Interdependent Privacy in Smart Homes: Hunting for Bystanders in Privacy Policies
Shuaishuai Liu, Gergely Acs, Gergely Biczók
TL;DR
The paper addresses interdependent privacy in smart homes by analyzing how vendor privacy policies address bystander privacy. It uses a threat-model-based framework to map policy content to real-world data flows and case law, revealing that many policies focus on the data subject (the device owner) and rely on disclaimers rather than concrete protections for bystanders. Through a policy-analysis of 20 leading smart doorbell/camera brands, it shows substantial variability in acknowledging bystander data and notes the prevalence of owner-shifting language with limited practical safeguards. The study proposes policy and system-design recommendations—such as explicit accountability, visible notices, and proactive bystander-protection features—to enhance transparency and empower bystanders and owners alike, while outlining limitations and avenues for future research.
Abstract
Smart home devices such as video doorbells and security cameras are becoming increasingly common in everyday life. While these devices offer convenience and safety, they also raise new privacy concerns: how these devices affect others, like neighbors, visitors, or people passing by. This issue is generally known as interdependent privacy, where one person's actions (or inaction) may impact the privacy of others, and, specifically, bystander privacy in the context of smart homes. Given lax data protection regulations in terms of shared physical spaces and amateur joint data controllers, we expect that the privacy policies of smart home products reflect the missing regulatory incentives. This paper presents a focused privacy policy analysis of 20 video doorbell and smart camera products, concentrating explicitly on the bystander aspect. We show that although some of the vendors acknowledge bystanders, they address it only to the extent of including disclaimers, shifting the ethical responsibility for collecting the data of non-users to the device owner. In addition, we identify and examine real-world cases related to bystander privacy, demonstrating how current deployments can impact non-users. Based on our findings, we analyze vendor privacy policies in light of existing legal frameworks and technical capabilities, and we provide practical recommendations for both policy language and system design to enhance transparency and empower both bystanders and device owners.