Personalization leaks when several people are in the room

What it is

A television is a shared living-room screen. Resume, search history, For You, who watched—laid out from the current account’s personal record. The people on the sofa are not necessarily that account’s owner: a partner, a child, a guest, a parent. Personalization leaks when several people are present means those traces computed for one person become visible to everyone in the room. That is co-viewing disclosure, not a treatise on privacy principles, and not the same as whether the account has a lock.

Why it happens

For personalization to work, “this person watched, searched, might want” has to sit in the most visible slots on Home. TV type is large, distance is far, and the screen cannot be turned toward oneself like a phone, so disclosure is room-wide. Resume is the sharpest surface: the title is already the content, and the progress bar says how far. Search suggestions complete the last query on screen before anyone has spoken. Profile artwork, viewing rank, and purchase history are equally readable identities.

Harm is uneven. For the owner it is “I was seen”; for others it is “I now know something I was not meant to.” That changes the conversation and the next choice—someone pretends not to have seen, someone asks, someone takes the remote. Treating every personalization as care is, in co-presence, a default of maximum disclosure.

Who is present is usually unknown to the system. Cameras and mics can guess; a wrong guess hides what should show or shows what should hide. More stable signals are an explicit co-viewing mode, the current profile, and a chance to cancel before a screen that will paint personal history.

Studying it

Co-viewing privacy studies cross “which personal traces appear on screen” with “who else is in the room,” rather than only asking whether someone “cares about privacy.” Typical methods are staged scenarios or in-home observation: one person’s profile is up, a second person enters or is already there; record which surfaces disclose (Resume, search, recommendations, notifications) and how owner and others react.

Independent variables: content type (ordinary series / sensitive genre / search terms), relationship (partner / child / guest), surface (first screen of Home / one more step away). Dependent variables: immediate profile switch or UI dismiss, discomfort ratings, later change in viewing choice, verbal strategies (topic change, grabbing the remote).

Lab guests played by actors have limited ecological validity: real households hold a long-run tacit “what can be seen,” and a one-shot study can over- or under-estimate harm. Do not treat “turn personalization off” as the only intervention—Home goes empty, people turn it back on for usefulness, and disclosure returns.

Where it stops holding

Alone, or on a household “living-room account” with no personal record, there is no identifiable person to disclose. Hotel and short-let TVs leak to the next occupant, not to a second person on the sofa—that is session residue, not co-viewing. Phone notifications or call captions jumping to the big screen are a sudden disclosure with the same shape but a different source than recommendations. A kids profile is already rated; what leaks is “what the child is watching” to an adult, the other direction, with a different harm model.

Applying it

• On surfaces likely to be co-viewed (first screen of Home, power-on, return from playback), fold the most personal lists (Resume, search history) or replace them with household-facing covers. Put personal lists one press further away.
• Do not spread the last query across the search field before it is focused; suggestions appear only after an explicit enter-search.
• Offer one-press “living-room mode”: the session shows no personal history and writes no new viewing into a member’s profile. Exit needs confirm.
• Verify by having a second household member walk in with the profile unswitched, and listing which owner-identifiable items can be read in three seconds on the first screen. Each one is a disclosure. Measure again after the change, and confirm that Resume remains reachable when alone.

Related

• Within the group: K5.05.2 Account switching must be cheap · K5.05.3 Recommendations must account for co-viewing
• Adjacent: O1.08 Contextual integrity · O3.17 Sensitive on-screen exposure · K7.04 Simultaneous multi-user use
• Search terms: co-viewing · privacy in the living room · personalization disclosure