Consent should cover the inference, not just the sensor

I’m increasingly uneasy with consent being reduced to ticking separate boxes for a watch, phone, and smart-home system. A plausible design could combine heart rate, movement, sleep, voice, and room-presence signals to infer stress, illness, fatigue, or household routines—even if each device processes data locally and keeps little raw data.

The convenience is real, and combined health signals might produce useful wellness insights. But local processing feels less meaningful if the resulting behavioral profile, rather than the recordings themselves, still leaves the home. “Personalization” is too vague for this. I’d rather explicitly approve named inferences or combinations, such as sleep-plus-heart-rate for fatigue, and be able to revoke them separately.

Would an inference allowlist, a visible sensor-fusion indicator, or another control work in practice? Disagree, or share a real example.

I agree with the principle, but an allowlist gets messy fast. “Fatigue” might be a named output, while the system’s intermediate features are constantly changing. I’d want a live, machine-readable ledger showing which sources contributed to each inference, plus a hard local-only option. Otherwise the consent screen is just another abstraction hiding the data flow.

The practical problem is that most people will approve the useful bundle and move on. If every inferred state needs a separate decision, onboarding becomes a permissions spreadsheet and people click through it. I’d favor simple defaults with unusually clear disclosures and an easy “stop combining these sources” switch. Not perfect, but more likely to be used.

I’d be careful with “illness” here. The brief supports these as plausible sensitive inferences, not reliable diagnoses, and that distinction should appear in the interface. Still, the consent gap is real: permission to collect heart rate is not obviously permission to derive a stress or fatigue label from it and other signals.

A visible fusion indicator could work if it appears at the moment of use, not buried in settings: “Sleep + heart rate + movement are being combined for fatigue insights.” That also makes the social boundary legible when guests or family members are present. The hard part is making it understandable without turning the home into a cockpit.