“It becomes more of an abstract idea, this privacy” – Informing the Design for Communal Privacy Experiences in Smart Homes

In spite of research recognizing the home as a shared space and privacy as inherently social, privacy in smart homes has mainly been researched from an individual angle. Sometimes contrasting and comparing perspectives of multiple individuals, research has rarely focused on how household members might use devices commun-ally to achieve common privacy goals. An investigation of communal use of smart home devices and its relationship with privacy in the home is lacking. The paper presents a grounded analysis based on a synergistic relationship between an ethnomethodologically-informed (EM-informed) study and a grounded theory (GT) approach. The study focuses on household members’ interactions to show that household members’ ability to coordinate the everyday use of their devices depends on appropriate conceptualizations of roles, rules, and privacy that are fundamentally different from those embodied by off-the-shelf products. Privacy is rarely an explicit, actionable, and practical consideration among household members, but rather a consideration wrapped up in everyday concerns. Roles and rules are not used to create social order, but to account for it. To sensitize to this everyday perspective and to reconcile privacy as wrapped up in everyday concerns with the design of smart home systems, the paper presents the social organization of communal use as a descriptive framework. The framework is descriptive in capturing how households navigate the ’murky waters ´ of communal use in practice, where prior research highlighted seemingly irreconcilable differences in interest, attitude, and aptitude between multiple individuals and with other stakeholders. Discussing how households’ use of roles, rules, and privacy in-practice differed from what off-the-shelf products afforded, the framework highlights critical challenges and opportunities for the design of communal privacy experiences.


Introduction
Research has identified multi-user contexts as an important feature and as particularly challenging for the design of smart technology for the home (e.g., Geeng & Roesner, 2019).The challenges of these contexts include differences in preferences, interests, and abilities between household members (e.g., Garg & Moreno, 2019), as well as the effects of smart technologies on power relationships between household members and with the outside world (e.g., Levy & Schneier, 2020).Privacy is often considered as an important feature of these relationships and frequently discussed in this context.
Privacy research into the user experience and privacy of smart home products has initially assumed the perspective of a single individual or a multitude of individuals' perspectives (e.g., Zeng et al., 2017).Recognizing the importance of multifaceted relationships between individuals in the home, these perspectives contrast preferences and seek to enable mutually privacy preserving behaviors but struggle to strike a balance in face of competing interests (e.g., Yao, Basdeo, Mcdonough & Wang, 2019).Results of such analysis may appear to arrive at irreconcilable differences which may only be mitigated by law and regulation, for example, posing questions of responsibility and duty of care between primary users and by-standers (e.g., Yao, Basdeo, Kaushik & Wang, 2019).
While it is unquestionably important to anticipate the consequences of the actions of individuals who cannot or do not want to compromise (e.g., McKay & Miller, 2021), there is also value in learning from the ways in which households successfully coordinate the use of their devices between themselves and with the outside world.Prior research suggests that households routinely navigate challenges that arise from communal use of devices.Zeng and Roesner (2019) find that households have their ways of managing complex sociotechnical problems and that these ways should be studied further.
We heed their call for research on the ways in which households successfully navigate the demands of communal technology use by choosing an analytic perspective that focuses on the ways in which people conduct their lives (Zeng & Roesner, 2019).To understand how one might design for communal privacy experiences, there is a need to understand how communal use of technology is shaped by the design of technology itself.Questions such as who does what with which device and to what end become important.This paper focuses on household members' interactions with devices to investigate the relationship between communal use and privacy as it is shaped by the design of technology.Hence, we ask the following research question: RQ How does the nature of the relationship between internet-connected technology use in the home and privacy manifest in-situ?
The research context for this work are families in a small city in the UK.With the goal of exploring how interpersonal issues are navigated in 'healthy relationships' (Zeng & Roesner, 2019) the scope of this research is families, which we loosely define as two or more person households with spousal or parental relationships between inhabitants.
This paper presents a study that is designed to (1) allow households to choose a number of off-the-shelf smart devices; (2) observe their installation and use over an extended period of time (at least six months each); (3) focus on the communal nature of use1 ; (4) document the communal nature of smart device use; and (5) highlight the contingencies of this nature with the design of devices themselves.
We use these insights to construct a framework of the social organization of communal use, and we highlight its relationship to household members' everyday conceptualizations of privacy.The framework highlights important differences at the intersection of technology design and communal use that relate to issues of privacy.It shows how the everyday use of roles, rules, and privacy itself differs from conceptualizations frequently used in system design and engineering.The consequences of this observation are far-reaching, highlight important challenges, and open up new opportunities for design.
A key challenge is that some current designs implement generative and restrictive access control design that is unfit for communal contexts.Designers should empower users to follow their social goals and purposes.An access control design is required which allows users to dynamically establish and maintain their roles, not one that restricts the process.We also observed a lack of support to manage expectations of use, particularly where technical and social rules are not visible to the household by-design.To avoid frequent misalignment of expectations, design should promote coordination and communication between household members, e.g., by foregrounding activities that are relevant to particular rules of use such as privileged interactions.A third opportunity lies within re-thinking privacy-by-design for the home to account for the realities of communal use.Currently, communal use amplifies challenges for technical and regulatory privacy protection measures because individuals have to manage a community's preferences, these preferences are rarely relatable in everyday interactions and afford no accountability to other users.Social purposes of use and technical purposes of data collection are fundamentally misaligned, for the community of users.
In the following sections, we describe our study, introducing our approach to data collection and analysis.Next, we present our findings on four categories of interactions, roles, moral order, and rules before discussing the social organization of communal technology use in the home.We draw on these findings to offer implications for design of communal use.

Privacy and Design
Two related perspectives are salient in privacy research on the home: a focus on 'control over information ' (e.g., Emami-Naeini et al., 2017;Zeng et al., 2017;Solove, 2006;Lau et al., 2018) that is prominently manifested in data protection laws and regulations (e.g., European Commission, 2016;California Consumer Privacy Act, 2018), and an interpersonal perspective from human-centered computing where broader concerns of privacy beyond the flow of information are taken into account (e.g., Burrows et al., 2018;Yao, Basdeo, Mcdonough & Wang, 2019;Palen & Dourish, 2003;Crabtree, Tolmie & Knight, 2017).The latter perspective is more flexible in taking into account that values, norms, and understandings of right and wrong are also encapsulated in the concept of privacy and may even vary depending on social contexts (e.g., Nissenbaum, 2009;Wong & Mulligan, 2019).
A perspective of privacy as control over information only partly explains concerns over technology use in the home.While privacy concerns arise with regard to manufacturers' data collection and sharing practices (e.g., (Zeng et al., 2017)), they also arise from interpersonal relationships in the home (e.g., (Levy & Schneier, 2020;Leitão, 2019)), and while legal scholars explore how the division of responsibilities between data controllers and data processors might apply to multi-user contexts (Urquhart & Chen, 2020;Chen et al., 2019), the nature of privacy issues in the home is not limited to concerns over the collection and use of data but extends to mind and body (McKay & Miller, 2021).
Researchers have explored ways to address some of these privacy issues by design.For example, they have considered access control as means of control over information and a way to map interpersonal relationships in the home (e.g., He et al., 2018;Tabassum et al., 2020).Those who have field-tested more dynamic models highlight the implicit and social character of regulating access.Access to devices and services is found to be socially managed rather than technically enforced (Zeng & Roesner, 2019), resonating with previous research that has reported access control to be intimately "bound up with the subtleties of relationships" (O'Brien et al., 1999) and an "especially nuanced way of managing moral accountability" (Crabtree, Mortier et al., 2012) within the home.Social management is also manifested in sharing behaviors.Researchers have found frequent everyday sharing of accounts and devices, suggesting common kinds of access control is not commonly used (Matthews et al., 2016).
These insights on the practical use of systems resonate well with arguments that privacy cannot be "grafted onto a system" but ought to be considered as a pervasive feature of a system (Dourish & Bell, 2011).They suggest that applying a preconceived notion or even privacy theory can run afoul of the theory's or concept's own limitations, thereby hindering, rather than helping, research investigations.It seems other ethical concerns that influence the social nature of the home are inseparable from privacy.To approach this complexity, more research investigating the ways in which the use of devices and privacy as a feature of it are socially managed (not technically enforced) is needed (Zeng & Roesner, 2019).

Technology Adoption and Communal Use
Smart home devices are not the first generation of internet-connected technology to enter people's homes.Effects on interpersonal relationships have been discussed through the lens of appropriation (Dix, 2007) or domestication theory (Venkatesh, 1996) before.An often cited phenomenon of these research perspectives is a so-called 'dominance of the social', probably best summarized by Venkatesh (1996): "we cannot assume that what the technology can do in the household is the same as what the household wants to do with the technology".This statement foregrounds the importance of considering social processes and somewhat refutes 'technocratic dreams' of successfully reforming society through 'technology push' (Sacks, 1995;Tolmie et al., 2003).
Researchers have pointed out how the life in the home is organized and coordinated between cohabitants, and how cohabitants' efforts in turn are oriented towards the home's moral order (O'Brien et al., 1999;Strain, 2003).Socially, homes include relationships and are "moral economies" that inhibit a unique set of values, routines and practices.The home provides 'ontological security', a sense of confidence that the world really is as it appears (Giddens, 1989).The process of making technology work within these household economies has been described as 'negotiation'-"different people that have moral claim and the differing activities that are deemed appropriate at any moment in time in people's homes" (Crabtree, Mortier et al., 2012).The communal technology use by households has been documented as ongoing negotiations, articulated or manifested in everyday practices of usage arrangements (Garg & Moreno, 2019;Kraemer et al., 2019).
Within the household community, individuals consider a broad array of personal, social, and practical matters when arranging for the sharing of devices.Desires to act as gatekeeper (Jakobi et al., 2018), personal preferences (Page et al., 2018), and the nature of technology are all possible causes for tensions and conflicts (R. H. Jensen et al., 2018).At times, these conflicts are resolved by adopting devices to different extents (Hargreaves et al., 2018).In the extreme, devices can be used intentionally to gain and exercise power over cohabitants (Freed et al., 2019;Levy & Schneier, 2020).Ownership, power, and control (Hargreaves et al., 2018;Geeng & Roesner, 2019) are social concepts often discussed in relation to cultural history and politics, and prominent among such ongoing debates are aspects of gender.Researchers have pointed towards a gendered nature of technology design and use (Strengers et al., 2019;Richardson, 2009) that also manifests itself in men driving adoption and typically doing 'digital housekeeping' (Forlizzi & DiSalvo, 2006;Hargreaves et al., 2010;Tolmie et al., 2007).The introduction of new technology to the home could therefore alter the existing division of labor in the home by allowing men to justify contributing less to housework traditionally done by women (Strengers et al., 2019).
These issues raise questions of who does what with which device and when.Ethnomethodologically-informed (EM-informed) perspectives have been instrumental in addressing such questions of social organization/structure and moral order.Researchers have provided insights into sense-making of data (e.g., Goulden, 2019), the use of the home network (e.g., Crabtree, Mortier et al., 2012;Grinter et al., 2005), and domestic routines (e.g., Tolmie et al., 2002).However, social issues mentioned above have been reported to be enabled by and amplified through the use of smart home devices (Levy & Schneier, 2020), motivating us to pay particular attention to their use.To the best of our knowledge and despite its power in understanding social interactions, there is no EM-informed account of smart device use in the home.We therefore focus on communal use of off-the-shelf smart home devices as we detail below.

The Study
The literature review has highlighted that considerations of technology use and privacy in the home are closely interlinked with normative aspects, foregrounding the questions of who does what, how, and why.Invariably, these questions of household members' interactions with devices and with one another are also influenced by the devices' affordances, placing design decisions center-stage.
Following Dourish and Bell (2011), we do not aim to understand how preconceived notions of privacy can be grafted onto a system, perhaps in ways that existing privacy theory suggests might be conducive to human preferences, needs and untroubled behavior.Instead, we follow Wong and Mulligan (2019) who suggest empirically inductive approaches offer insight where no appropriate theory is available.We further refine our main research question as follows: RQ How does the nature of the relationship between internet-connected technology use in the home and privacy manifest in-situ?
1) How is communal use of smart devices in and around the home organised?
2) How is privacy oriented to as part of this organisation?
3) What are implications for product design and development?
To answer our research questions, we recruited six families to join a six-month interview and diary study of household technology use (Figure 1), and we choose to inform this approach using Ethnomethodology (EM).However, the nature of the relationship was not just communal, but can also be characterized by effects of privacy and technology design.These issues raised analytic and structural questions, which we approached by presenting insights from our EM-informed study following the process of Grounded-Theory (GT).We explain briefly.

Workshop Provision
Reflection The figure shows the planned progression of home visits (circled).The actual time per household varied to accommodate for seasonal and family holidays, as the detailed schedule in Appendix Figure A8 shows.In (1), we got acquainted and conducted a smart home planning workshop.Phase (2) started with the provision of new devices, followed by regular visits to learn about their experiences.
nature of technology use manifests in-situ'.These research approaches have developed over the years.They are best structured by considering different research paradigms (Harrison et al., 2007).This research is positioned within the 3rd paradigm (Harrison et al., 2007) of HCI where the meaning of privacy is constructed at the intersection of technology and society: "what goes on around a system is more interesting than what's happening at the interface".A qualitative, exploratory, and inductive approach is needed.At the same time, the approach must be suitable to provide insights into "what [was] happening at the interface" (Harrison et al., 2007), connecting rich empirical insight with the requirements of system design.EM informed approaches are particularly powerful in providing ethnographic perspectives in design, urging researchers to "move from design critique to design practice" and moving past critiques of the design process that only 'defamiliarise', 'tell exotic tales', or 'critically reflect' (Crabtree et al., 2009;Button & Dourish, 1996;Dourish & Button, 1998).
'Defamiliarisation' studies help designers rethink the assumptions built into domestic technologies.It is questionable in how far an approach turning naturally accountable interactions into analytic objects can play an active part in, rather than a critique of, the design process (Crabtree et al., 2009).The proposition of these studies is to "provide an alternative view point on assumptions in the design process itself" (Bell et al., 2005, p. 154).While serving as the root of ethnography in anthropology, 'exotic tales' are criticized in HCI for their failure to provide actionable insights for designers due to their lack of sufficient detail and attention to interactions.'Exotic tales' often surface descriptions that offer "grossly observable features of a setting or culture" (Crabtree et al., 2009;Button, 2000).'Critical reflection' encourages designers to consider 'new values' beyond productivity and efficiency (Crabtree et al., 2009;Boehner et al., 2007): "Critical reflection itself can and should be a core principle of technology design for identifying blind spots and opening new design spaces" [p.49] (Sengers et al., 2005).Crabtree et al. (2009) position the EM informed 'critical interpretative frame' as the result of uncovering the natural accountability of members' actions and not as the result of an analyst's interpretation of data (see also (Ten Have, 2004)).This perspective follows Lucy Suchman's seminal work on 'situated action' (Suchman, 1987) and has made significant contributions to the field (Randall et al., 2020).The perspective allows us to focus on how actions and interactions of household members are organized in their particular setting (Garfinkel, 1967;Suchman, 1987).
The main part of our research question aligns well with an EM informed study within system design.However, any discussion of the nature of the relationship between tech-nology use and privacy can also benefit from 'defamiliarisation' and 'critical reflection', raising the question as to how EM informed findings can offer implications for user experience and interaction design more broadly in these ways.As the study is an evaluation of existing design efforts, interaction with designers and product developers is not part of this study.Moreover, our findings need to enable user experience and interaction designers to consider privacy as a pervasive feature of product design and development.Hence, an additional goal to inform future design efforts arises: designers should be able to navigate and reconstruct the findings independently.
System designers benefit from EM informed approaches that provide operationalisable, generalisable, reusable, and transferable insights (Randall et al., 2020;Crabtree, Rouncefield & Tolmie, 2012;J. A. Hughes et al., 1992;J. Hughes et al., 1994).These insights should allow for critical reflection and familiarisation, i.e., they need be generic implications (Crabtree, Rouncefield & Tolmie, 2012), presented with clear and efficiently navigable links between findings and their implications.Beneficial are representations that can be efficiently navigated bottom up (anecdote to insight) or top down (insight to anecdote).
GT provides structured and focussed representations that let 'the data speak for itself' and highlight emerging social phenomena (Charmaz & Mitchell, 2001).GT is used frequently to explore socio-technical phenomena and to inform design through structured, empirically-grounded representation of interaction (e.g., (Westin & Chiasson, 2021;Razavi & Iverson, 2006;Alsheikh et al., 2011)).GT's inductive theorization suggested by Charmaz (2006) based on (Glaser, 1978) maintains the heritage of arriving at "concepts and theories through analytic construction [rather than] through empirical generation" (Ten Have, 2004).As Ten Have (2004) explains, GT traditionally employs a fundamentally different analytic orientation as 'ethnomethodology does not strive to 'add' anything to the social life it studies, no 'theory', no 'concepts', not a different level of reality.It just brings to light what is already available for all to see; it is, then, just an eye-opener.' (Ten Have, 2004, 12) In our grounded analysis, GT and EM engage in a synergistic relationship.The idea of theory building is replaced by 'plugging' EM's analytic perspective into GT's process.The overarching GT protocol not only encourages us to pay close attention to observable and reportable interactions, but also provides guidance in organizing and navigating our record of interactions.In this sense, we use the GT protocol to frame the "empirical generation" (Ten Have, 2004) of 'generic implications for design' (Crabtree, Rouncefield & Tolmie, 2012).The approach reminds us to stay focused on "what people do and how they organize action and interaction in particular settings of relevance to design" (Crabtree et al., 2009).The rest of this section further explains the approach to which we will refer as 'grounded analysis' henceforth.

Recruitment and Participants
We focused on families for their social complexity and desire to organize their lives efficiently (Davidoff et al., 2006).Families were also the focus in related work which facilitated the discussion of our findings, i.e., (Crabtree, Tolmie & Knight, 2017) and (Zeng & Roesner, 2019).We advertised our study to families from our previous stud-ies2 , and through social media and online platforms3 .Prior experience with smart home devices was not mandatory, but experience with instant messaging and/or email was required for communication with the researcher.We did not target a particular 'type of family' as sometimes described by the number of adults in the household, their age, or their genders4 .Such intention would undermine our research approach by super-imposing 'categories' as prototypes of personal characteristics or character traits that are assumed to influence behavior.Regardless of whether these aspects drive action in participants' everyday experiences, they are outside this study's remit on observable and reportable action (Ten Have, 2002).At the same time, we decided to exclude flat shares and other forms of cohabitation for their different dynamics and setups.We suggest others investigate these in future studies.
A total of 10 families initially expressed interest, and we clarified details of the study in an initial 'meet and greet'.We selected families with two adults who share a spousal/partnered relationship and/or a co-parenting relationship, plus children if applicable.Initially, we also required both adults to cohabit.As the only exception, this rule was relaxed for household 3 where two adults co-parented, but it became clear that one adult was moving out early in the study.Note that the parent became a frequent visitor thereafter and appears as such in this study.
Five families with children agreed to join the study, and a sixth family without children was accepted when our efforts to recruit families with children remained unsuccessful.Details on these families, the devices they owned, and devices they obtained as part of the study can be found in Table 1.
Participation was incentivized with (£200) cash paid in four installments and by allowing families to keep smart devices they received as part of the study (£600-800).A requirement for participation was an interest in procuring new smart home devices, and all participating families expressed such interest.The total incentive, of up to £1,000 per household, was calculated as above the minimum wage in the UK for a time commitment of approximately 10 hours (including households visits and participant diaries).Families were allowed to drop out of the study at any point and without any explanation.When dropping out, they also had the opportunity to withdraw their consent for the use of diary and interview data.In any case, they were allowed to keep the devices and the financial rewards received up to the point.Out of the initial six families, Household 5 declared per email that they were unable to continue the study due to health related reasons.They had not yet received any new devices, and they did not withdraw their consent.The first three interviews with this household are part of the analysis, but no further interviews were conducted.

Data Collection
The first household visit started in August 2019 with our final visit in May 2020.We also asked participants to keep diaries throughout the study.Appendix Figure A8 shows the households' detailed schedules.
Due to the first UK national lockdown caused by Covid-19, our in-person interviews scheduled between March 23rd and May 10th were moved online, and our conversations naturally gravitated toward health, safety, and the challenges of working and learning from home.Note, that these circumstances do not warrant a methodologically different treatment, as explained below.
Households 1-3 and 5 had finished the planned participation before the lockdown came into effect.Household 4 had one interview left, which was hardly affected by the lockdown.As the family transitioned into the new normal, there had not yet been any major changes around their device usage practices.The four interviews with Household 6 during lockdown showed a significantly increased amount of time spent and resulting heightened engagement with the devices.As a result, interviews provided richer insights as the couple had more time to jointly explore their use of devices, to try different setups, and to build new habits/routines.This process appeared accelerated as compared to other households, but was expected over the course of the remaining four interviews.Reaching stable routines and habits earlier than the other households does not present a limitation of our findings that report on what these routines are and how they come about.
Dynamics in other households were also affected by the lockdown, likely in ways that would alter existing routines and bring about new ones.However, reporting on these dynamics is beyond the remit of this study and subject to future work.

Home Visits
During each of the visits (30-60 minutes of unstructured interview), we encouraged all family members to share their experiences of using any of their internet-connected technology.For example, in households one and four, the researcher would arrive after the family had finished dinner and join them for a cup of tea at their dining table.We engaged with participants in conversation for as long as they preferred, but we were equally happy to just listen to what they had to discuss between one another.Naturally, the conversation for the first few minutes evolved around what happened at school or work but eventually turned towards experiences with smart devices; for example, through recalling conversations with friends/colleagues about these devices.We generally made sure that every household member was given time to share their experiences, actively involving children in the conversation in so far as parents were not doing so already.We used a simple dictation machine to record these meetings.

Researcher Diary
Field notes of each visit were kept in the researcher's diary after the meetings.The researcher employed a three-step note-taking approach: (1) a short summary of issues and topics discussed during each visit to be posted on the household participation page; (2) descriptive observation notes on interactions with devices and between participants; and (3) interpretative notes and reflective comments on the researcher experiences.

Participant Diaries
Participants over the age of 10 asked to keep a participant diary and were invited to choose either paper-based or digital diaries (12 participants in total); most participants preferred the digital version which we run using Threema5 messenger (8 participants).
Table 1: Participating households and their networked devices.
pre study: smart tv, smart phones, iPads, and laptops new devices: smart speakers, smart display, smart cameras H2 (£70-80k): Monique (mother, 40s) and Adam (father, 40s), living with their son Eric (1-3) a .Monique (undergraduate degree) works in communication management, and Adam (undergraduate degree) works as an IT manager at a local University.
pre study: laptops, smart phones, streaming devices, smart meters new devices: smart speakers, smart display, smart camera with doorbell and chime H3 (£40-50k): Carrie (mother, 40s) and Felicity (daughter, 10-12) live together.Paul (father, 40s undergraduate degree) a ,b pays a regular visit to his daughter.Carrie holds a postgraduate degree and works as a support teacher in special needs education.
pre study: laptops, streaming devices, smart thermostat, smart phones, do-it-yourself Raspberry Pi system new devices: smart display, streaming device, smart bridge for Apple Homekit, smart switch, smart lighting, smart doorbell a Not actively participating.b Not permanent household members.c Household left the study after smart home planning session due to illness.
We encouraged participants to log instances of shared use of any internet-connected devices they owned.During part (1) of the research, we asked about their experience using a device they owned already.From part (2) onward, we encouraged participants to comment on their experiences with the devices with which they were provided.Diary entries also served as starting points for conversations during our home visits.We did not treat digital diaries any different from notebook diaries for our analysis.We equally received short-worded diary entries and long-winded explanations through either, as well as varying reporting frequencies over both mediums, suggesting the choice was a purely personal preference and of little to no effect on reporting behavior.

Smart Home Workshop
To prepare participants for the planning session, we shared consumer insight reports with the participants on smart home planning6 and test reports on particular devices7 .All of these reports were created by Which?, a popular UK product testing and consumer information organization.
We conducted a workshop during the third visit to identify devices of interest.To this end, we created a card deck (Appendix Figure A2) with details on device features.Using a points system to represent the costs of our devices, we asked participants to build two sets of cards worth £800 and £600 respectively.Our motivation for this approach was two-fold: (1) we were interested to see whether workshops would bring forth notions of ownership with regard to set-up and ongoing use (see also (Garg & Moreno, 2019)); and (2) the workshop required participating families to arrive at a consensus through discussion, thereby revealing something of their social and moral order.

Our Grounded Analysis
The final data set included 47 interviews (∼45 minutes per interview), 47 field notes (∼200 words per note), 13 participant diaries (∼1,485 words per diary) and 22 photographs.The data set was imported into the qualitative data analysis software "Atlas.TI 8", which supported our coding and diagramming process throughout.
As detailed in Figure 2 and further described below, our analytic approach allowed us to produce a structured account of phenomena related to communal use and privacy that emerged from our data.Such account then served the need for actionable, reusable, and abstract insights (Charmaz & Mitchell, 2001).Note that the use of standard GT terms and their role in our grounded analysis is illustrated in Figure 2. Theoretical codes (purple) in our analysis are inspired by (Crabtree, Rouncefield & Tolmie, 2012) generic implications for design.They are informed by categories (pink) which are best understood as implicit social processes that relate to observable social processes (green).
Discussing the benefits of importing GT for empirical studies, Charmaz and Mitchell (2001) suggests adapting its methods for "specific objectives of a study and for the style of the researcher".To do this, the grounded analysis for empirical generation of findings, which was repeated for each transcript, field note, and participant diary of every household, was as follows.
First, the researcher and a colleague individually read the document.They then met to code the artifact jointly, incident by incident as description of interactions (e.g., (Charmaz & Mitchell, 2001)).The artifact was coded with a focus on preserving actions and comparing data with data initially.Codes were captured as names of quo- tations (white in Figure 2).Disagreements between codes were discussed there and then between the two researchers, sometimes deciding to refer a code for later revision after having seen more data.Regular debriefings with supervisors also supported consistency of coding.During this step, focused codes describing observable social processes (coded in green in Figure 2) began to emerge.These social processes manifested over time through constant comparisons with each other and with quotations/data.Once all the artifacts pertaining to one household were coded, the researcher created networks that linked quotations with codes and emerging categories.Investigating these networks, the researcher began to write memos which served to manifest categories (pink in Figure 2) while drawing on sensitizing concepts presented in Section 3.3.1.Once these memos were integrated with the household coding networks, they served as reference points for comparing codes and categories between incidents and households8 .
Core concepts (coded in purple in Figure 2) emerged through iterative comparisons of implicit social processes (categories, pink) with observable social processes (focussed codes, green) and descriptions of interactions (quotations, white).The social organization (theoretical concepts, purple) represents links between categories and outcomes of the meaning brought about by their social processes.Their meaning is created and reflected by social processes, contributing to the establishment of social organization.It is important to note that our intention was not to analytically construct a generative or prescriptive theory but rather to empirically generate a descriptive/sensitizing framework.
Once we were confident that we have arrived at an insightful and stable representation of the social organization of communal use, we iteratively queried existing EM related literature to verify codes, categories, and emerging concepts.At this point our analysis was complete, i.e., 'theoretical saturation' (Charmaz, 2008;Muller, 2014) was achieved.The final product of this coding process is depicted in Figure A4.

Importing Sensitizing Concepts
Using sensitizing concepts in conventional GT analysis reduces the complexity of the analytic task as it helps provide focus and guidance for the analytic process through a focused perspective on data (Charmaz, 2006).We use 'everyday activities', 'natural accountability', and 'dimensions of work' to help us ask specific questions about the data and guide our analytic efforts.
Everyday activities are subject of EM investigations in that they constitute recurring practices.Fuchs explains, "members of ordinary society do not so much act as enact the social practices of common sense" (Fuchs, 2007, p. 61).The concept suggests a strong focus on action, one that almost disregards actor agency.It fits well with our focus on practical action.
Natural accountability Highlights the ways in which actions are self-explanatory to other members, and how this kind of accountability provides a sense of normalcy (the 'visibly-rational-and-reportable-for-all-practical-purposes' (Garfinkel, 1967, p. 7) character of interactions).Members of the setting "are supposed to design their actions in such a way that their sense is clear right away or at least explicable on demand" (Ten Have, 2002).Accountability is an inherent property of "rational social behaviour" (Dourish & Button, 1998) rather than something that can be attributed to or used to describe a particular kind of social action.Dimensions of work offer inspiration for the organisation of empirical insight from EM studies (J. A. Hughes et al., 1997).We take Crabtree, Rouncefield and Tolmie (2012, pp. 127-128) notions and appropriated them for the home: • Distributed coordination refers the organization of activities in the home that are part of the division of labor.The "manner and means" by which these activities are organized is of particular interest in EM. • In work settings, objectives might be laid out by plans and procedures but what is actually involved in accomplishing them is often overlooked.In the home, plans and procedures are more dynamic and rarely codified.However, even paying attention to "what is actually involved in 'getting the job done'" is important.• Awareness of work refers to the ways members make each other aware of their interactions that contribute to the distributed division of labor.Of interest are the means by which this awareness is achieved, emphasizing "the fundamentally social and accountable nature" of interactions.These concepts offer directions for the emerging representation, sensitizing the researcher to social processes that need to be understood in order to make sense of the social organization of a setting.For example, they sensitize the researcher to questions of what it is that people 'do' that contributes to and represents the sense of normalcy when 'following' social processes, and how such processes can be supported or enabled.

Ethics
The research project was approved by the central research ethics committee of our institution (reference number: R59140/RE001).Since the study was conducted at participants' homes and with the involvement of children, extensive efforts were dedicated to safeguarding participants and the researcher.We collected informed consent from all participants over the age of 16.We obtained the assent of children under the age of 16 in addition to their parents' consent.The information material for children was illustrated and written in plain and easy language.The consent form and process was explained to the participants during the first meeting.
We considered that conversations in group settings at participants' homes might touch sensitive topics.To emphasize participants being controlling the conversation, we highlight repeatedly that participants could change the subject or refrain from answering questions altogether.Participants could contact the principal investigator and main researcher at any point in time to voice concerns or get clarifications.
All involved researchers underwent appropriate training in safeguarding children.Researchers familiarized themselves with the university's code of practice for conducting research at participants' homes, the university's safeguarding code of practice, completed the OSCB's (Oxfordshire Safeguarding Children Board) online training, and received clearance from the UK's Disclosure and Barring Service.All research data was managed according to standards of the university and the UK Data Privacy Act 2018.
Participants received off-the-shelf devices as part of the research study.Devices were gifted to the participants, fully owned and overseen by them.The research team did not have access to any of the accounts or data involved.All devices were chosen and set up voluntary by the participants.For safeguarding, we made sure to only recommend devices for which no known security vulnerabilities had previously been reported.

Findings
The novelty of our findings is two-fold: first, a framework of the social organization of communal use that builds on social processes presented across concepts of interactions, roles, moral order, and rules; and second, naturalistic data that illustrates the relationship between the challenges of communal use and our framework.
An important insight corroborates with prior research (Crabtree, Rouncefield & Tolmie, 2012;Dourish & Bell, 2011) and confirms our methodological orientation: participants rarely referred to privacy explicitly, and the concept did not appear to be an immediate concern in their practical actions-at least not in the ways referred to in the literature on informational privacy that is concerned with control over information.Instead, participants' perspectives on privacy were bound up with other situational considerations and reflected in interactions of everyday use that shape part of the social and moral order of the home.To answer the research questions for this study, it is necessary to take as a starting point an exploration of these activities before turning towards the ways in which privacy is embedded in everyday interactions.

The Social Organization of Communal Use
Exploring everyday interactions of device use, we explicate social concepts of roles and rules as shaping and influenced by moral and social order of the homes (Figure 3).In the sense of expectations, roles provide for interactions while interactions manifest in roles.Interactions inform rules in at least two ways: they might make the articulation of a rule necessary (parents for their children), and/or rules can be proposed by adults to call moral order into account.In turn, rules provide meaning to actions such that community members are enabled to act competently.Rules articulate expectations for roles but do not define them in these expectations.Rules are not just role expectations but also account for moral order.Assuming and acting as part of a role requires considering the meaning of rules and how this meaning encapsulates social goals and moral order.Social values and goals are reflected in the moral order of the home.An important concern among household members is to maintain and nurture relationships across digital and physical worlds by managing the 'attack surface' with the digital world (Crabtree, Tolmie & Knight, 2017).It is clear, that these everyday conceptualizations differ from their counterparts in system engineering that are closley related to issues of privacy engineering.Narrow interpretations of these concepts can cause friction between household members and can hamper technology adoption as we further show documenting our participants' experiences and grounding these concepts in data.

Interactions
The relevance of devices to the social and moral order in the home becomes visible in interactions.Interactions refer to when individuals (household or members of the wider community) communicate with one another face-to-face or mediated by devices (generally by making sense of a system's state and recent changes, but also by facilitating asynchronous communication between individuals).
Prerequisites for interactions are, at the very least, opportunities and 'being conversational' (familiar) with the ways a device can be used.Participants draw on various resources to make visible and constitute the relevance of smart technologies in their home.The findings describe a household's collective ability to talk about a device in terms of its purpose and how that purpose is established.Contributing to this ability are a number of factors: experiences with similar kinds of devices (e.g., smartphone-based voice assistants being similar to stand-alone voice assistants), exposure to reports on these devices or advertisement for these devices in the media, and time spent using devices.Collectively, experiences and insights are shared in conversation through purposeful demonstrations, teaching, and observation.In these ways, household members learn about others' usage practices, usage preferences, and possibilities of use.Interactions also hinge upon familiarity with one another as part of a decision-making process such as choosing devices for study purposes.

Vignette 1
Household 2-visit 2 Adam: We could try it.
By drawing on everyday practices, household members can benefit from jointly anticipating usage scenarios before purchase.While single household members are likely familiar with "whatever else is going on in the home" (Crabtree, Mortier et al., 2012), they will not be able to fully anticipate practices, needs, and desires of others.Usage practices vary between people and therefore need to be reflected upon (Kraemer et al., 2019).Secondly, the ability to consider appropriation of devices to the needs of the household depends on a basic understanding of all adults of how a device can be used.These findings are in line with the cognitive work dimension of domestication theory.Researchers before us have called for more engagement of designers with this perspective (Hargreaves et al., 2018).Although the discussions above take place before the participants obtain a particular device, the sense-making process of becoming conversational we described is useful in highlighting a sequence from understanding what a product does and how it fits with everyday practices to envisioning possible futures with the devices; all of which happen in conversations between household members.
However, a household's ability to become conversational depends on opportunity and access to knowledge.While opportunity can be created by design, and knowledge is available through members of the household and resources we shared prior to the meeting, there are limitations to this approach: first, the features considered for appropriation by household members are those advertised by manufacturers only (thereby unlikely to include considerations of privacy (Emami-Naeini et al., 2019, 2020)); second, additional knowledge through household members may not always be available (Emami-Naeini et al., 2018); and finally, not all household members are involved in the processes outlined above (e.g., children frequently were involved only later).
As we illustrate further in the next sections, interactions do not only contribute to familiarity with devices in the ways described here, but also become an essential part of the ways in which the use of devices is socially organized at home.

Roles in Communal Use
Socially, roles describe who normally does what with which devices in the home.While roles are usually not formally defined or articulated, they are sometimes brought up to highlight expectations (Hilbert, 1981).Adults coordinate their efforts with regard to device configuration, ongoing use, and maintenance.While coordination largely happens between adult household members, it also extends to neighbors and friends, and in that sense encompasses the wider community.Household members coordinate their actions across emerging divisions of labor following, in part, divisions of knowledge and experience.

Divisions of labor
Divisions of labor frequently emerge as the set-up of devices is carried out by adults on behalf of the household.The set-up is not carried out communally: while some households divide tasks among themselves (across Households 1-4, the set-up of voice assistants was led by women while men focused on security, light systems, and thermostat systems), in other households the set-up of all systems is conducted by one person; in Household 6, for example, the voice assistant is configured only by the husband.These divisions of labor are planned for by our participants.For instance, in Household 4 Carla left the set-up of cameras to Aaron because she knew he enjoyed using cameras.Rosa also relied on her husband, Jaco, to set up their smart security system as it requires fixing camera mounts outside the house for which he had to borrow the required tools from a friend.
Two important observations are made: (1) divisions of labor are not always planned for but occasionally arise from the nature of devices themselves, and (2) when divisions of labor are not planned for, additional coordinative efforts are required, along with time and opportunity, to ensure the technology works for everyone.

Vignette 2
Household 2-visit 5 Monique: It will not.I've done the app, I've followed the instructions.
Adam: I think it's because my account's connected, I think we need to share an account.
Researcher: Yeah.Monique: No, because it says that it's . . .Adam: But I haven't been able to dedicate as much time to those devices, but I think it's also a testament that they're, in terms of at least set-up not user-friendly . . .
Household members' ability to support each other in solving problems with devices can also be limited by the nature of devices, particularly where a division of labor during the set-up is consequential for a division of labor in subsequent configurations.
This is further illustrated by the example of Household 4, where the mother, Carla, and her daughter, Ester, configure a Google Home Mini to recognize only Ester's voice to prevent Ester's brother, Malte, from using the device.While Aaron, the father, was not present during the set-up, he considers adding Spotify to the Google Home device to improve Ester's experience of it at a later point.However, since he is not aware of the devices configuration in the first place, he does not know how to overcome a situation in which the device does not respond to his requests ("Because Google does not respond to me").
On another occasion, the two parents fail to use family accounts for Google and Amazon on their devices, leading to a situation in which most of the services they pay for are linked to only Aaron's accounts.Such a division is limited by the nature of devices or the features linked to accounts, requiring coordination between spouses to make devices work for their family (e.g., for their children).

Differences in Use
An additional division of use emerges over time which, at least in part, could be attributed to an earlier division of labor in the set-up and configuration.Where devices have already been put in place by inhabitants with strong interests in exploring this kind of technology, individuals in the home used the technologies to different extent and sometimes on behalf of the household (Households 5 and 6).
In Household 5, Cassie and Frank live with their children, Donald and Fabian.Vignette 3 takes place several months after Frank has configured the smart lighting system (including wall light switches) which was linked to the voice interfaces and already used by all family members.

Vignette 3
Household 5-visit 2 Cassie: But can I say, "Can you set that scene in the kitchen?"Frank: Yes, it is configurable on a room-by-room, bulb-by-bulb setting.Cassie: Okay, well, then we should do that, set one up for cooking and eating.Frank: Yeah, I have but you have not found them and it is easy enough to change them, right?[. . .] Researcher: How do you usually find out about new things?Cassie: When I see Frank doing it.
Configuring and maintaining devices can become a shared effort or someone else's task.People more familiar with devices willingly take on the tasks with these devices on behalf of others.In Cassie's response "we should do that" (Vignette 3), it is important to note that 'we should' is used rather than 'I can' or 'I should' or similar.The 'we' signals that Cassie alone is not the person who configures the devices9 .Only after Frank configures the device, Cassie learns about what new things it does.Similar divisions of labor could also be reported from other participating households, e.g., the considerations of Household 2 in Vignette 1.However, this division of labor is not just contingent on individual interest and is not always planned for.

Fluidity of who does what
However, a fluidity of who does what when individuals move in and out of roles as the division of use is not always clearly and consistently delineated.Especially, where spouses change or exchange the tasks they typically do.For example, in Household 1 Jaco has set up the smart security cameras and taken on the task to regularly review their recordings.When his phone broke, Rosa took over this task of checking the video feed for incidents daily.Unlike Household 2 and 4 where the couples managed each their devices, Jaco has configured the corresponding application on Rosa's smart phone, not mentioning any particular challenge.Subsequently, Rosa makes the system 'work for herself' by setting camera names that signal the camera's location.Because she knows that her husband regularly reviews the recordings, she does not take on that task.Instead, Rosa assumes a "secondary role", expecting her husband to look after the home security system (Rosa: " I guess because I know he will do it.I will take a secondary role [...]").This role of looking after the security system is co-established and shared between the adults.Household 4's experiences with the same smart security system illustrate that the design of the technology itself affected the construction of roles (Carla: "Yeah, Aaron has to do all the admin.").Such influence is not always welcome, and requires additional coordination between adults (Aaron: "Again it's me ruling all of the apps, isn't it?").

Vignette 4
Household 4-visit 7 Carla: Aaron can do much more on his app than I can.Aaron: Because mine's Android.And it seems to be easier somehow anyway to get hold of all the options and do things.
Researcher The parents in Household 4 wish to share access to devices following their idea of a spousal relationship (the established ways of dividing labor and responsibility in the home) in which either of them has the ability to manage everything on any of the devices, technology design permitting.Sometimes they deliberately refrain from this approach, and diverge in other times.
Summary Adults coordinate their interactions to make the technology work for their home.Roles in the home are co-established between adults.When they are called into account, they highlight an expectation of the person assuming the role and doing the work ascribed to it.This is in line with Hilbert who defines roles as "something actors occasionally require to achieve mundane, non-theoretical ends" (Hilbert, 1981, p. 218)).However, devices sometimes fail to accommodate for the fluid nature of who does what in the home.Roles are not always assumed by single individuals.Rather, it is the individuals who move in and out of roles.Roles are sometimes shared between adults; at other times tasks that serve the fulfillment of a role can be delegated.When the nature of devices (features they offer/lack) is consequential for a division of labor (who can do what with devices), the division of labor is considered problematic and requires additional coordination.

Moral Order and Communal Use
In this section, we show how households' interactions inside and outside the home reflect and contribute to a moral order-"shared goals, values, norms, and beliefs, about words, deeds, and actions considered 'normal,' 'right,' and those considered 'wrong'" (Langman, 2007, p. 5052).We do so by arguing that expectations with regard to appropriate use are not only held by members of the household community, but also extend beyond the immediate household.We further show that these expectations are implicated in everyday interactions and communication between community members, and that they are not always articulated among household members but surface when expectations are not met.

Inside the home
As we will also show in Section 4.5.1, notions of appropriateness can be seen in interactions between household members, both with spouses and with children.This appropriateness shows that household members reflect on the use of devices, and particularly on the ability to make appropriate use of devices when the design of devices is perceived as limiting.
Expectations of normalcy become visible during continued use when others' actions are called to account (background expectancies (Garfinkel, 1967)), and this demanding account reveals what appears to be the home's moral order.In Household 1, Rosa assumes a "secondary role" as she only reviews recordings when she knows that Jaco would not be able to.Note that Rosa is not excluded from reviewing the recordings.However, as the vignette below illustrates, how the task (reviewing the recordings) is accomplished has not been discussed or mutually agreed on but was somehow left to Jaco.

Vignette 5
Household 1-visit 7 Rosa: The last two weeks we, after the kids went to sleep he wasn't sleeping, I could hear his phone buzzing (makes noise).Then I couldn't sleep.And then I said, "Do you have second wife or what?Your phone is buzzing all the time."And he said, "It's Arlo," I said, "Oh, okay." The two household members establish the relative needs and purposes of reviewing the camera feed in light of existing goals and values, i.e., looking at the phone in this situation (before bedtime) is unusual but permissible given their shared goal of protecting the home, and Rosa accepts the explanation Jaco offers, "It's Arlo"10 .
Over time, interactions like these with their encapsulated goals, values, and sense of normalcy (as visible or discussed with other household members) become part of a moral order.Household 4's values and goals are reflected in Aaron's considerations when moving the Alexa Show 5 to the bathroom.While the parents, particularly himself, also enjoy having access to entertainment in the bathroom, he covers the camera out of concern for his children.

Vignette 6
Household 4-visit 6 Aaron: But for us I think that is, to me it is mainly just as long as the kids are not being filmed in a private way, there is not much else about my own privacy setting I actually care that much about.It becomes more of an abstract idea, that privacy rather than something I particularly want to keep, secrets.
These excerpts provide insights into Aaron's reasoning, which is to protect the children from being spied on and that privacy is an abstract idea that is not relevant in practice.In Aaron's consideration, "being filmed in a private way" is not in line with his overall parenting values, which involve protecting the children from such outside influences.

Outside the home
While household members could derive a sense of normalcy by observing others' interactions, the opportunity of non-household members to partake in this local process is naturally limited.Consequently, a sense of appropriateness of action is difficult to uphold when others come in contact.Several challenges are involved in dealing with people outside the home.
One particular challenge is the need to manage neighbors' expectations with regard to devices in relationship-appropriate ways.The parents in Household 1 find it necessary to inform their neighbors about their new smart security system which also overlooks parts of the neighbors' properties on two sides, a 'lady' and a young family they are friends with.Household 1 is also part of a neighborhood watch.

Vignette 7.1
Household 1 -visit 6 Jaco: it's our neighbors are happy as well, [. . .] Researcher: so you mentioned the cameras to them Jaco: yes of course Researcher: what did they say?Jaco: they say it was brilliant where did you get from and how Rosa: yeah we had to do it from a privacy point of view.Because they need to be aware of them being filmed Researcher: so you just let them know Jaco: no they were happy Rosa: yes they were happy because if something happens to the front of their house then you have the video The vignette illustrates two things: (1) it shows how Rosa and Jaco have coordinated their efforts to make the newly installed cameras accountable to their neighbors, since both consider this behavior as appropriate for neighbors (reflecting the moral order); ( 2) it shows a division of labor between the two adults (Jaco taking care of the more practical issues related to the system while Rosa helping with managing the work required to make the system work well in the community).Rosa uses phrases like 'had to' and 'need to be aware', signalling that she is oriented to mundane concerns of being a good neighbor and fully aware of what needs to be done in restoring accountability with their neighbors.Both partners contribute toward determining the right course of action and contribute different parts to implementing it.
The second part of the vignette shows how the neighbors started taking interest in Jaco's and Rosa's use of the security cameras by seeking confirmation of the ways in which the system is used.In demanding accounts from Jaco, they are able to gain a better understanding of what normally is to happen with the recordings.

Vignette 7.2
Household 1 -visit 6 Jaco: they keep asking 'did you see anything happening in the house' and I said 'I check everyday don't worry.If something is happening to your house, someone will knock your door or so' then it's recorded'.
Researcher: okay Jaco: so I'll tell them.They are asking and then I think the wife asked me once and the husband asked my twice.. and they said it's good because when you go on holiday then you don't have to worry about.It's good it's fine.I check everyday when I come from work The interactions provide a sense of normalcy for the neighbors.Their acceptance of the accounts also indicates Jaco's perceived competence of orienting to the purposes with others in gaining familiarity with devices, or they can refrain from doing so by containing the use of smart devices to their homely perimeters.Notably, household members' efforts towards the wider community are driven by a sense of 'we versus them,' which can lead to a sense of shared tasks and responsibilities (a shared role of being a good neighbor).Interactions with the wider community typically are occasional and thereby do not lend themselves to the establishment of normalcy in the same ways interactions between household members do.

Rules and Communal Use
In this section, we illustrate how the local moral order can shape the management of interpersonal relationships in the home and with the 'outside world'.We also show how this management can become more visible through rules.Rules do not exist to prescribe behaviors through role expectations because "morality is not simply a phenomenon attached to society that makes it run smoothly" (Hilbert, 1992).Instead, rules are employed by actors to achieve mundane ends (Hilbert, 1981).They are not devices to create order, but "devices invoked to account for order" (Crabtree et al., 2015).

For Children
Household members articulate rules to help each other interact 'appropriately' with respect to established goals and values or the moral order of the home.This is particularly visible among parents introducing rules to help their children.
For example, in Household 1, Rosa and Jaco have established that their daughter is not going to get access to the smart security camera feed despite her interest in watching her friends walking by and making funny faces at the camera.

Vignette 9
Household 1 -visit 8, edited Jaco: Yeah, that is why I would worry about it.Jaco: That is the kind of like when she is, like, she is not here we are talking to you, like, we talk to you but . . .Iria: But what is there to talk about?Jaco: Because when she is, one of her, if all three of ask, one of us delete the video, that is how we . . .Iria: No, they are just worried because everyone in our year, in my year literally knows where we live.And all the boys love to cycle past our house.And they will always knock and come and say, "Hello," to me, so they are just worried.I think it . . .Jaco: Well, as a father I'm always worried but it is even though you are a boy or you are a girl or it does not matter, they still are children.
The rule the parents have discussed beforehand ("daddy knows") establishes that Iria will not be given access because she "might delete videos".However, Iria reveals what this rule might actually be about, that her parents are worried "because everyone in [her] year [...] knows where [the family] lives".Jaco confirms this motivation ("as a father I'm always worried").
The daughter is considered not sufficiently competent to contribute to the management of hers and others' relationships in the digital world.The rule of 'not giving Iria access' serves to further the parenting goals, part of which is to assist the daughter with being able to independently manage personal relationships.The parents consider the smart security system to be an essential part of their parenting role, which is not reconcilable with the daughter's interest in using the system.
Jaco and Rosa in Household 1 also manage their children's access to the Echo Show 5 in the kitchen.At the beginning of one of our visits and before her two boys made their way into the kitchen, Rosa asked the researcher not to mention any keywords that can be used in interactions with the Echo Show 5 since the two boys had repeatedly played the same YouTube channel 11 .Clearly, the children are not expected to understand what constitutes appropriate use of the system.In the present study, their use is at times guided by rules and at other times regulated by limiting access.
Other rules have been established to manage the exposure of children to the digital world.In Household 2, wanting to protect their son from the world of brands and targeted advertising, Monique and Adam introduce their son to the Google Home with the keyword "Doogle" instead of "Google".Established between the adults for the benefit of their son, this rule for use shows the household's moral order, i.e., that they would like their son to grow up unaffected by targeted advertising and other influences from the online world (Adam, visit 2).The use of a nickname with the device would allow their son to disassociate the qualities of a voice assistant from its manufacturer's brand.
These mundane concerns related to the role of parenting.Parents' efforts are oriented to the local moral order of the household and children need to follow their parents' ordering of goals and values.Another example of rule invocation that reveals the moral order in relation to parenting and technology use is provided in the next vignette.
Mother Carrie and daughter Felicity in Household 3 jointly set up the Google Home device.They attempt to connect the Google Home app to their Google Home Hub Max, and subsequently want to set up music streaming.Prior to this excerpt, they have provided a nearby street when prompted for an address of their new device.The device is now asking for location permissions to be able to connect to other devices.
Felicity: Features and services?Carrie: It was more services, I think, if you had to choose.Felicity: Yeah.I thought I saw it.Go down.Music.Carrie: No.We are doing privacy at the moment, Felicity.
Rules are invoked by parents to establish moral order in the set-up and configuration of devices, providing meaning to their actions which might not be noticed by their children otherwise (Felicity: "The privacy is more important.").In the vignettes above and other examples, we see that this encompasses the management of relationships not only between household members but also with the online world (see also (Crabtree, Tolmie & Knight, 2017)).
Rules, however, do not always suffice in helping children learn about the moral order and orient their actions.Sometimes rules are implemented to actually restrict access, as implicated in the parents' reactions to Felicity's interest in setting up entertainment (Vignette 10) and Iria's plans to watch security camera recordings for fun (precursor to Vignette 9).Parents also limit their children's ability to use a device.For example, in Household 4, Malte struggles to manage his screen time, so that Aaron moved the Echo Show to a location where Malte could not use it.
While rules are articulated to teach the moral order to children, children are not always expected to exhibit the desired competence of acting according to that moral order.In these situations, parents reassert their values and goals of parenting in speech and action.

Between Adults
Moral order is established in shared experiences (past mistake of sharing) and articulated in rules.Rules between adults are rarely as clearly articulated, but they exist nonetheless.As Garfinkel shows us, the orderliness of everyday life is mostly unremarkable but becomes visible to us when it is breached, when background expectancies surface (Garfinkel, 1967).These rules are then applied to new situations.
In Household 6, Tobias and Sylvie are exploring which devices to acquire as part of the study.While discussing smart security cameras, they recall a past incident that influences their decision-making.Tobias had set up a webcam to watch their kitten in the kitchen while at work.His subsequent providing the web link to his mother so that she could also watch the kitten is described by Sylvie as inappropriate.Sylvie 'did not like' this and explicitly finds fault with Tobias.

Vignette 11
Household 6 -visit 2 Researcher: How about cameras outside or inside?Tobias: You will not find cameras inside?Sylvie: Oh, yes, that is because you used it inappropriately, though.Tobias rigged up a camera so that we could observe what the kitten was doing when we were not in, and we could access it using a web link, and Tobias gave the link to his mum.So his mum could then observe the cat plus us, whatever we were doing in the kitchen, and I did not like that but that was your fault.Tobias: Yeah, I shared the link.Sylvie: Yeah, but it was nice to be able to see the kitten.
Researcher: And then the camera went away?Sylvie: Yeah, and then the kitten started going outside and it was redundant.
Tobias relates to the past incident by implying a rule of 'no cameras insight' ("you will not find cameras inside?").Sylvie recounts the past incident where her mother-in-law has gained access without her knowledge.The incident had caused a discussion between the couple, and they refrained from choosing any security cameras for the study.
Outside the home, household members in our study have not established clear rules but provided information and insight as discussed in the previous section (Section 4.4.2).This sharing allows other community members to position themselves and their own needs against the circumstances of device use (e.g., the shared purpose of using a device to catch burglars and protect the neighborhood).
However, community members could allude to or highlight the applicability of 'rules' (as in laws and regulations) to challenge these circumstances as documented in the below.In such cases, rules are invoked by adults to highlight expectations of appropriateness that reflect the moral order.In Household 2, Monique narrates a situation where she found herself confronted by a neighbor, and her husband Adam comments on the issue.

Vignette 12
Household 2 -visit 7 Monique: So I was just with Eric and the neighbors were just going and he was saying, "Oh, it is interesting . . ." because I was telling him about how it is good for security as well as answering if you are not here . . .Monique: . . .say, "Hi, just leave it round the corner, I am going to be here in two minutes."And he said that we need to have a licence because he said, "You should check that it is not classed as CCTV . . ." Adam: Okay.Monique: ". . .and if it is then you need to have some kind of licence."Andalso, if you remember when we were burgled. . .

Summary
Our findings show how rules are used to highlight the meaning of interactions in relation to moral order, e.g., to show the ordering of values and goals to children or to establish appropriate use between adults.The meaning of interactions is in turn challenged by articulating rules.Parents use rules to support their children in managing their relationships in the physical and digital world.Note that these rules are essentially articulated not only to manage access to devices but also to attend to "higher-level matters" (Crabtree et al., 2015) related to concerns of parenting such as imparting values, protecting children from the online world, or helping them to regulate their screen time.This kind of moral and social order is established between adults in the home and finds its application in the articulation of rules pertaining to the use of smart devices.
To highlight the importance of the moral order, adults likewise use rules which are linked to households' past experiences or to societal agreements such as laws and regulations.However, it is equally important to acknowledge that rules are not established in prescriptive or generative ways.As adult members of the household are able to-and are expected to-orient their actions appropriately, restrictive use of rules between adults (as opposed to children) is often not evident.

Social Goals and Privacy
We return to the observation that participants' perspectives on privacy are bound up with other situational considerations, among which privacy is rarely an explicit reference.We then discuss everyday concerns and social goals prevalent in our study that can be linked to the concept of privacy.

The Importance of Everyday Concerns
As Aaron (Household 4) puts it: 'it becomes more of an abstract idea, that privacy rather than something I particularly want to keep, secrets.' (Vignette 6) When explicitly mentioned, the somewhat abstract concept of privacy requires further practical consideration and explanation: 'we had to [inform the neighbours] from a privacy point of view.Because they need to be aware of them being filmed.' (Vignette 7.1) The word itself is used to express aspects of a locally agreeable moral order, as this vignette of household 3 illustrates: In this sense, the word privacy becomes a vehicle to explicate a part of the local moral order which in turn manifests in the practical actions reported above.These practical actions (e.g., talking to the neighbor about the cameras) reflect everyday concerns.Privacy becomes wrapped up in these concerns but is rarely made explicit.
These insights presuppose our EM informed methodological orientation.Of course, the aforementioned quotes can be interpreted as 'privacy as secrecy' or 'control over information'.Further vignettes in this paper can be interpreted as occurrences of privacy conceptualizations such as the 'right to be let alone' or 'control over information' (e.g., Vignette 11) or 'limited access to the self' (Vignette 10).Similarly, one could draw on privacy theories.For example, Vignette 10 can be discussed as 'privacy as boundary work' and, in Household 2, Aaron's camera covering in the bathroom out of concern for his children illustrates 'privacy as contextual integrity'.These references reflect the multifaceted nature of a phenomenon that others have called a 'concept in disarray' (Solove, 2008) and researching it may invoke many different interpretations of the word (Barkhuus, 2012).Methodologically, these interpretations lead us astray from our goal to document how privacy manifests on the ground and to provide insights into observable and reportable practical action to inform design.Such interpretations may encourage us to label and gloss over a social phenomenon that is not often explicitly accounted for and hardly relatable or actionable.
Staying close to relatable and actionable considerations, we need to explore the everyday, social considerations that are reflected in household members' practical work.When the term privacy is used, it is appropriate in the context of everyday concerns related to parenting, being a good neighbor (Vignette 7.1), or not being followed around by someone (Vignette 10).We have also reported several other occasions in which privacy is not articulated as a concern but could be analytically categorized as privacy behaviors, e.g., not pointing security cameras at neighbors (Vignette 8), calling a device 'Doogle' to protect children from effects of brands (Household 2), or not tolerating cameras inside the home (Vignette 11).Taking the perspective of our participants, it becomes clear that they are not concerned with analytic or theoretical matters of privacy as much as with everyday concerns.

Managing Relationships and Expectations
Prior research has documented household members' concerns with everyday matters rather than the concept of privacy in other contexts (Jakobi et al., 2018;Crabtree, Tolmie & Knight, 2017;Dourish & Bell, 2011;Barkhuus, 2012).Our findings in the context of off-the-shelf products for the smart home corroborate with these insights.In attending to social goals, values, past experiences, a sense of normalcy, and societal norms, household members are rather concerned with the mundane matters described in the previous paragraph.They orient their actions to the moral order.Crabtree, Tolmie and Knight (2017) find that people are rather concerned with managing the "attack surface" of the digital world on the social when they made use of passwords for their personal computers or shared content on the online social networks.This preoccupation with 'managing relationships' (Crabtree, Tolmie & Knight, 2017)one's own relationships and those of others-is also evident in our households.
Household members employ a range of practical methods to "manage risks of particular cohorts"; and because of the qualities of smart home devices in our study, these can be seen as another variant of methods reported in (Crabtree, Tolmie & Knight, 2017).What we have observed is a range of methods that are partly established in the literature (e.g., camera covering) and others that emerge in reaction to relatively new interfaces (e.g., parents encouraging their child to call their Google Home devices "Doogle" instead of "Google").As we have pointed out, rules are frequently invoked by adults to articulate and account for the moral order to others (e.g., their children).
Our findings suggest a difference between household members' orientation inside the home and outside the home.Inside the home, the guidance provided by roles and rules is available to individuals in the ways described above but does not translate to relationship management outside the household.Participating families jointly contribute to efforts of relationship management, e.g., in their considerations of creating awareness among their neighbors (signified in the use of 'we' Vignette 3).This perspective can surface based on the assumption that household members become conversational with regard to their smart products.
We have described the work of our household members in terms of managing relationships as well as expectations.Expectations can be best described as anticipation of a sense of normalcy given a situation.Where household members anticipate that expectations might be unmet, they are concerned with managing them proactively.Hence, expectations are essentially about managing accountability of devices and interactions across the fluidity of who typically does what and to what end.Currently, neither perspective is well supported by design, and we suggest both be taken into consideration.

Informing the Design of Communal Privacy Experiences
Before we discuss our findings, it is important to recall that the scope of this study was to explore communal use and privacy 'healthy relationships' (Zeng & Roesner, 2019).We deliberately chose to sample families with two or more persons and spousal or parental relationships.We acknowledge that the nature of these relationships certainly influenced the ways in which families used devices, and we will provide directions for future research at the end of the paper.
Communal use requires household members' to orient their actions towards social goals and purposes, particularly also where considerations of privacy are bound up in these ends and goals.Where the design of devices curtails this ability, household members struggle to behave in relationship appropriate ways.Here, we discuss inherent limitations of system design and how they may be overcome to design for privacy and communal use.Table 2 provides an overview of these insights.Future research must rethink access control to meet these requirements, e.g. by considering approaches such as goal-oriented access control (Massacci & Nguyen, 2009).
Technical and social rules for technology use lack articulation, resulting in a missed opportunity to manage expectations • rules are not visible or self-explanatory but need to be explicated by community members • rules are explicated to share a community's moral and social order • rules cannot be articulated where there is a lack of agreement on higher level concerns Enable 'coordinate work' to manage expectations • design to foreground "activities that are relevant to rule use" • design for 'articulation work' to negotiate and communicate social goals • design to make members' (particularly privileged) interactions with devices socially accountable Leverage concepts and approaches from prior research for further investigation, e.g., on social translucence (Niemantsverdriet et al., 2016(Niemantsverdriet et al., , 2019)).Researchers and designers can consult work on UX and data protection, e.g., (Chen et al., 2019).More research is needed to enable regulatory action that enforces and applies privacy-by-design principles for communal contexts.

Enable users to follow social goals and purposes
Roles are not constructed by articulating expectations, as is the common understanding in the functionist role theory (actors conform to expectations to gain approval).
Neither are they prescriptive in an interactionist sense (role-taking to see the world with other's eyes) (Franks, 2007;Hilbert, 1981).In their discussion of a receptionist's role in a social work agency, Zimmerman (1970) argue that no set of constructed role expectations (job profiles) can sufficiently cover members' behavior, which encompasses a large array of contingencies.As Hilbert (1981) emphasizes, individuals always place their own interpretations on the enactment of role expectations (rules), such that they work around limitations while upholding the intended meaning of a role (Hilbert, 1981) (see also Jaco's reviewing the recordings at night in Vignette 5).
Competent 'role' behavior manifests in interactions where their meaning in relation to social goals becomes visible, i.e., the reflexive orientation of actions to the moral order, the social goals, or the purposes to which members ascribe.In Vignette 11, Tobias fails to meet Sylvie's expectations of the social goal implicated in the original intended use of a cat camera, i.e., to look after their pet.Sylvie's expectation is unmet when Tobias orients the social goal of nurturing the relationship with his mother instead.Part of being competent is also the ability to balance personal goals with those of the community.In Vignette 9, Iria is not given access to the security camera feed as she might delete videos which her parents preferred to keep in order to look out for her.Finally, where social goals are not coordinately established with the community, community members might orient to 'normative notions' of what they consider right and wrong within the wider community.For example, Frank demonstrates this competence in considering the effects of security camera usage on their neighborhood (Vignette 8).
Where devices limit the ways in which communal use can evolve, they are perceived as problematic.Roles are abstract but not in a generative sense (Button & Dourish, 1996;Dourish & Button, 1998), and rules are prescriptive but not definitive for roles (Hilbert, 1992).If design is suggestive of generative and restrictive ways of technology use, the resulting models are unlikely to be adopted.One such example is the access control models proposed in (Zeng & Roesner, 2019) but largely unused.Designers can draw on the framework presented above to take into account the dynamic and evolving nature of communal use.
Generally, access control models should not be built in ways that restrict future changes.For example, they should not be strictly limited to a single administration account.They also should not be restrictive in ways that curtail interactions contributing to the shared roles (e.g., maintenance of a system).While actions around the use of smart technology in the home might be "differentially organised" (Crabtree, Mortier et al., 2012), technology features should not restrict role actions but facilitate role establishment.
Everyday concerns and practical work documented in this article-particularly when shared by household members-offer an alternative orientation for design efforts.A possible first step is to enable 'moving in and out of roles'.We are not proposing to assign the same role simply to more users.Rather, we are suggesting that roles (and inherently permissions) be oriented to social purposes or goals.They need be designed in ways that accommodate competent behavior rather than behavior defined by a specific role.Alternate conceptualizations of access control models, such as goal-based access control (Massacci & Nguyen, 2009), are starting points for further research.For example, designs can guide users through processes of goal alignment and provide support for goal adherence in continued use12 .

Enable 'coordinate work' to manage expectations
Our insights on rules and moral order expand on existing literature.The differences in rules application and invocation observed between adults and children corroborate with (Crabtree et al., 2015) findings on home network policy use.The authors highlight that any articulation of rules makes explicit what is "deemed to be permissible" which itself may only be welcome in the management of specific activities and behaviors.Our insights on the use of smart security cameras and smart voice assistants support the notion that a clear articulation of rules is used to attend to 'higher level' parenting concerns (e.g., turning rules into parenting devices) (Crabtree et al., 2015).The hesitation we observed with regard to articulating rules outside the home is also reflected in (Crabtree et al., 2015) findings on the use of domestic network policy.The conversation Household 1 had with their neighbors (Vignette 7.1) supports (Crabtree et al., 2015) suggestion that creating awareness of "activities that are relevant to rule use" (letting the neighbors know what is happening in their environment) provides opportunity for appropriate action and can be an appropriate substitute where the articulation of rules is not permissible (Crabtree et al., 2015).However, we also highlight that the means by which household members could let members of the community 'know what is happening' are poorly supported by the current design of devices.Crabtree et al. (2015) suggests making the home network accountable to users, which remains an active research area (e.g., (Jakobi et al., 2018;Seymour et al., 2020)).
There is a need to design for coordinate work ('articulation work' (A.Strauss, 1985)) in order to support privacy in communal use (via (Crabtree et al., 2016))i.e., the various concerns with relationships and the management of expectations that guide practical action.In addition to designing for the management of relationships with and mediated by the online world (Crabtree, Tolmie & Knight, 2017), we suggest designing for coordinate work that contributes to the negotiation of social goals.Social negotiation and coordination between users contribute to the accountability of devices with all household members, answering questions such as what a device is designed to do, how it could be used, and how it is used by the community (Jakobi et al., 2018).We suggest this perspective can contribute to the rethinking of the approach to informational privacy and novel design patterns (Nouwens et al., 2020).
Our suggestion is to allow for members' interactions with a device, particularly when exercising privilege, to become socially accountable through technical mechanisms such as creating awareness of activities that contribute to role use (i.e., showing what is happening in an environment).This accountability is essential for other members to gauge whether interactions are naturally accountable to the moral order (i.e., if they are part of an activity coordinated between household members) and what purpose the activity serves.For example, windows stickers which disclose the operation of CCTV not only potentially deter burglars but also create awareness among community members.To integrate this kind of visibility into products, researchers have developed concepts and methods, among which is the concept of social translucence (Niemantsverdriet et al., 2016(Niemantsverdriet et al., , 2019)).The concept and a related framework are centered around the idea of translucence in interactions with the system-i.e., helping users to coordinate their use of the system by creating accountability with limited visibility.Our findings suggest that-for 'healthy' relationships at least-such insights might be conducive to reducing privacy issues and coordinating related management efforts13 .

Rethink privacy-by-design for communal use
Manufacturers are obliged to seek users' consent by transparently documenting their data collection and processing practices in light of specific purposes (European Commission, 2016).This transparency requirement is usually satisfied in privacy policies and through the use of notice and consent frameworks.However, both face a lot of criticism in the single user context (Nouwens et al., 2020;Cate, 2010;C. Jensen & Potts, 2004;Obar & Oeldorf-Hirsch, 2018-07;Schaub et al., 2015;Luger et al., 2013;Luger & Rosner, 2017;Luger & Rodden, 2013).The criticism includes: (1) the setup of devices requires a degree of practical reasoning that is largely unwelcome and even infeasible (e.g., reading privacy policies); (2) permission request models/patterns (pre-installation and/or during ongoing use) fail to take into account the situational (contextual, temporal, and occasioned) nature of preferences; and (3) the framework suggests the management of privacy could be an individual's exercise whilst the literature highlights the importance of the social (e.g., networked privacy in online social networks).
When it comes to smart technologies in communal use, these issues are amplified.We have found that: (1) individual challenges are fuelled by individuals aiming to manage others' accountability to the digital world; (2) 'privacy preferences' are rarely oriented to by individuals or the community, and only requested prior to or during installation as opposed to at the time of use; and (3) the configurations are to be performed by a single individual, providing little to no (technical or social) accountability to other users.Furthermore, based on a secondary analysis of the here reported data set, consent is dynamic in that people desire to grant, amend, and revoke consent at different points in time (Chalhoub et al., 2021).Relatedly, Speed and Luger (2019) raise questions on consent given by those not actively or implicitly involved in the set-up and configuration of devices.As for devices without graphical user interfaces, other means are necessary to inform their users.It has also been pointed out that interactions with devices are not always deliberate and voluntary (Speed & Luger, 2019).
These 'notice and consent' challenges in the realms of the internet of things/smart home have long been anticipated (Luger & Rodden, 2013).Researchers have called on the community to fundamentally rethink the underlying approach to informational privacy and for novel design patterns (Nouwens et al., 2020).Our insights into privacy in communal use highlight a misalignment of the technical interpretation of purpose by manufacturers and that by their customers.Off-the-shelf smart home devices typically embody an orientation of purpose to the regulatory requirements of data collection and processing.As our study shows and our framework of communal use illustrates, households tend to orient toward everyday concerns of being good parents, a good neighbor, a good spouse, or a good child.Household members' orientation toward the purpose of device use becomes part of this social and moral order.The technical purposes found in smart devices are not naturally linked to household members' mundane concerns with managing relationships or expectations (see also (Crabtree, Tolmie & Knight, 2017)).Instead, they become "more of an abstract idea, that privacy rather than something I particularly want to keep, secrets" (Aaron, Household 4).
This misalignment between household goals and product designers' efforts to seek privacy as compliance must also be noted.To comply with data protection legislation, a lawful basis for data collection and processing practices must be established.We suggest that privacy-by-design according to users' social goals and everyday con-cerns can help reduce the gap between users' expectations of data processing and manufacturers practices, and we hope to explore this opportunity in future research.

Conclusion
The goal of this paper is to investigate the on-the-ground relationship between communal use and privacy.To this end, we have presented a grounded analysis based on a synergistic relationship between an ethnomethodologically-informed study and a grounded theory approach.The study of six households' experiences with smart devices has offered an account of the organization of communal use in terms of interaction, roles, moral order, and rules.With regard to privacy, we have expanded on prior work (Crabtree, Lodge et al., 2017) by highlighting members' orientation toward relationships and the management of expectations rather than their preoccupation with privacy or 'control over information'.We have illustrated how our participants' concern of managing their relationships with and within the digital world is a coordinated and sometimes distributed effort in the organization of communal use.We have discussed how roles and rules are constructed in this context, suggesting that the relationship of these concepts be reconsidered in light of relevant system design.Finally, we have discussed implications for the design of communal privacy experiences to overcome some of the challenges identified.The implications highlight an opportunity to accommodate the 'sociality of work' for devices to be more 'transparent and accountable' in order to become an essential part of the moral order.We believe this orientation can help us address, not avoid, a broad array of privacy issues.
However, more work is needed.Our study focussed on familial relationships in the UK.As discussed throughout the paper, the work by Crabtree, Tolmie and Knight (2017) on privacy in the home is closely related to our findings.Their work compares households in the UK and France using a related methodological approach and finds no noteworthy differences.By their insight and argument, we expect our findings to be applicable to other cultural contexts, but future work should validate this assumption.Similarly, our findings should be discussed for different forms of cohabitation and different kinds of relationships.More research is needed to evaluate and enrich these findings in light of 'unhealthy relationships' or 'intimate threats' where power imbalances do exist (e.g.Levy & Schneier, 2020;Leitão, 2019).The framework presented in this paper might not cover all dynamics that exist in these households and should be extended in future research.Finally, the framework presents related sensitizing concepts and is useful to inform design discussions.However, to easily operationalize the framework, future research should develop a 'boundary object' (Star & Griesemer, 1989) around the framework.Boundary objects facilitate discussions over values, practices, and politics implicated in systems and their developments.

Figure 2 :
Figure2: Overview of the analytic process including quotations with initial codes (white), focused codes as observable social processes (green), implicit social processes as candidate categories (pink), and theoretical codes (purple).The figure also illustrates the use of sensitizing concepts (blue).

Figure 3 :
Figure 3: The Social organization of Communal Use Carrie: Because I do not really want somebody following me around where I am going all the time.Okay.Felicity: 'Settings', 'location'.What do we do?[...] Carrie: Yeah.Let me do the privacy thing first.Felicity: The privacy is more important.(Vignette 10)

Figure A7 :
Figure A7: Recruitment information page : Well, so what is it what you can do on Android?Aaron: All the things like changing the video quality and all that . . .Yeah, it's not always deliberate, with Alexa Show it was, with Alexa Show I did say you have to link it to my account and I'm, you know, but with this that was just accidental.With the lights I think you've got a bit more . . .

Table 2 :
Implications for the design of communal privacy experiences