brain?: When an experience matters, the brain releases oxytocin into the bloodstream at the same moment it acts in the brain. Oxytocin binds to the vagus nerve and to receptors in the heart and changes its rhythm in real-time. The Immersion SDK decodes that change. It’s the body's response to the brain, read from a wearable.

All questions

All guides