Interdependent Privacy in Smart Homes: Hunting for Bystanders in Privacy Policies

TL;DR

This paper analyzes privacy policies of smart home devices, focusing on bystander privacy, revealing that vendors often shift responsibility to owners and highlighting the need for improved transparency and system design to protect non-users.

Contribution

It provides a detailed analysis of 20 smart home device policies regarding bystander privacy and offers practical recommendations for policy and system improvements.

Findings

Vendors acknowledge bystanders but mainly include disclaimers.

Current policies shift responsibility to device owners.

Real-world cases show impact on non-users.

Abstract

Smart home devices such as video doorbells and security cameras are becoming increasingly common in everyday life. While these devices offer convenience and safety, they also raise new privacy concerns: how these devices affect others, like neighbors, visitors, or people passing by. This issue is generally known as interdependent privacy, where one person's actions (or inaction) may impact the privacy of others, and, specifically, bystander privacy in the context of smart homes. Given lax data protection regulations in terms of shared physical spaces and amateur joint data controllers, we expect that the privacy policies of smart home products reflect the missing regulatory incentives. This paper presents a focused privacy policy analysis of 20 video doorbell and smart camera products, concentrating explicitly on the bystander aspect. We show that although some of the vendors acknowledge bystanders, they address it only to the extent of including disclaimers, shifting the ethical responsibility for collecting the data of non-users to the device owner. In addition, we identify and examine real-world cases related to bystander privacy, demonstrating how current deployments can impact non-users. Based on our findings, we analyze vendor privacy policies in light of existing legal frameworks and technical capabilities, and we provide practical recommendations for both policy language and system design to enhance transparency and empower both bystanders and device owners.