"They told me I was counting people to save energy. Nobody mentioned that I could also tell who arrives late, who leaves early, and who spends nineteen minutes a day near the coffee machine. I noticed on my own."
A Well-Placed AI Agent
Prerequisites
This section assumes you can tell the sensing modalities of this book apart and reason about what each one can and cannot reveal: cameras, microphones, radar, and RF from Chapter 1, and the idea from Chapter 2 that a measurement is a physical proxy for a hidden state. It builds on the leakage-safe and provenance discipline of Chapter 5. No new mathematics is needed here; the harder machinery of biometric identity and location traces is deferred to Section 70.2, and the legal instruments (GDPR, the EU AI Act, FDA) to Section 70.6. This section is about the design principles that must hold before any of those instruments apply.
The Big Picture
A sensing system does not become surveillance because of its hardware; it becomes surveillance because of what it retains, who it is pointed at, and whether the people it observes had any real say. The same \(60\,\text{GHz}\) radar that counts occupants to modulate a heat pump can, with a firmware flag and a longer retention window, reconstruct who was in the room and when. This section gives you three linked design principles that govern that boundary. Surveillance-awareness asks what a system can infer, not just what it was built to infer. Consent asks whether the observed party agreed in a way that was informed, specific, and revocable. Proportionality asks whether the intrusiveness of the sensing is justified by, and minimized against, the stated purpose. Get these right at design time and the later chapters on privacy and regulation become a matter of paperwork; get them wrong and no amount of encryption or compliance text will fix a system that should never have been pointed where it was.
From measurement to surveillance: the same sensor, a different system
It is tempting to sort sensors into "creepy" and "benign" and stop there. That instinct fails immediately, because the property that matters is not the sensor but the system built around it. A thermal array that reports only an occupant count is a comfort control; the identical array logging per-pixel frames at one-second cadence for ninety days is a movement-tracking archive. What separates the two is a set of choices that live in software and policy, not in the datasheet.
Four choices do most of the work. Retention: does a reading exist only long enough to produce an aggregate, or is it stored? Resolution and identifiability: is the output a count, or is it a signature specific enough to re-identify a person across sessions? Linkage: is the stream joined to an identity, a badge swipe, a device MAC, a name? Secondary use: can the data be repurposed for something the observed person never contemplated, such as an attendance metric derived from an occupancy sensor? A system that minimizes on all four is doing measurement. A system that maximizes any of them is doing surveillance, whatever its brochure says. Because these are software choices, they are also where an engineer has leverage, which is the entire point of treating this as an engineering topic rather than a legal footnote.
Key Insight
Design against capability, not just intent. The relevant question at review time is never "what will we use this for?" but "what could this system reveal if a future operator, subpoena, breach, or product manager decided to?" A benign purpose does not neutralize a surveillance-capable pipeline; it merely postpones the misuse until someone with different incentives inherits the data. Contactless vital-sign radar (developed in Chapter 33) and through-wall RF sensing (Chapter 47) are the canonical traps: sold as convenience, they are latent surveillance instruments the moment retention and linkage are switched on. The engineer who removes the capability at the sensor is worth more than the policy that promises never to use it.
Consent that means something
Consent is the mechanism by which an observed person authorizes being sensed, and most deployed "consent" is a fiction. A sign at a building entrance reading "these premises are monitored" is notice, not consent: the person cannot decline without also declining to enter, cannot see what is collected, and cannot withdraw later. Meaningful consent has four properties that a checkbox rarely satisfies. It is informed: the person knows what is sensed, at what resolution, and to what end. It is specific: consent to occupancy counting is not consent to gait-based identification. It is freely given: refusal must be a genuine option, not a condition of employment or entry. And it is revocable: withdrawal must be as easy as granting, and must actually stop the processing.
Sensory AI adds a problem that web consent forms never faced: the bystander. A wearable, a robot, or a smart-home microphone senses people who never opted in and often never knew they were present. A delivery robot with a camera navigating a sidewalk (its perception stack is the subject of Chapter 57) records dozens of non-consenting passers-by per minute. There is no checkbox you can hand a stranger on a sidewalk. The engineering response is to make bystander data unusable by construction: process on-device, blur or discard faces before anything is stored, retain only the geometry needed for navigation. This is where consent stops being a form and becomes an architecture, and it connects directly to the privacy-preserving computation of Chapter 64: the strongest consent story is a pipeline in which the sensitive raw data never leaves the device that captured it.
Proportionality: matching intrusiveness to purpose
Proportionality is the principle that the intrusiveness of a sensing system must be justified by its purpose and reduced to the minimum that still serves it. It has two operational halves. Purpose limitation fixes a specific, declared reason for collection and forbids drift into secondary uses. Data minimization demands that, among the sensing options that achieve the purpose, you pick the least revealing, and that you strip, aggregate, or degrade the signal to the coarsest form the task tolerates.
Made concrete, proportionality is a constrained choice. Suppose a purpose \(P\) can be served by a set of candidate modalities \(M\), each with an intrusiveness score \(r(m)\) and a task-sufficiency indicator \(s(m, P) \in \{0, 1\}\). The proportionate choice is $$m^{\star} = \arg\min_{m \in M} \; r(m) \quad \text{subject to} \quad s(m, P) = 1.$$ You do not reach for the camera because it is the most capable sensor; you reach for the coarsest modality that still clears the sufficiency bar. Counting occupants for HVAC control is served by a CO\(_2\) sensor or a low-resolution thermal tripwire; it does not need, and therefore must not use, a full-frame camera, because the camera's surplus capability is exactly the surveillance risk you are obligated to avoid. This is why the non-camera occupancy methods of Chapter 39 are not merely a cost choice; they are a proportionality choice.
Step-Through: the smart office that chose the coarser sensor
A facilities team wants to cut heating and cooling in a corporate building by matching airflow to occupancy per zone. The vendor's default kit is ceiling cameras with a person-detection model, because computer vision "just works" and reuses the activity-recognition stack of Chapter 26. The privacy review applies the proportionality test. The declared purpose is a per-zone occupancy count updated every few minutes. Three modalities clear that sufficiency bar: cameras, low-resolution \(8\times8\) thermal arrays, and CO\(_2\) plus door-count sensors. Cameras also reveal identity, dwell patterns, and who talks to whom, capability the purpose never asked for. The thermal array reports a blob count and cannot recognize a face at \(64\) pixels. The team ships thermal arrays with on-device counting and a retention window of zero for raw frames, storing only the per-zone integer count. Energy savings land within two percent of what the camera pilot achieved. Six months later, when management asks the facilities team to produce "who was in early last quarter," there is nothing to hand over, because the proportionate design made the surveillance question unanswerable by construction. That refusal-by-architecture is the deliverable, not a side effect.
Engineering proportionality into the pipeline
Proportionality reviews fail when they live in a slide deck that nobody re-runs after the modality list changes. The remedy is to encode the choice as data and evaluate it in code, so that adding a more intrusive sensor to the catalogue forces an explicit, logged justification instead of a silent default. The function below implements the constrained selection above: given a purpose and a catalogue of modalities tagged with an intrusiveness score and the purposes each can satisfy, it returns the least-intrusive sufficient option and flags any proposed modality whose capability exceeds what the purpose requires.
from dataclasses import dataclass
@dataclass(frozen=True)
class Modality:
name: str
intrusiveness: float # 0 (aggregate only) .. 1 (identifiable raw media)
serves: frozenset # purposes this modality can satisfy
def proportionate_choice(purpose, catalogue):
"""Least-intrusive modality that still serves the declared purpose."""
sufficient = [m for m in catalogue if purpose in m.serves]
if not sufficient:
raise ValueError(f"no modality in catalogue serves {purpose!r}")
best = min(sufficient, key=lambda m: m.intrusiveness)
# Flag surplus capability: anything more intrusive than necessary
surplus = [m.name for m in sufficient if m.intrusiveness > best.intrusiveness]
return best, surplus
CATALOGUE = [
Modality("co2_doorcount", 0.10, frozenset({"occupancy_count"})),
Modality("thermal_8x8", 0.25, frozenset({"occupancy_count", "fall_detection"})),
Modality("radar_60ghz", 0.55, frozenset({"occupancy_count", "fall_detection"})),
Modality("ceiling_camera", 0.95, frozenset({"occupancy_count", "fall_detection",
"identity", "dwell_tracking"})),
]
choice, surplus = proportionate_choice("occupancy_count", CATALOGUE)
print("chosen:", choice.name, "| rejected as over-capable:", surplus)
occupancy_count it returns co2_doorcount (intrusiveness \(0.10\)) and lists the camera, radar, and thermal array as over-capable options that must not be used absent a purpose that genuinely requires them. Wiring this into deployment config means a reviewer who wants a camera for a counting task has to change the purpose, on the record, rather than pick it by default.Code 70.1.1 turns proportionality from a one-time meeting into a check that survives contact with reality. When someone later adds fall_detection as a purpose (a legitimate safety need served by thermal or radar but not by the CO\(_2\) sensor), the selector re-derives the least-intrusive sufficient modality automatically, and the surplus list still bars the camera. The point is that the justification is recomputed whenever the purpose or catalogue changes, so the design cannot silently drift toward the most capable sensor.
Right Tool: privacy-preserving transforms you should not hand-roll
The selector picks the coarsest sensor, but you often still capture richer data and must degrade it before storage: blur faces, drop resolution, aggregate to counts, add calibrated noise. Writing that yourself is where subtle re-identification leaks hide. Libraries such as opencv for face detection and redaction, and diffprivlib or opendp for differentially private aggregation, replace roughly a hundred lines of error-prone masking and noise-calibration code with a few well-tested calls, and the differential-privacy libraries give you a formal \(\varepsilon\) budget rather than an ad-hoc "we blurred it and hoped." Let the library own the redaction and the noise mechanism; you own the policy decision of which purpose justifies capturing the raw signal in the first place. The formal guarantees connect forward to the privacy machinery of Section 70.2.
Exercise
A hospital ward wants continuous fall detection in patient rooms. Candidate modalities are a ceiling camera, a \(60\,\text{GHz}\) radar, a pressure mat at the bedside, and a wrist-worn accelerometer. (a) Assign each an intrusiveness score and mark which serve the purpose fall_detection, then run the logic of Code 70.1.1 by hand to find \(m^{\star}\). (b) Patients cannot always give consent, and visitors and clinicians are bystanders in every frame; state one architectural change (not a policy promise) that makes the bystander data unusable. (c) Administration later asks to reuse the same feed to audit how often nurses enter each room. Explain, in terms of purpose limitation, why this request must trigger a fresh proportionality review rather than a config change.
Self-Check
- Two deployments use the identical thermal array. Name the four software-and-policy choices that determine whether each is measurement or surveillance.
- Why is a "these premises are monitored" sign notice rather than consent, and which of the four properties of meaningful consent does it most clearly violate?
- State the proportionality selection rule in one sentence, and explain why "the camera is the most capable sensor" is an argument against using it for an occupancy count, not for it.
What's Next
In Section 70.2, we sharpen the hardest case these principles gesture at: data that identifies a specific body or traces a specific person through space. Location trails and biometric signatures are special because they cannot be anonymized away by coarsening alone, and they carry legal weight that ordinary measurements do not, so they demand privacy machinery, formal budgets, and retention rules of their own.