Account switching must be cheap

What it is

For co-viewing to work, someone must be able, in a few steps, to change the current profile to the person present or to a shared profile. If switching means walking nested menus, typing a long password, and waiting for Home to reload, people stay on the wrong profile—personalization keeps running on someone else’s record, rated content may not be gated, and viewing is written to the wrong person. Account switching must be cheap is about the step count and the cost of getting it wrong, not how recommendations are computed, and not how disclosure itself happens.

Why it happens

Every remote step is expensive, and switching happens at peak social pressure: someone just sat down, a child walked in, a guest wants a title. The window is a few seconds. Once the path is longer than “open the profile rail → pick an avatar,” those seconds are eaten by small talk and the switch is skipped. After a skip, the system still sees the old profile, and a whole evening of records and recommendations is written wrong.

Locks and cost are a pair. Kids profiles need a PIN; a guest profile should not see the owner’s Resume; those checks have to exist. If every switch demands the full account password, everyday switching among adults dies. The cheap shape is: profiles already signed in on this device switch in one press; only protected profiles add a short PIN, with a try limit—not a full re-login for every profile.

Switching also has to be visible. The profile rail must be findable at power-on and on Home; buried in Settings it does not exist. Undo of a wrong pick must be cheap too: one more press back to the previous profile, not walking the list again.

Where it stops holding

A single-person household, a TV in a private room, switches rarely; the path can sit deeper. Classroom or office devices need end-of-session clearing, not a family profile rail. Voiceprint or face auto-switch in a living room mis-guesses who is present: a guest as the owner, a child as a parent. An automatic wrong switch is harder to notice than two extra presses. When the OS user, the streaming user, and the store user are separate profiles, switching one is not switching all; cheapness has to say which layer just changed.

Applying it

• Put a horizontal profile rail on power-on and Home, reachable in a few D-pad steps. Protected profiles add one short PIN, not an email password every time.
• Keep the current profile artwork in a focusable slot; selecting it opens switch, with no detour through Settings.
• Offer “back to the previous profile” for a few seconds after a switch, then let it lapse, so a mis-tap does not write the evening to someone else.
• Verify by timing, with someone already seated, from “this is the wrong profile” to “the new profile’s Home is usable.” More than a couple of seconds, or anything that requires leaving the sofa, is too dear. Repeat with a PIN-gated kids profile to confirm it blocks unauthorized use without blocking everyday adult switches.

Related

• Within the group: K5.05.1 Personalization leaks when several people are in the room · K5.05.3 Recommendations must account for co-viewing
• Adjacent: M4.08 Multi-user voiceprint and account switching · K8.05 Pairing and discovery · O3.02 Two-factor authentication
• Search terms: profile switching · PIN · household accounts