A shared screen has to ask who is there.

On 13 October Apple announced HomeView, a 7-inch screen for the kitchen counter or the wall. It costs $299, pre-orders opened the same day in the US, the UK and a handful of other markets, and it ships on 13 November. It plays music, runs FaceTime, controls the lights and shows the family calendar. None of that is new for the category.

What is worth reading closely is how it decides who is standing in front of it. HomeView recognises up to six people by face, and each gets their own Home Screen. Shared photo albums and music stay open to the household and to guests. Personal content, Messages and Calendar, only appears when the device recognises your face and your paired iPhone or iPad is present and has been unlocked recently. Two signals, not one.

"

A screen everyone walks past has to answer one question before it shows anything: who is this, and how sure am I.

Identity is the hard part of a shared screen

A phone has it easy. It is in one pocket, it belongs to one person, and the lock screen settles the question. A shared screen has no owner. Whoever is closest is the user, and they change every few minutes. Apple's answer is to split the content into what anyone may see and what needs proof, then ask for more proof as the stakes rise. A face is enough for your Home Screen layout. Your messages need the face and the phone.

This is the same problem we work on with every touchscreen we put into a shop, a lobby or an event stand. The device is shared by design. The person in front of it might be a visitor, a member of staff or someone who wandered over. The mistakes are always the same: a previous visitor's details still on screen, a staff menu reachable with three taps, a session that never ends because nobody pressed log out.

Why we would not copy the face part

In a home, recognising six enrolled people you live with is one thing. In a public space in the UK it is quite another. The ICO's guidance on biometric data, finalised in 2024, treats biometric recognition as special category data from the moment it is collected, and in most cases explicit consent is the only lawful basis. A kiosk in a shopping centre cannot get explicit consent from someone it has not met yet. So for public installations the camera is the wrong first signal.

The pattern underneath still holds, though. Apple processes camera data in what it calls Secure Exclaves, out of reach of the software and apps on the device, and leans on a second device the person already trusts. We do a version of that in public with a QR code or a tap that hands the session to the visitor's own phone. The shared screen does the public part, and anything personal moves to the device they carry.

How we would apply it

• 01Sort every screen state into public, recognised and personal before designing a single layout. Most of a kiosk should be public, and that is fine.
• 02Ask for more proof as the stakes rise. Browsing needs nothing. Saving a basket needs a light handshake. Seeing an order history or a staff function needs a real one.
• 03Make the second signal something the person already owns. A phone scan beats a new account, and it carries the personal data off the shared screen.
• 04End sessions on absence, not on a button. A timeout tuned to how people actually walk away does more for privacy than a log out button nobody presses.
• 05Keep anything biometric out of public deployments unless the consent is real and documented. It usually is not.

Should clients care about a smart home display? Not as a purchase. But a large platform just shipped a product where the key decision was how much to trust whoever is nearby, and it chose a layered answer with a second device in the loop. Anyone specifying a shared screen for a building should be asking the same question at the brief, not at the data protection review.