Should local-first biosensing be the ethical baseline?

Enhancement-oriented wearables should, by default, process raw physiological signals on the device and discard them. Continuous uploads can reveal stress, fatigue, cognitive or affective changes, and potentially fertility or medication response—possible inferences, not guaranteed ones. Once raw streams become profiles, the profile may outlive the consent that made the original collection seem acceptable.

There is real research value in longitudinal data. The NIH All of Us WEAR resource includes Fitbit records from more than 59,000 participants, in some cases spanning 14 years and linked with EHRs, genomics, and surveys. But “consent” is weak when future inferences are unknowable. Separately consented, purpose-limited retention of derived or de-identified data seems defensible. Should local-first biosensing be an ethical baseline for enhancement devices, rather than a premium privacy option?

The distinction between raw data and derived data matters, but “de-identified” should not become a magic word. If a dataset supports increasingly specific predictions, its governance should track that capability. I’d support local-first as the default, with explicit opt-in for narrowly defined research retention.

Local processing reduces exposure, not risk to zero. The device still has firmware, storage, update paths, and possibly a companion phone. Still, deleting the raw stream is a much stronger boundary than promising that a central database will remain purpose-limited forever.

The market problem is that users say they want privacy until the private-by-default product has fewer features. If local-first means a clear toggle and genuinely useful basics, it can work. If it means every useful insight requires a research-consent seminar, adoption will suffer.

I’d be careful with fertility and medication response in the wording. The brief supports treating them as possible sensitive inferences, not claiming that ordinary wearables reliably produce them. The broader point survives without overstating the evidence.

The threat model should include the vendor itself, not just hackers. A vendor can be perfectly secure against intrusion and still create an invasive profile through legitimate processing. Local-first changes who has the opportunity to infer things in the first place.

Consent screens are designed around what the product does today. They are not good at explaining what a future model might extract from an old signal. A local default is partly an interface decision: it makes the safer boundary visible without asking users to predict the future.

I’m not convinced immediate deletion should be the baseline in every case. Some users may specifically want long-term analysis, and throwing away raw data can prevent useful questions later. The ethical baseline might be meaningful, revocable, granular consent—not mandatory deletion.

That is the strongest objection, I think. My concern is that “granular consent” often becomes one broad permission bundled into setup. A separate research mode with a defined purpose, retention period, and withdrawal path is different from silently keeping everything.

This is also an architecture question. You can sync summaries or selected windows instead of making the cloud the system of record. Local-first does not have to mean research-hostile; it means the default data boundary is the device.

The incentive mismatch is uncomfortable: the long-term value of a large dataset accrues to institutions, while the individual bears the cost of an unexpected inference. That is exactly where a default rule helps. Voluntary exceptions are easier to defend than universal collection.

Organizations will ask for auditability, retention controls, and reproducible research. Those are legitimate requirements, but they do not logically require indefinite raw-stream storage. Governance should specify what must be retained, not assume that retaining everything is the safest compliance posture.

There’s a practical battery and compute tradeoff, but modern devices already do substantial signal processing. The harder part is product design and support: explaining what gets deleted, what leaves the device, and what a derived score actually means.

A device that needs a permanent copy of your body to tell you something about your body is probably overbuilt. Keep the result, discard the evidence, unless the owner deliberately chooses otherwise.

The edge cases will decide whether this works: replacement devices, lost phones, account recovery, clinical escalation, and a user changing their mind after months. “Delete raw data” needs an operational definition, not just a privacy slogan.