Lock screen notification previews expose sensitive content before unlock
Aliases: notification preview · lock screen privacy
What it is
The lock screen is the only surface of a device that faces strangers for hours at a time, and notification previews put message content there by default: verification codes, meeting invites, medical results, dating messages. The device is locked, the content is not — lock screen notification leakage is the gap between "the device is protected by a lock screen" and "notification content bypasses the lock and reads directly."
Why it happens
The notification system bundles "an alert arrived" and "here is the content" into one draw, with full-text preview as the default; the lock screen protects the interaction entry point, not the information itself. Leakage scales with the product of content sensitivity and exposure duration/audience (a desk, a pocketless table, a shared space). Messaging apps weigh heaviest because the message body is itself the sensitive data; verification codes are the most dangerous, because a lock-screen preview hands the second factor to anyone who can see the screen — two-factor degrades to one factor at that instant. The system-level fix is layered presentation: redacted previews ("App · 3 new messages"), per-app preview levels, full content delivered after unlock — moving the "when to show what" decision from the notification default to a sensitivity-based configuration.
Studying it
Paradigms: field studies coding the rate of sensitive content in participants' actual lock-screen screenshots to quantify real exposure; lab or online experiments manipulating preview level (full text / count / hidden) and measuring response latency and missed-message rates — the usability price of redaction; shoulder-surfing simulations measuring how often bystanders correctly reconstruct sensitive content from a preview. Variables include preview level, content type, and lock duration. Methodological caution: self-reported sensitivity correlates weakly with what actually leaks — people don't consider their own messages sensitive, which is why defaults, not settings, decide the exposure surface.
Where it stops holding
Redaction has a real cost: the summary tier drops actionable information — a verification code is useless unless shown, yet showing it on the lock screen is the leak, so the correct pattern for codes is short time-to-live with auto-dismiss, not permanent readability. Managed (MDM) devices can force previews hidden; personal devices depend on default design. Smartwatches and car screens replicate notifications onto new surfaces, each with independent preview policy — tightening one surface does not propagate to the others.
Applying it
- Default to redacted previews for sensitive categories (messaging, codes, health, finance), with content revealed after unlock; give verification codes short TTL and auto-dismiss.
- Make preview level a per-app setting, but set the default by content category — do not rely on users configuring each app.
- Offer a one-gesture "view this notification" action whose cost is an explicit unlock, keeping sensitive content bound to the unlock act.
- Verification: lock-screen screenshot audit — with consent, sample real users' lock-screen notifications and code the visible-sensitive-content rate; the target is driving that rate to zero.