Investigating Bystander Privacy in Chinese Smart Home Apps

Paper Title

Investigating Bystander Privacy in Chinese Smart Home Apps

Publication Info

• Topic area: Privacy and security in smart home ecosystems, focusing on bystander privacy in non-Western contexts.
• Keywords: Bystander privacy, smart home apps, Chinese privacy laws, UX/UI design, privacy policies, traceability analysis, PIPL compliance, data sharing, IoT privacy, Apple App Store labels.

Background and Problem

• Problem / challenge: Bystander privacy in smart homes is underexplored in non-Western contexts, particularly in China, where cultural and regulatory frameworks differ from Western norms. Current privacy policies and UX/UI designs fail to adequately address privacy concerns for non-primary users such as visitors, neighbors, and domestic workers.
• Significance: The lack of bystander privacy protections in smart home apps poses ethical and regulatory risks, undermines user trust, and limits informed consent, which are critical for inclusive smart home ecosystems.
• Motivation and related work: Prior research has extensively studied bystander privacy in Western contexts and critiqued the opacity of IoT privacy policies. However, studies on Chinese apps have focused on primary users and legal compliance, neglecting the interplay between privacy policies, UX/UI design, and bystander protections.

Solution

• Proposed approach: A mixed-methods analysis of 49 Chinese smart home apps, combining privacy policy review, UX/UI evaluation, and traceability analysis to identify gaps in bystander privacy protections and inconsistencies between documented policies and actual practices.
• Novelty:
  1. Comprehensive traceability analysis mapping privacy policy claims against real-world UX/UI practices.
  2. Identification of critical gaps in bystander privacy, highlighting neglect of visiting and uninvolved bystanders.
  3. Actionable design and regulatory recommendations to enhance bystander-aware privacy protections and improve transparency.
• Procedure and key techniques:
  • Thematic analysis of privacy policies guided by the Personal Information Protection Law (PIPL).
  • Cognitive walkthroughs and heuristic evaluations of app UX/UI designs, focusing on privacy-by-design principles.
  • Traceability analysis comparing privacy policy provisions with implemented UX/UI features and Apple App Store privacy labels.

Results

• Concrete findings:
  • Privacy policies averaged 15,623 characters, requiring 52–70 minutes to read, and were overly legalistic and inaccessible.
  • 19/49 apps addressed live-in bystander privacy but lacked explicit consent or deletion mechanisms for visiting and uninvolved bystanders.
  • None of the apps provided direct controls for bystanders to manage their data.
  • Widespread discrepancies between Apple App Store privacy labels and actual data practices, including underreporting of tracking and data collection.
• Advantage over baselines: The study uniquely integrates privacy policy analysis, UX/UI evaluation, and traceability analysis to uncover systemic gaps in bystander privacy protections in Chinese smart home apps.
• Experiments / evaluation:
  • Privacy policy analysis of 49 apps using thematic coding.
  • UX/UI evaluation via cognitive walkthroughs and heuristic assessments.
  • Traceability analysis across four dimensions: data collection, sharing, control, and security measures.
• Limitations and future work:
  • Focused only on iOS apps in Mainland China; future studies could include Android apps and cross-platform comparisons.
  • Did not verify backend data handling or assess the accuracy of policy disclosures beyond observable features.
  • Findings represent a snapshot in time; longitudinal studies are needed to track regulatory and technological changes.

Summary

This study analyzed 49 Chinese smart home apps to investigate bystander privacy protections, revealing significant gaps in privacy policies, UX/UI designs, and traceability between stated policies and actual practices. While apps generally complied with PIPL and CSL for primary users, bystander privacy was systematically neglected, with no explicit controls for visiting or uninvolved individuals. Discrepancies between Apple App Store privacy labels and actual practices further undermined transparency and user trust. The paper offers actionable recommendations to improve bystander privacy, including onboarding transparency, dedicated privacy controls, consent-oriented guest modes, and bystander-initiated data deletion mechanisms. These findings contribute to the development of inclusive smart home ecosystems that prioritize privacy for all affected individuals.