Bystander appearance and motion data also constitute privacy collection and need a handling policy

What it is

Depth, skeletons, and RGB will include people who never agreed to use the product. Their appearance and motion are still collected personal data, even if they never issued a command. A handling policy is required: do not store, discard immediately, blur, or—where the law allows—keep briefly to filter input. “Bystanders are not users” is not a reason to write them out of the privacy notice. A false fire writes a bystander into a command; this writes them into storage and models.

Why it happens

Capture range is larger than the interaction volume; people in the aisle, at the other end of the sofa, outside the glass, still enter the frame. A pipeline that “records whole frames to improve recognition” makes bystanders into training samples by default. Skeleton keypoints still reflect build, gait, and who was in frame with whom; dropping the face does not stop them being personal data. Policy has to sit near the sensor: after detecting a non-participating body, do not send raw pixels off-device, or discard on leaving the interaction volume. Blurring in the cloud is late. Consent frames usually cover only the person who pressed “allow”; bystanders have no consent action, so the default must be minimize capture, not “unless they object.”

Studying it

In a real or high-fidelity venue, count people who enter the frame but never participate in an hour, whether their pixels leave the device, and retention time. Compare whole-frame upload, upload only inside the interaction volume, and on-device discard of bystander boxes. Have a privacy specialist walk the notice for whether bystanders are mentioned. Do not only ask operators “do you mind”—bystanders are often not on the interview list, which is the blind spot.

Where it stops holding

Law treats public-space cameras and in-home cameras differently; one global notice will not do. A pure infrared cloud too coarse to identify a person has a different risk shape, but can still expose head-count and trajectories. Safety uses (care, access control) treat bystanders as the object; that is another product category and needs its own notice, not surveillance under the name of a gesture TV. Research datasets that contain bystanders need a separate ethics and de-identification path.

Applying it

• By default do not send likeness or skeletons of people outside the interaction volume off-device. Improve models on operator footage that was agreed to.
• Write the privacy notice in sentences a bystander can read: “passing through is briefly seen by the sensor and not kept.”
• Acceptance: packet-capture a walk-through with no operation. Outbound traffic should not contain that person’s identifiable image or a full skeleton. If it does, there is no bystander policy.

Related

• Same group: C4.30.1 Actions of bystanders in the capture range should not be treated as user input · C4.30.3 The system needs to distinguish participants from third parties who are merely passing through · C4.30.4 Capture notices aimed at bystanders should be more conspicuous than those for users, because bystanders did not initiate the interaction
• Adjacent: C4.29 Visibility of capture state · C4.20 Interaction volume versus capture range
• Search: bystander privacy · incidental capture · on-device discard