Ethics, consent and the people who never enrolled

A deployment is written up as a study of its participants. It is not. A microphone in a kitchen, a camera over a shared entrance and an access point logging every device in a block record more people than the study recruited. None of those people enrolled, and none can withdraw. Their data are a property of the instrument.

The claim here has two halves. A deployment is an intervention in a setting rather than an experiment on volunteers. Its ethics therefore turn on people who cannot consent, and design time settles them rather than a signature. This ninth of ten units takes the setting the eighth described and asks who is inside it without having agreed to be.

Value sensitive design names the stakeholder who never agreed

Friedman, Kahn, Borning and Huldtgren (2013) supply the vocabulary. Value sensitive design accounts for human values through conceptual, empirical and technical investigations, and opens with the question of who the direct and indirect stakeholders are. A direct stakeholder uses the system. An indirect stakeholder is affected without being a user. A home setting produces them by the household: partners, children, visitors, and a relative who manages the device.

Rogers and Marshall (2017) put the same problem in practice. Their book's fifth chapter covers consent, risk and the responsibilities a deployment creates, treating ethics as a design problem settled alongside the device and the recruitment plan.

The instrument records people the study never enrolled

Shilton (2009), writing in Communications of the ACM on whether four billion little brothers are watching, argues that participatory sensing puts recording devices in the hands of individuals rather than organisations, so the fair information practice codes written for corporations no longer suffice. She defines privacy as the ability to understand, choose, and control what you share, with whom and for how long; a form supplies only the first.

Metcalf and Crawford (2016) attack the regulatory version. The distinction between research and practice, a core commitment of research ethics regulation, cannot be cleanly exported from biomedical research to data science. Whether the people in a deployment's data are human subjects is settled by convention, not by rule.

Choe and colleagues (2011) report what householders say. Their anonymous survey of 475 respondents collected 1,433 descriptions of activities people do at home that they would not want recorded. Those refusals are ordinary, frequent and spread through the home, so no room or time window is safe by default. Abstraction does not help, because the objection is to the recording.

Zou and colleagues (2023) built IoTBeholder, which runs on commercial off-the-shelf phones. They showed that smart home Wi-Fi traffic alone supports device localisation, classification and activity identification, recovering habitual behaviour on a testbed of 23 IoT devices. Adding devices adds a channel describing everyone living there. A systematic review of the bystander literature finds the same asymmetry: guests, short-term tenants and domestic workers have little chance to accept or refuse collection, may feel the only option is to opt in, and are often not told the device is there (Saqib et al., 2025).

A signature is not informed consent

Luger and Rodden (2013) reframe consent for ubiquitous computing. Systems embedded below the line of human attention cast every trace of life as potential data, so consent needs revisiting and agency rebalancing towards the user, and they offer three principles to balance against functionality. That is the repair position.

The documents carrying consent do not survive measurement. Luger, Moran and Rodden (2013) measured United Kingdom energy supplier terms and conditions with the SMOG readability formula. They found them beyond what a functionally literate adult could be expected to understand. A procedure resting on a document nobody can read is not informed consent.

Caine and Hanania (2013) show what a usable version has to express. From a card task, a questionnaire and interviews with 30 patients whose health information was held in an electronic medical record, no patient wanted to share all stored information with every recipient: preferences varied by data element and by recipient. One signature collapses that grid to a single cell.

Anonymity is a promise the data cannot always keep

Sweeney (2002) states the standard vocabulary for de-identification.

A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release (Sweeney, 2002).

Narayanan and Shmatikov (2008) show how little that condition buys. Their attack on the Netflix Prize dataset of anonymous movie ratings from roughly half a million subscribers identifies a record from a small amount of background knowledge. It needs as few as two to eight ratings per user, and the paper notes that k-anonymisation fails on high-dimensional data. Removed names are a promise about one dataset.

The rules that govern the data are not the ethics of the study

Vitak, Shilton and Ashktorab (2016) surveyed 263 researchers who work with online data. They found continuing disagreement that did not track disciplinary, methodological or workplace affiliation. The Association of Internet Researchers guidance replaces the rule with a procedure. Its third version holds that the obligation grows with the vulnerability of the participant, defines harm contextually so that judgement is inductive, and extends the earlier recommendations to big data and machine learning (Franzke et al., 2020).

Fiesler, Beard and Keegan give the regulatory gap a measured instance. They read the terms of service of more than a hundred social media sites and found prohibitions on data collection common but ambiguous, inconsistent and lacking context (Fiesler et al., 2020). A rule that forbids scraping here and permits it there, with no reason given, cannot tell a researcher what is ethical. What the case does not show is what to do instead: looking past the terms to the context of the source is a judgement, not a rule.

Contested question: can consent be repaired, and does de-identification protect anyone?

Luger and Rodden (2013) hold that consent is worth reframing, and that principles balanced against functionality can support it. Caine and Hanania (2013) show that people hold granular preferences worth eliciting, since none of their 30 patients wanted to share everything with everyone. On this account the failure is implementation, and the repair is consent indexed by recipient and by data element.

Franzke and colleagues (2020) and Shilton (2009) take the other position. Their argument turns not on readability but on where the decision sits: harm is contextual, so judgement cannot be delegated to a one-off document, and protection has to be built into the collection process. The card task of Caine and Hanania (2013) elicits the preferences; the paired interviews of Wang and colleagues (2026) show preferences bypassed by structural factors a clearer form would not touch. The party who pays for the device holds a power the form cannot redistribute.

A second dispute, over de-identification, is one-sided: Sweeney (2002) states a formal condition that Narayanan and Shmatikov (2008) beat. Within the first dispute the repair position rests on a reframing and an elicited-preference study with 30 patients (Luger and Rodden, 2013; Caine and Hanania, 2013), and the replace position on a contextual ethics framework and a survey of 263 researchers (Franzke et al., 2020; Vitak et al., 2016). What would settle the first is an experiment that varies the consent procedure and tests what participants can state about what is recorded. While the dispute is open, treat consent as a process and test the release against an adversary. The strongest objection is that granular consent cannot bind the people who never enrolled.

Where the area is heading

Wang, Tan and Munson (2026) derive three design criteria for multi-sided negotiation in care settings. Metcalf and Crawford (2016) put the regulatory question on the table, and Franzke and colleagues (2020) offer a chart for the cases the rules do not reach. Zou and colleagues (2023) are the counterweight: while a deployed environment leaks through its own traffic, ethics settled at design time must include an adversary's view of it. The questions to settle are who the indirect stakeholders are and what the system shows each of them (Friedman et al., 2013); which activities householders would refuse to have recorded (Choe et al., 2011); what the added channel reveals and to whom (Zou et al., 2023); who can change what is sensed for somebody else (Wang, Tan and Munson, 2026); and what is promised about the data afterwards (Narayanan and Shmatikov, 2008). A final question is who judges when the answers conflict (Franzke et al., 2020).

The sources this unit rests on

Each note states what the cited document did and found. Titles are in British spelling, and identifiers were checked against registered metadata on 2 November 2026.

• Rogers, Y. and Marshall, P. (2017). Research in the wild. doi:10.1007/978-3-031-02220-3 A short book whose fifth chapter is Practical and Ethical Issues. It covers consent, risk and the responsibilities a deployment creates, placing ethics in design and logistics.
• Friedman, B., Kahn, P. H., Borning, A. and Huldtgren, A. (2013). Value sensitive design and information systems. doi:10.1007/978-94-007-7844-3_4 Sets out value sensitive design, whose methodology is conceptual, empirical and technical and which asks first who the direct and indirect stakeholders are, the distinction this unit uses for people measured without being recruited.
• Franzke, A. S., Bechmann, A., Zimmer, M. and Ess, C. (2020). Internet research: ethical guidelines 3.0. https://aoir.org/reports/ethics3.pdf The third version of the Association of Internet Researchers recommendations, building on the 2002 and 2012 editions and extending them to big data and machine learning. It holds that the obligation grows with the vulnerability of the participant and defines harm contextually.
• Shilton, K. (2009). Four billion little brothers? Privacy, mobile phones, and ubiquitous data collection. doi:10.1145/1592761.1592778 A Communications of the ACM viewpoint on participatory sensing, in which individuals deploy the recording devices. It argues that the fair information practice codes are no longer enough for distributed data collectors, and defines privacy as the ability to understand, choose, and control what you share.
• Metcalf, J. and Crawford, K. (2016). Where are human subjects in big data research? The emerging ethics divide. doi:10.1177/2053951716650211 Argues that the core commitments of research ethics regulation cannot be cleanly exported from biomedical research to data science. It finds that the gap has led some practitioners to reject regulation outright.
• Choe, E. K., Consolvo, S., Jung, J., Harrison, B. and Kientz, J. A. (2011). Living in a glass house: a survey of private moments in the home. doi:10.1145/2030112.2030118 An anonymous survey of 475 householders that collected 1,433 descriptions of activities they would not want recorded at home. The refused activities are ordinary, frequent and spread through the home, making the recording the thing objected to.
• Zou, Q., Li, Q., Li, R., Huang, Y., Tyson, G., Xiao, J. and Jiang, Y. (2023). IoTBeholder: a privacy snooping attack on user habitual behaviours from smart home wi-fi traffic. doi:10.1145/3580890 Builds an end-to-end attack that infers habitual behaviour from smart home Wi-Fi traffic alone. On a testbed of 23 IoT devices it localises and classifies devices and recovers automation rules.
• Saqib, E., He, S., Choy, J., Abu-Salma, R., Such, J., Bernd, J. and Javed, M. (2025). Bystander privacy in smart homes: a systematic review of concerns and solutions. doi:10.1145/3731755 Reviews the smart home bystander literature, defining bystanders to include guests, short-term tenants and domestic workers. It maps the concerns and the proposed solutions and finds consent the leading unresolved one.
• Wang, S., Tan, N. H. and Munson, S. A. (2026). Negotiating autonomy, control, and privacy in always-on home IoT technology-mediated care relationships with older adults. doi:10.1145/3831972 Interviews 22 participants, older adults aged 65 and over and their support networks, in always-on home IoT for care. It finds that they differentiate what they share by recipient, modality and retained control, and that their preferences are bypassed through power asymmetries in device acquisition.
• Luger, E. and Rodden, T. (2013). An informed view on consent for UbiComp. doi:10.1145/2493432.2493446 Reframes consent for ubiquitous computing, for systems embedded below the line of human attention that treat every trace of life as potential data. It offers three principles for designers to balance against functionality, and so states the repair position.
• Luger, E., Moran, S. and Rodden, T. (2013). Consent for all: revealing the hidden complexity of terms and conditions. doi:10.1145/2470654.2481371 Measures United Kingdom energy supplier terms and conditions with the SMOG readability formula and finds them beyond what a functionally literate adult could be expected to understand. It argues that accessible pages encourage consent while the terms defeat comprehension.
• Caine, K. and Hanania, R. (2013). Patients want granular privacy control over health information in electronic medical records. doi:10.1136/amiajnl-2012-001023 Uses a card task, a questionnaire and interviews with 30 patients whose health information was held in an electronic medical record. No patient preferred to share all stored information with every recipient, and preferences varied by data element and recipient.
• Sweeney, L. (2002). k-anonymity: a model for protecting privacy. doi:10.1142/S0218488502001648 Defines k-anonymity as a formal protection model for a holder releasing personal data, so that no person in the release can be distinguished from at least k-1 others. It also examines re-identification attacks that succeed on releases meeting the condition unless accompanying policies are respected.
• Narayanan, A. and Shmatikov, V. (2008). Robust de-anonymisation of large sparse datasets. doi:10.1109/SP.2008.33 Applies a class of de-anonymisation attacks to the Netflix Prize dataset of anonymous movie ratings from roughly half a million subscribers. An adversary with as few as two to eight ratings per user identifies a subscriber's record even with imprecise dates and wrong ratings; the paper also notes that k-anonymisation fails on high-dimensional data.
• Vitak, J., Shilton, K. and Ashktorab, Z. (2016). Beyond the Belmont principles: ethical challenges, practices, and beliefs in the online data research community. doi:10.1145/2818048.2820078 Surveys 263 researchers who work with online data about the ethical challenges they meet. It documents convergence and continuing disagreement, finds it uncorrelated with disciplinary or workplace affiliation, and closes with emergent best practices.
• Fiesler, C., Beard, N. and Keegan, B. C. (2020). No robots, spiders, or scrapers: legal and ethical regulation of data collection methods in social media terms of service. doi:10.1609/icwsm.v14i1.7290 Analyses terms of service from over one hundred social media sites. Prohibitions on collection were common but ambiguous, inconsistent and lacking context, so the authors argue that ethics must extend beyond the terms to the context of the source.