Personal information must not appear on shared devices

What it is

Shared surfaces — the kitchen tablet, the screen-bearing speaker, the TV, the door panel — have a physical audience of everyone within sightlines, while the system routes information by account: calendar reminders, message previews, medication alarms, and delivery details are pushed to "the account owner" but displayed to everyone present. Personal content on a shared surface is an incidental information disclosure: the audience of the disclosure is decided by where the device sits, not by the person the content belongs to.

Why it happens

The routing error goes back to the system having only an "account → device" binding model and no "content sensitivity × surface audience" matching model. Notification systems assume that displaying equals delivering to the target user; on a shared surface, displaying equals broadcasting to an unenumerable audience — the family member walking past, the visiting friend, the repair technician are all inside the sightline audience.

The secondary damage runs in two directions. The owner notices the leakage and self-censors: their digital life migrates back to personal devices and the shared surface degrades into decoration. Or the owner does not notice, and content keeps leaking — a relative's visit interrupted by the fridge screen showing a spouse's follow-up appointment reminder. Both directions erode something: the first erodes the shared device's value, the second erodes the family's information boundaries — for everyone in the home, "who knows what about me" is no longer a question they take part in deciding.

Studying it

• Smart-home privacy surveys and interviews (described generically): unintended disclosure on shared surfaces ranks among the most frequently reported privacy incidents; users' improvised countermeasures — disabling notifications, separate accounts, taping paper over screens — are themselves evidence of routing failure.
• Boundary-management lens: domestic privacy research often borrows communication privacy management (Petronio) as its analytic frame: owners hold rules about disclosure scope; when technology discloses on someone's behalf, bypassing those rules, the conflict moves into the relationship, not just the data layer.
• Variables: which content categories users route to shared versus personal surfaces (card sorting, diaries), rate of unintended disclosure incidents, incidence of self-censorship behaviour.

Where it stops holding

• "Personal information" is not a fixed category but a relational judgement: the family calendar is meant for the whole family. The failure criterion is non-reciprocal disclosure — the audience is not the set of people the content's owner chose. Blanket category bans (say, all health content) block what family members should see.
• Safety exceptions have their place: medication reminders and fall alerts derive their value precisely from being seen by whoever is present — the design must support explicit promotion ("this one may appear on the shared screen") rather than letting exceptions in through the back door.
• Screenless households face the audio version of the same problem — the speaker reading content aloud. The medium differs; the routing logic is isomorphic: the missing piece is an audience model at the moment of "display", not the medium itself.

Applying it

• Grade the surfaces: every shared surface carries a sensitivity tier, defaulting to "household level" — only information the whole household shares (the family calendar, the door camera, shared to-dos).
• Route by audience, not by account: account-level pushes go to personal devices by default; reaching a shared surface requires an explicit "promote to family-visible" action.
• Provide one-tap suppression (guest mode) when visitors are present: all personal categories collapse, leaving household-level content only; the same tap serves both as the owner's operation and as the account given to the guest.
• How to check: audit one week of what the shared surface actually displayed, asking of each item "did everyone present — including guests — know about and agree to see this?" Every "no" is a routing defect; counting them yields the improvement baseline.

Related

• Same group: Z6.03.2 Voice assistants broadcast private content to the whole room · Z6.03.3 Monitoring inside the home is power-asymmetric
• Nearby: Z6.04 Non-users in the space · Z4.07 Multi-user and permission assignment
• Search terms: shared device privacy · incidental disclosure · notification privacy · communication privacy management