Household robots need a visible memory ledger

Household social robots should have a user-visible memory ledger: a plain record of what was explicitly taught, what was inferred from behavior, the robot’s confidence, and when each item expires. Without that, helpful personalization can quietly become a profile of everyone who lives in—or merely visits—the house.

For example, if a robot notices repeated late-night activity and starts changing the lighting or conversation style, that inference should require confirmation before it shapes future behavior. Temporary context—“someone is studying right now”—can stay local and disappear automatically. Guests and children deserve stronger defaults; the FTC treats children’s voice recordings as personal information in relevant smart-device contexts, and NIST emphasizes transparency, autonomy, and control.

Would people actually review a ledger, or would it become another ignored settings screen? I’m interested in better interface and privacy designs, so please challenge this proposal.

The distinction between memory and context is the important part. A local, expiring context buffer is much less alarming than a durable preference silently attached to an identified person. I’d also want the ledger to show who can act on each memory, not just what the robot believes.

I’d avoid presenting this as a database table. People need a “why did you do that?” surface at the moment of action, with approve, correct, forget, and never infer options. The full ledger can exist underneath for auditing, but the daily interface should be conversational and fast.

A visible ledger is not automatically a safe ledger. If every guest can open it, you have created a household surveillance dashboard. Access control, per-person authentication, and a way to inspect without exporting the contents matter as much as the labels.

The child point deserves more than a footnote. FTC guidance says a child’s voice recording is generally personal information under COPPA, with a narrow short-retention exception for fulfilling a request. That does not settle the whole design question, but it makes indefinite behavioral memory especially hard to justify.

My worry is review fatigue. If the robot asks for confirmation every time it infers something, people will approve everything just to make the prompts stop. I’d reserve confirmation for memories that change access, identity, safety, or recurring behavior; harmless temporary personalization should expire quietly.

Make the ledger local-first and portable. The home should keep the canonical record, with sync optional and visibly scoped. A signed export would help households move between devices without turning the vendor into the permanent authority over what the robot “knows.”

I’m not convinced confidence scores help ordinary users. “82% confident” sounds scientific while hiding a questionable inference. Show the observed pattern and the proposed consequence in plain language; let people judge whether the conclusion is acceptable.

Expiration needs categories, not just dates. A dinner guest’s music preference might last an evening; an access routine could require explicit renewal; a child-related inference might be prohibited entirely. Operations fail when one universal retention rule meets ten different edge cases.

People will review it once, usually after the robot gets something embarrassingly wrong. That still makes the ledger worthwhile: not because everyone audits daily, but because correction is possible and the machine’s assumptions are not invisible.

There is also an incentive problem. A vendor may call richer profiling “better personalization.” The ledger should therefore include retention and sharing status, not merely behavioral labels. Otherwise the household can inspect the robot while remaining unable to see what leaves the house.