Personal information does not belong on a shared screen
Aliases: personal content on public glass · shoulder surfing · broadcast UI
What it is
Every pixel on a shared screen is a broadcast to whoever is present. A name, a face, a message, a payment amount, a medical identifier, once drawn on that glass, is no longer “the current operator’s UI.” It is a public picture for onlookers, later arrivals, and people across the way. The claim is about co-present geometry: whoever stands in the viewing cone can read it. It is not an abstract privacy principle, and it is not about whether a session is wiped after someone leaves—that is a trace after departure, not who the glass is showing while several people are still there.
Why it happens
A personal device assumes the holder as audience: arm’s length, a chosen angle, and anyone else has to lean in. A public large screen inverts all three. Type is enlarged for distance, the viewing angle covers the whole standing zone, and the operator cannot body-block every pixel. “I am looking up my own stuff” is spatially equal to “I am holding this stuff up to the room.” Co-present people need no prying intent; the content walks over to them.
Simultaneous use widens the broadcast. One person’s query, a face-match result, a successful login, become the backdrop for everyone else’s turn. Operators overestimate control of the visible field—the type looks small to them, the other person seems busy on their side—while layout on a large screen is built for the farthest reader, so a nearby spectator reads it better. Co-viewing on television already exposes taste through personalised recommendations; a public wall is the same geometry, harder: there is no remote to cut away fast, and no “this is our living room” membership boundary.
Studying it
Shoulder-surfing and public-display deployments treat “what a third party can read” as the dependent measure: station an observer behind or beside the operator and record which fields come through. Co-viewing work is a contrast class—personalised content leaking in a living room—but third parties at a public screen are unspecified, with weaker membership.
Independent variables: whether a field appears on the shared surface, type size against viewing distance, observer angle relative to the operator, whether a second operator is present. Dependent variables: items a third party reads correctly, what the operator afterwards believed others saw, operations aborted because they were being seen.
A lab “observer” introduced as a colleague does not carry the same social cost as a stranger in the street. Do not let the operator’s comfort ratings replace what a third party can actually read—people often do not know their screen is still sharp at three metres.
Where it stops holding
Fully public content (departures, weather, exhibit captions) is already a broadcast; there is no “personal field on screen” to refuse. An operator who voluntarily throws a work onto the wall for others to see wants the broadcast. A one-person window machine or a covered cash interface narrows the cone in hardware, weakening the geometric assumption, though the side angle still needs a check. Content that is personal to the operator but shared among a present family (finding a route, ordering together) would be gutted by “never put it on the wall.” The split then is “this group” versus “everyone outside it,” not “operator versus the world.”
Applying it
- Default to: everyone in the viewing cone can read all type and images on the screen. Do not draw personal fields (identity, communications, payment, health, precise location) on the shared surface.
- Put checks that must stay personal on the operator’s phone, or on a small panel that faces the operator and faces away from the crowd. Leave on the public screen only outcomes this group jointly needs.
- Do not keep residues “about me”—search boxes, login state, recommendation reasons—as a standing layer of the public picture.
- Verify by standing a person who is not operating at a typical spectator spot and listing every field they can read. Anything personal to the operator and not required by everyone for the task in hand does not belong on that glass.