The Pip as Argument

There is a standard way to talk about consent in the context of ambient intelligence, and it is almost entirely wrong. The standard way involves interfaces. Permissions dialogues. Terms and conditions. Privacy dashboards. Opt-in flows.

The user is presented with information about what the system will do, given the choice to accept or decline, and their decision is recorded.

This is the consent framework that the technology industry and its regulators have constructed over the past two decades. It is legible, auditable, defensible in court.

And for ambient intelligence, it is fundamentally unsuited to the problem it is supposed to solve.

The Pip is our attempt to think through what consent could mean instead.

Not as a UI problem. As a spatial one.

The Problem with the Permissions Model

The permissions model of consent was designed for a specific kind of technology relationship: the user visiting a service. You navigate to a website, open an application, initiate a transaction. The consent event makes sense at that moment because there is a clear beginning to the interaction. You are entering a space.

The system asks: on what terms?

Ambient intelligence does not have a visit structure. You do not visit your home's sensing layer. You inhabit it. The intelligence is there when you wake up, when you eat, when you argue, when you are alone.

The beginning of the interaction is not a login event. It is moving in. And the appropriate moment for a permissions dialogue is not morning coffee on a Tuesday. It is the decision to introduce ambient intelligence into the space in the first place, and then continuously, implicitly, every moment that you remain in the space and the system remains active.

Helen Nissenbaum, whose work on contextual integrity has been formative for thinking about privacy in ambient contexts, makes the key distinction. Her framework, developed across Privacy in Context (Stanford, 2010) and A Contextual Approach to Privacy Online (Daedalus, 2011), argues that privacy is not fundamentally about secrecy or control over information. It is about appropriate information flow. Information flows appropriately when they match the norms of the context in which they originate.

A doctor sharing medical information with another treating physician is appropriate. The same information flowing to an employer is not. The information is identical. The context determines appropriateness.

Applied to ambient intelligence, Nissenbaum's framework suggests that the question is not whether the system has permission to sense and respond. It is whether its sensing and responding matches the contextual norms of the space. A home has norms. A bedroom has different norms from a living room. A private moment has different norms from a shared gathering. The permissions model treats all sensing events as equivalent.

The contextual integrity model requires the system to understand and respect the normative texture of the space. That is a fundamentally different brief.

Consent Through Placement

Ann Cavoukian's Privacy by Design principles, developed at the Information and Privacy Commissioner of Ontario and published in 2009, include a principle that remains underused in product development: privacy as the default. The system should default to protecting privacy, not to collecting data.

The user should not have to act to protect themselves. Protection should be the baseline from which the system operates.

This principle was written for data systems. It applies with more force to ambient ones. In a data system, the privacy risk is information misuse after collection. In an ambient system, the privacy risk is the continuous presence of a sensing system in intimate space. The default should not be: the system is on, please manage it if you want less.

The default should be: the system is calibrated to the minimum sensing required for function, and extensions of that sensing require affirmative choice.

The Pip operationalises a version of this principle through spatial gesture rather than interface action. Placing The Pip in a space signals consent to ambient sensing in that space. Moving it signals the withdrawal of that consent. The device's location is the consent record. There is no permissions dialogue. No privacy dashboard. No terms and conditions event. The spatial decision is the consent. This is consent through placement. It has several properties the permissions model lacks.

It is continuous rather than punctual. Consent is not an event that happened at setup and is now recorded. It is the ongoing spatial fact of The Pip's presence. The moment it is moved, consent is withdrawn. No dashboard required. It is embodied rather than declarative. You do not agree to terms. You make a spatial decision.

The relationship between the gesture and its meaning is direct and physical. It is legible to all inhabitants of the space, not only to whoever completed the setup flow. The Pip is visible. Its presence is apparent to everyone in the space. The consent it signals is shared and observable rather than individual and hidden in an account settings page.

The Spatial Politics of Ambient Consent

Shared spaces create consent problems that individual permissions models cannot address. Consider a flat shared between two people. One wants ambient intelligence throughout the space. One has reservations about the bedroom.

The permissions model handles this badly. Whose account controls the system? What happens when preferences conflict? How is the negotiation recorded and enforced?

The spatial model handles this differently. The Pip is placed in the living room. Not in the bedroom. The spatial decision is the negotiation. No account arbitration. No settings conflict. The device is or is not in a space. The sensing it enables is or is not active in that space. The conversation between flatmates is about where an object lives, not about account permissions.

This is a conversation people already know how to have. We negotiate the placement of objects in shared spaces constantly. It is ordinary social practice. Extending that practice to ambient consent is not the addition of a new social technology. It is the application of an existing one to a new kind of object.

Simon Penny's Making Sense (MIT Press, 2017) is useful here. Penny's argument is that embodied, spatial, gestural interaction is more natural and more durable than interface-mediated interaction precisely because it draws on evolved human competencies rather than learned digital ones. We are better at spatial reasoning than interface reasoning. Better at reading physical presence than navigating settings menus.

A consent model that operates through spatial gesture is drawing on a deeper and more universal competency than one that operates through UI. This has equity implications beyond the flatmate scenario. The permissions model requires digital literacy, language proficiency, attention, and access to account management. The spatial model requires only the ability to place and move an object. It is accessible in a way that the permissions model structurally is not.

The Pip as Speculative Methodology

The Pip is not a product in development. It is a speculative object: a designed artefact that makes an argument visible and holdable. This is what speculative design does. Not predict the future. Make specific ideas about the future tangible enough to examine, critique, and refine.

The argument The Pip makes is: spatial consent is more appropriate to ambient intelligence than permissions-based consent. The object makes this argument in a way that a paper or a presentation cannot. You can hold it. Place it. Move it. Feel the simplicity of the gesture relative to the complexity of the consent event it replaces. That felt simplicity is evidence. Not conclusive. But meaningful.

The thing either works as a spatial argument or it does not. You know when you hold it.

This is why speculative objects matter to futures practice. Theory can describe a design direction. Objects can demonstrate whether the direction produces something liveable. The Pip demonstrates that consent-through-placement is a coherent idea with a legible physical form. Whether that idea should become a product, and what form that product should take, are subsequent questions. The Pip answers the prior one: is this a real idea? Hold it. Decide.

What This Means for Ambient Intelligence Design

If spatial consent is a viable model for ambient intelligence, it has significant implications for how ambient products are designed and deployed.

Products need physical forms capable of carrying spatial meaning. An ambient device without a physical presence cannot signal consent through placement. It cannot be moved as an act of withdrawal. The push toward fully distributed, physically invisible ambient intelligence creates consent problems that the spatial model cannot solve. Some physical presence, in some form, may be required for consent to remain legible in ambient environments.

The physical form needs to be designed with placement in mind. Where The Pip sits in a room is meaningful. The form should support deliberate placement rather than arbitrary positioning. This is a different design constraint from most consumer electronics, which are designed to work wherever they are placed. An ambient consent object needs to work spatially, not just functionally. Its placement is part of its function.

The spatial model produces a different relationship between users and ambient systems over time. The permissions model creates a one-time consent event and then a settled relationship. The spatial model creates an ongoing negotiation. The Pip can be moved. Its placement can be revisited. The consent it signals is provisional and continuous rather than concluded and archived. This is harder to audit from a regulatory perspective. It is more accurate as a model of how consent actually works in intimate shared spaces.

These two things are in tension. Working out how to honour both is the design problem ambient intelligence needs to engage with seriously, and soon.

References and further reading

Helen Nissenbaum, Privacy in Context: Technology, Policy and the Integrity of Social Life, Stanford University Press, 2010. Helen Nissenbaum, A Contextual Approach to Privacy Online, Daedalus, 2011. Ann Cavoukian, Privacy by Design: The 7 Foundational Principles, Information and Privacy Commissioner of Ontario, 2009. Available at ipc.on.ca. Simon Penny, Making Sense: Cognition, Computing, Art and Embodiment, MIT Press, 2017. Related Aerithic project: The Pip spatial consent device. Related Aerithic essay: Soft Systems, Hard Questions.