Petition for mandatory transparency, visible sensing indicators and meaningful user control for microphones, cameras and privacy-sensitive sensors in consumer devices

Smart TVs, smartphones, smart speakers, computers, cars, security systems, home assistants and other connected devices are increasingly equipped with microphones, cameras and other sensors capable of observing, recording or analysing the people and environments around them.

These technologies can provide benefits, but can also collect highly personal information from our homes, workplaces, vehicles and other private spaces.

Consumers should always be able to understand when and why this is happening.

We call on the European Commission, the European Parliament and EU Member States to establish clear, technology-neutral rules guaranteeing every European citizen a simple and understandable right to know when a consumer device is sensing, recording or analysing them.

• Recording cases with apparently Off or Standby devices:

In September 2026, independent security researchers and technology investigators reported that certain Smart TVs could capture and store microphone audio while the television appeared to be in standby mode. The reported investigations also identified other forms of data collection and network-device discovery. Similar cases have also been reported with smartphones displaying ads of products mentioned on conversations, even with the microphone apparently switched off.

Modern consumer devices can also contain cameras, motion sensors, proximity sensors, biometric sensors and other technologies capable of collecting information about the people around them.

The necessity of updating the regulation framework.

The European Data Protection Board already recognises video devices as an important data-protection issue and has issued guidance concerning transparency, lawful processing, disclosure of footage, sensitive data and privacy by design.

Similarly to how Conversation Recording policies exist defining consent and purpose in countries such as Germany, France, Greece, Luxembourg, Bulgaria and other European Union countries, privacy policies should be adapted to other unregulated scenarios involving the aforementioned devices.   

A consumer should not need specialist technical knowledge, network-monitoring software or a detailed analysis of firmware to discover whether a device in their private environment is collecting information about them.

We ask the European Union to establish mandatory requirements for consumer products containing microphones, cameras or other sensors capable of collecting information about people.

1. Clear indication
Devices must provide a clear, visible indication whenever their microphones, cameras or other sensors are actively capturing information.

2. Capture vs. transmission
Users must be able to distinguish between information being captured locally and information being transmitted outside the device. Not being uploaded is not the same as not being captured.

3. Purpose transparency
Users must be clearly informed what is being sensed, why, how often, where it is processed, how long it is retained and who can access it. Information should be given regarding the use of the recorded information.

4. Meaningful, event-based consent
Devices must not obtain blanket consent for continuous or ambient sensing. When a device is about to activate a microphone, camera or other privacy-sensitive sensing technology for an optional purpose, the user must be clearly informed and given the opportunity to consent to that specific function or sensing session. Consent must not automatically extend to future, unrelated or materially different sensing activities.

5. No silent sensing in standby
Devices must not silently activate microphones, cameras or equivalent sensors while appearing to be switched off or in ordinary standby, unless the user has explicitly enabled a sensing-dependent function.

6. Hardware-level user control
Devices should provide hardware-level controls to disable microphones, cameras and other sensitive sensors.

7. Third party protection
Privacy protections must also apply to people who did not purchase or configure the device, including visitors, family members, children and colleagues.

8. Policy Consistency
Software or firmware updates must not materially expand sensing capabilities without clear notification and, where required, renewed user consent.

9. Privacy by design
Local processing and data minimisation should be preferred wherever reasonably possible, reducing unnecessary collection and transmission of personal information.

10. Independent verification
Manufacturers should be subject to independent testing and regulatory oversight to verify device behaviour, including during standby, apparent power-off, offline operation and after software updates.

11. Right to complete deletion
Users must have the right to request the permanent deletion of all personal information collected by the device, including recordings, derived information, profiles, biometric data and AI models or other trained models created using their personal data, except where retention is strictly required by law. Deletion must apply to copies and derived datasets under the manufacturer's or service provider's control.

12. Right to access recorded information
Users must have the right to access all personal information captured or recorded by the device in a complete, intelligible and usable form. This must include the underlying recordings or captured data, not merely metadata, summaries, classifications, embeddings or other derived representations. Information must be provided in a form that the user can access and understand without requiring proprietary software, decryption controlled by the manufacturer, or specialist technical knowledge.

Sign this petition if you believe that the right to privacy must evolve alongside connected technology.