Users cannot tell whether a device is still sensing or running

What it is

"Is it off?" is answerable for ordinary appliances — the switch has a physical position, the lamp being lit is the state. Invisible devices break that judgement: a voice speaker keeps a standby circuit hot waiting for a wake word, sensors quietly report on a schedule, and a camera's "off" may mean only "no notifications". The user faces not a switch state but a string of unverifiable promises: the vendor says privacy mode stops recording, but whether it is recording right now offers no observable evidence.

This is not paranoia; it is an epistemic vacuum: the sensing and running state is in principle unreadable by the user, who can only choose to trust or not trust — never to check. The "is it on?" problem is a common shorthand for exactly this bind.

Why it happens

Three sources stack.

Standby and active are physically identical. Conventional "on" comes with perceivable side effects — sound, light, heat — free evidence of state. Invisible devices suppress the working state's physical signature below the environmental noise floor: no fan, no light, negligible warmth. The evidence chain snaps.

"Off" is a software promise, not a physical break. A soft switch disables the function layer; the sensing hardware can remain powered and perceiving. Deep sleep, firmware wake-ups, cloud-initiated remote wakes can all happen after "off". The user's mental model reads "off" as a broken circuit; the implementation delivers a policy statement.

State semantics split. One device simultaneously has a power state (energised), a sensing state (sampling), a network state (connected), and a service state (cloud features enabled) — and a one-dimensional on/off label cannot cover a four-dimensional reality. A camera can be "on but not recording" or "off but still motion-detecting". "Is it running?" has no single answer, and devices rarely present the four dimensions separately.

Studying it

• Perception-versus-reality studies: measure users' judgements of "which devices are currently sensing or connected" in their homes against traffic monitoring or firmware state. A robust finding in smart-home privacy research is systematic divergence in both directions — under-reporting (sensing nobody knew about) and over-reporting (persistent unease about devices long unplugged).
• Semantics-of-off interviews: ask users what they believe happens after a device is "turned off", and compare with actual firmware behaviour, exposing the soft-off/hard-off gap in mental models.
• Trust and compensation studies: examine behavioural workarounds under unreadable states — physically covering cameras, pulling plugs, isolating devices on the router. These behaviours are themselves evidence that when state cannot be read, users go physical.

One methodological caution: such findings are sensitive to technical literacy; sample in strata, and pair self-report with network-level measurement wherever possible, since self-report alone drifts.

Where it stops holding

• Unreadability is a matter of degree. A camera with a physical shutter, a smart plug with a relay hard-break — these buy back readability by making "off" a physical fact again; the price is circuit and mechanism design.
• Vendor transparency statements work partially. Transparency reports and third-party audits change the basis for trusting, but not the unverifiability of this moment — declarations lower expected risk, not observational uncertainty.
• Over-reporting also costs. Persistent unease about devices that genuinely are off drives compensating behaviours (frequent power-cycling) that erode the experience; both tails of the divergence belong in the ledger.

Applying it

• Make "off" a graded physical fact: give the sensing path at least one hard break (a camera lens cover, a microphone disconnect relay) so the word returns to what the user's mental model means by it.
• Present the state dimensions separately: power, sensing, network, and cloud service each queryable on its own — no single on/off standing in for a four-dimensional reality.
• Rebuild the evidence chain with ambient side effects: leave a perceivable trace during sensing, however faint, so running state carries its own evidence the way conventional appliances always did.
• How to check: surprise home visits asking "which devices are sensing right now", scored against measurement — read together with the rate of compensating behaviours (unplugging, covering frequency).

Related

• Same group: Z1.05.1 When invisible systems fail, users lack the clues to localise the fault · Z1.05.3 Invisibility erodes users' sense of the system boundary · Z1.05.4 Costs compound with device count, while each device's cost looks tiny
• Nearby: Z6.08 Physical indication of sensing state · Z2.05 Privacy visibility of sensing
• Search terms: is it on problem · smart speaker privacy · device state legibility · soft off