Guests enter the sensing field without ever consenting

What it is

Smart homes sense the space, not "the user": whoever walks in — guests, relatives, repair technicians, the courier at the door — enters the sensing field, never having consented and often without knowing. The structural mismatch: the unit of consent is the account holder (the owner); the unit of exposure is every person in the space. A guest is a data subject with no account relationship, yet keeps producing data — their face enters camera footage, their voice enters recordings, their phone triggers presence logs. The umbrella term is bystander privacy.

Why it happens

Consent frameworks assume an account relationship between the data subject and the service, through which terms can be presented and authorisation obtained. Ambient sensing removes that premise — one configuration the owner makes over the space covers everyone else who is merely present.

Each individual exposure is small (a stretch of footage, a few presence records), but exposure accumulates on the guest's side: visiting this home this week, that home next, a little sensing from every household assembles into a behavioural trail of a person who chose none of it.

The guest also lacks exit options: the way to refuse being sensed is to decline the visit — a social cost too high to count as a choice. "The owner consented" therefore cannot cover the guest: the consenting party and the affected party are different people. This is a failure of consent by proxy, not an incomplete process — no amount of more prominent notice closes the structural gap.

Studying it

• Bystander privacy research (described generically): surveys of smart-home guests show they consistently underestimate the extent of their capture — unaware of camera coverage, unaware that microphones are always on; most have never asked a host to switch anything off, and the social cost of asking is repeatedly cited.
• Interdependent privacy research (described generically): one person's privacy exposure is decided by someone else's device choices — a partner buys the speaker, a housemate installs the camera, a friend wears camera glasses; researchers treat such "exposure of non-users" as a systemic property of sensing ecosystems.
• Variables: guests' awareness rates and over-/under-estimation bias, proportion who ever requested changes and the social cost experienced, the inventory of data types generated by a single ordinary visit.

Where it stops holding

• Severity scales with what is collected and how long it is kept: presence-triggered lighting is near-zero exposure; identity-resolvable video with cloud archival is the other end. Conflating "there are sensors here" with "I am being surveilled" unfocuses the discussion — the inventory must be graded by data type.
• Guests' standing varies with frequency and depth: a one-off visit, the weekly tutor, the overnight houseguest differ in both exposure and the legitimacy of their claims — a one-off guest's reasonable expectation is "no identifiable record of me"; a long-stay guest approaches member standing.
• The owner's home is also the owner's private domain: guests' claims are real but bounded — a security camera at the entrance is legitimate; the asymmetry concerns ambient interior sensing of social life itself (an always-recording living room, retained conversation audio), not security.

Applying it

• Model non-users as a stakeholder class of their own: the data inventory distinguishes "owner data" from "data of people present", with control entry points and remedies designed separately for each, instead of hanging both under the account system.
• Provide account-free data-subject channels: guests' faces can be auto-blurred, guest segments purged on expiry; deletion requests require no account registration — a description or a one-time passphrase suffices to initiate one.
• How to check: run a mock-visit audit — list every data type a person who never installed the app generates during one ordinary visit; for each item, check: does the owner have a control to turn this off? does the guest have a remedy path? Items with neither are the structural mismatch itself.

Related

• Same group: Z6.04.2 Sensing needs visible notice · Z6.04.3 Children and visitors need minimal collection by default
• Nearby: Z6.06 Awareness of passive collection · Z2.05 Privacy visibility of sensing
• Search terms: bystander privacy · interdependent privacy · secondary users · incidental data subjects