Ending a session must clear personal data and login so the next user inherits nothing

What it is

If “end” is only a return to the attract loop, the name in the form, the ID photo in preview, the browser back stack, the print queue, and a still-live login are all still there, and the next user inherits a pile of personal material nobody claimed. Session end must clear personal data and login means that after an explicit end or a timeout, a public device must not leave traces the next user can read or use. The object is leftover from this machine's last session, not how a platform honours an erasure request or what remains in backups. What is cleared is UI and local session: fields, tokens, previews, queues, accounts—not a claim that a privacy principle is already satisfied.

Why it happens

A public terminal packages one use as a short session, but the implementation often stacks a web view, peripherals, and third-party widgets. Returning the picture to a screensaver only swaps the top layer: values still sit in the DOM, a login cookie is still alive, the camera's last frame is still in memory, the printer is still emitting the previous named slip. The next user hits Back, pulls history, or waits for a late print, and inherits. The harm is asymmetric: forgetting to end costs being seen by a stranger; the next user need not attack, only use controls the UI already offers. Clearing login but not the form, or the form but not the token, lets a refresh restore the signed-in state. A multi-app kiosk also has to count peripheral buffers: a passport scan head, a signature pad, a card reader still holding the last payload when the session ends.

Studying it

Run a full task. After end or timeout, a second person acting as “the next user” tries, on the same machine: Back, refresh, history, waiting on print, reopening the camera. List personal fields still visible or usable.

Independent variables: which layers end clears (frame / form / token / peripheral buffer), whether the container is restarted. Dependent variables: count of fields the next user can read, whether the previous account continues without credentials, whether a late print still carries the previous name.

Do not stop at “it looks like the home screen.” Lab test accounts understate the impact of a real name and an ID photo. Print and email receipts lag; sample the thirty seconds after end as well.

Where it stops holding

Transaction logs that must be kept by law are not “traces the next user can access,” and they also should not appear on the screen or a public print slot. A staff debug mode that can reopen the last session has to be isolated from the public path. A pure lookup screen with no input has little personal material to clear. A receipt the user asked to print and take is a product, not residue; residue is the same slip still on screen. A cloud cart signed in on the public browser can survive a local wipe; clearing the local session has to cut the site login too, or the next user still opens it in the same browser.

Applying it

• On end, clear in one pass: visible fields, backend login tokens, navigation history, camera and scan previews, unsent personal copies in print and mail queues.
• Destroy a session container or guest profile on end, rather than only swapping the top layer for an attract page.
• Drop peripheral buffers on end, and guarantee a late print no longer carries the previous name.
• Verify with a two-person relay: after the first person ends or times out, the second uses only controls the UI already offers and lists personal information still visible; any non-empty item means the wipe is incomplete.

Related

• Within the group: K7.10.1 Public-device sessions need an explicit end action, not timeout alone · K7.10.3 Walk-away timeout length trades convenience against privacy risk · K7.10.4 Payment and identity sessions need an explicit visual end, not a silent exit
• Adjacent: K7.04 Simultaneous Multi-user Use · O1.07 Right to Erasure and Data Deletion · O3.17 Sensitive information on screen
• Search terms: session residue · kiosk wipe · shared-terminal leftover