Sensor Dimmer
Provide simple controls to modulate sensing intensity
The Problem
Sensing systems such as cameras and microphones tend to oversense by default in order to reliably detect events.
In practice:
- Continuous sensing is required for many features (e.g., detection, alerts)
- Systems often expose full-resolution data (video/audio) even when unnecessary
- Users lack meaningful ways to reduce sensitivity without fully disabling the device
As a result, users face a binary choice:
- Leave sensing fully on (maximizing utility but increasing privacy risk)
- Turn sensing off entirely (sacrificing functionality)
Why This Problem Matters
Binary controls create poor tradeoffs between:
- Utility and privacy
- Awareness and exposure
- Owner control and adjacent user trust
In multi-user environments, oversensing amplifies:
- Perceived surveillance
- Social discomfort
- Power asymmetries between owners and others
The Pattern
Introduce a graduated spectrum of sensing states between True On and True Off that attenuate:
- Data exposure (what is visible or accessible)
- Data processing (what is computed or inferred)
- Data retention (what is stored)
These intermediate states allow systems to preserve useful functionality (e.g., event detection) while reducing the sensitivity and invasiveness of sensing.
Core Principles / Insights
Bounded spectrum
Intermediate states are only meaningful when anchored by clear True On and True Off endpoints
Attenuation over disablement
Reducing sensitivity is often more useful than turning sensing off
Layered reduction
Sensing can be attenuated at multiple levels (capture, processing, storage, display)
Legibility through simplicity
A small number of well-defined states is more understandable than many granular options
Design Guidelines
- Define a small, discrete set of meaningful attenuation states
- Clearly differentiate between exposure, processing, and storage reductions
- Ensure stronger privacy states impose irreversible constraints (e.g., no recoverable raw data)
- Anchor all intermediate states between True On and True Off
- Offer overly granular or opaque controls that are difficult to understand
- Conflate “hidden” data with “non-existent” data
- Allow users to reconstruct high-sensitivity data from low-sensitivity states
- Each state has a clear, explainable behavioral contract
- Users understand what is and is not possible in each state
- Transitions between states are visible and predictable
Variations / Extensions
- Sensor-specific dimmers (camera vs. microphone vs. location)
- Context-aware attenuation (e.g., based on time, presence, or activity)
- User-specific attenuation (different levels for different audiences)
- Event-triggered escalation (temporary increase in sensitivity)
When to Use
- Devices with continuous or high-fidelity sensing
- Systems where full disablement is too limiting
- Multi-user environments requiring nuanced privacy control
- Systems with only binary sensing capabilities
- Contexts where intermediate states cannot be meaningfully enforced