People entering a space passively have not consented
Aliases: bystander privacy · third-party consent gap
What it is
The population a smart space senses does not stop at the buyer: people who enter passively — visitors, couriers, invited guests — fall under the same sensors. Their reason for entering has nothing to do with the sensing (socialising, making a delivery), and they have consented to nothing. The consent structure breaks here: the person who decided is the one who bought the device; the people who bear the capture had no part in the decision. The gap is sometimes named bystander privacy.
This is not a corner case: a person with an ordinary social life enters more sensed spaces in a week than they own — passive entry is the standard path to being captured, and the "I have agreed" clicked on one's own devices covers none of it.
Why it happens
The classical informed-consent model implicitly assumes data subject = decision-maker: whoever is captured decides. Shared spaces pull the two apart — the host decides, the guest bears. The gap cannot be repaired with an "opt-out": the cost of refusing to enter is social (never visiting friends, leaving parcels at the door, skipping the shop), too high to exercise in practice; "entry implies consent" is therefore imposed, not chosen.
Two still-weaker subjects sit inside the structure: children, who can neither exit nor consent, whose capture is decided wholesale by guardians; and the unaware, who do not even have the first layer of knowing they entered a sensed space. The host is thereby cast as a fiduciary — making privacy decisions on behalf of everyone who enters — and almost no product makes that responsibility explicit.
Studying it
- Bystander privacy research: public debate and user studies around voice assistants and home cameras repeatedly document concern about "third parties being recorded" — device owners consented themselves yet assumed invisible obligations on behalf of their guests (smart home privacy surveys such as Zeng, Mare and Roesner 2017 also cover the position of guests' data).
- Norm-gap analysis: comparing "product compliance" (the buyer was informed) against "in-situ informedness" (the entrant knows) is the framework such studies commonly use.
Where it stops holding
- Passive entry implies neither zero rights nor veto rights. A guest's social expectation of "a security camera in a friend's home" differs from "covert recording" — social norms draw a middle band whose boundaries move across cultures; products can only anchor to the conservative side.
- The responsibility lands on the fiduciary. Guests cannot reach the host's device settings; any improvement operates through the host's choices — design must act at purchase and installation time, not rely on guest self-defence.
Applying it
- Degrade guest-facing capture by default: on detecting unenrolled presence, pause recording, drop voice retention, switch off personalisation — make "conservative on guests' behalf" the default rather than an option.
- Make the fiduciary duty explicit at purchase and installation: "this device will also sense others who enter the space", with guest mode as a step of setup rather than a switch buried in settings.
- For capture that cannot be avoided (security), provide notice before entry — door-level signage, relying on the existence of a physical indication.
- How to check: have an unaware guest enter the space and ask afterwards "did you know what this room was capturing?" — a blank answer is direct evidence of a missing notice layer.