Walk-away timeout length trades convenience against privacy risk

What it is

Someone walks away without pressing End. Too short a countdown kicks people who are still there fishing for an ID or waiting on a companion—convenience drops. Too long, and the next person inherits the login. Walk-away timeout length trades convenience against privacy is how that backup timer is set, not whether an End control exists, and not which layers a completed end must wipe. Public devices must time out, because explicit end will not be used by everyone. There is no correct number of seconds, only which class of error is less acceptable.

Why it happens

Idle timeout treats “no input for a while” as “the person has left.” In public, idle has many causes: reading a long explanation, finding a card in a bag, turning to a companion, glancing at a timetable. Those gaps run from a few seconds to a minute or two, and they share one timer with “the spot has already been yielded to a stranger.” A short timeout protects the next user and forgotten personal data, and punishes people who have not left; a long timeout protects people who have not left, and leaves a window for shoulder surfing and the next user. Presence sensing can shorten the wait after a real departure, but sensing that treats someone standing aside to open a bag as gone will false-kill. A countdown that interrupts in the last seconds with no warning is read as a broken machine, and people are even less willing to use End next time. Payment and identity sessions tolerate less idle than “check the next train,” because leftover costs more; one thirty-second value on every task kicks too early on low-risk work and lingers too long on high-risk work.

Studying it

On a live site, log the distribution of no-input gaps during tasks, whether the person is still there when timeout fires, and whether the previous session is still live when the next user starts. Run several timeout lengths and compare interrupt rate against leftover rate.

Independent variables: idle threshold, countdown warning before end, presence sensing, whether the task includes payment or identity. Dependent variables: premature interrupt rate, seconds a session lives after the person leaves, next-user inheritances, abandonments caused by timeout.

Lab participants do not walk away, so timeout only shows up as “being interrupted.” In the field, video has to split “still reading” from “already yielded the spot.” Sensing schemes must report false-kills (ended while the person is there) and misses (still live after they left).

Where it stops holding

A staffed counter reset after every use can time out later; a person carries the privacy load. A closed one-person booth will not get an immediate next user, but there is still a window in which cleaning or security sees the screen after someone leaves. A poor network that leaves the UI hung will have idle timing treat waiting as departure; pause the timer or pull “system busy” out of idle. Children and assisted use often include long idle; an adult-solo threshold false-kicks. Never timing out hands the whole exit to conscientiousness, which does not hold on public devices.

Applying it

• Band by task risk: sessions with login, payment, or ID get shorter idle; pure lookup can run longer. Do not ship one site-wide second count.
• Warn with a countdown before timeout, and allow one tap to extend; the warning itself must not expose personal fields.
• If a presence sensor exists, use it to shorten the wait after the body is gone, but do not wipe the session on sensing jitter.
• Verify by coding, on video, both “kicked while still there” and “gone but session still live”; after changing the length, report both classes. Driving only one of them to zero is not a pass.

Related

• Within the group: K7.10.1 Public-device sessions need an explicit end action, not timeout alone · K7.10.2 Ending a session must clear personal data and login so the next user inherits nothing · K7.10.4 Payment and identity sessions need an explicit visual end, not a silent exit
• Adjacent: C4.16 Disengagement and Timeout · O3.18 Security–usability tradeoff framework
• Search terms: idle timeout · walk-away · session linger