Public-device sessions need an explicit end action, not timeout alone

What it is

“I'm done” on a loan kiosk, a hotel check-in, a photo booth cannot be left to a countdown. Public-device sessions need an explicit end action means the screen has to offer something a person can press—End, Log out, Done—while timeout is only the net for someone who already walked away. A terminal that only times out leaves people thinking they are still in the session: they fetch a bag, come back, and have been kicked; or they never notice they are still signed in and yield the spot to the next person. This entry is how the session's exit is operated, not how many seconds the countdown should be, and not which fields are wiped.

Why it happens

A private device's session belongs to the same person by default; exit can hide in an account menu. On a public device the next user is a stranger, so the exit has to be a task-level, in-view action, or the boundary exists only inside the system. Timeout equates “no touch” with “willing to end,” which are not the same event: someone may be reading, waiting, fishing for an ID, hands off the glass. With no end control, people who want to leave can only wait, or they assume dismissing a panel equals log-out. An end control in a corner labelled “home” is not read as cutting the login. Public tasks are already short; the end action has to be as discoverable as “next” to fit the motion budget. It also does social work: pressing it announces to the queue that the machine is free, cleaner than walking off in silence.

Studying it

Compare timeout-only with explicit end plus timeout backup, on a live site, for leftover sessions, premature kicks, and next users inheriting the previous session. Watch whether people hunt for an end before leaving, and whether they use it when they find it.

Independent variables: presence of an end control, placement and wording, whether a second confirm is required. Dependent variables: rate of explicit ends, how long a session lives after the person leaves, tasks cut by premature timeout, whether the next user starts inside the previous account.

Lab participants told to “please log out” inflate explicit ends. In the field, split “left because the task is done” from “abandoned unfinished,” or you cannot tell whether the control was used or bypassed. A second confirm suppresses explicit ends and shoves people back onto timeout—the exit closed again.

Where it stops holding

A poster with no login and no input has no session to end. A staffed counter reset after every use can be ended by a person, but still wants a one-tap reset so a handoff cannot miss. If a switch-scanning user can only move through a ring, End has to sit in that ring, not only on touch. A forced second confirm may be required for payment; on “I only checked the next train” it becomes a reason not to end. Presence sensing that ends when a body leaves can back up timeout; it cannot retire the on-screen end—sensing misfires when someone stands aside to open a bag.

Applying it

• Put a fixed-place End / Done on every in-task screen, worded as cutting the session, not as Back or Home.
• End is one tap; do not bury the exit in an account menu or behind a drawer.
• Timeout may coexist, but the UI has to show “I can end now,” not only a countdown.
• Verify by asking people to leave after the task and counting who find and use End; for those who do not, check whether the session is still live when the next user starts. Change the control and compare the same site, rather than quoting whether timeout fired.

Related

• Within the group: K7.10.2 Ending a session must clear personal data and login so the next user inherits nothing · K7.10.3 Walk-away timeout length trades convenience against privacy risk · K7.10.4 Payment and identity sessions need an explicit visual end, not a silent exit
• Adjacent: K7.04 Simultaneous Multi-user Use · C4.16 Disengagement and Timeout
• Search terms: kiosk logout · explicit session end · shared terminal