Why exhibits are a privacy question
A gallery interactive looks harmless. A visitor touches a screen, watches a video, perhaps plays a game. But many exhibits are built from the same parts as ordinary consumer technology: cameras, microphones, network connections, software that writes logs. Each of those parts can record something about a person, often without anyone deciding that it should.
Privacy in an exhibit is not only about secrets. It is about whether people can visit a public place, including children and people who would rather not be tracked, without being recorded, identified or profiled in ways they did not expect. Museums also tend to be trusted institutions, and that trust is worth protecting.
The rules that apply differ by country and region, and they change. Treat this article as general orientation rather than legal advice, and check requirements with someone qualified where you operate.
What exhibits can collect
It helps to list the possibilities, because the risk is often in the parts nobody thought about.
- Images and video. Cameras used for gesture input, face-based effects, “take a photo with the exhibit” stations, or simple people counting.
- Audio. Microphones for voice interfaces, recording stations, or conversational exhibits that process what a visitor says.
- Typed or spoken contributions. Names, messages, comments and drawings left on a screen.
- Interaction logs. Which button was touched, in what order, and when. On its own this is usually anonymous, but timestamps combined with a camera feed or a ticket scan can point to a person.
- Device signals. Wi-Fi or Bluetooth identifiers from phones, which can be used to count or follow devices around a building.
- Accounts and tickets. Membership numbers, email addresses for sending a result to yourself, or loyalty cards linked to an exhibit.
- Accessibility settings. If a visitor chooses large text or audio support and the choice is stored, that can reveal something about their health or abilities.
Start with the question, not the sensor
The most effective privacy step happens before anything is built. Ask what you actually need to know, and whether the exhibit really needs the data to work.
Many exhibits do not. A gesture exhibit may need to detect movement in the moment, but not to keep any image. A people counter may need only a number, not a recording. Gesture interaction can often be designed so the camera feed is processed on the device and discarded immediately, with nothing saved.
A useful rule is data minimization: collect only what serves a stated purpose, keep it only as long as that purpose lasts, and then delete it. If nobody can explain why a data field exists, it is a candidate for removal.
Design choices that reduce risk
Process locally and discard. If a camera or microphone is needed for the interaction, handle the signal inside the exhibit computer and do not write it to disk or send it elsewhere unless that is the point of the exhibit.
Keep logs anonymous. Record that a button was pressed, not who pressed it. Avoid logging names, free-text entries or device identifiers when counts will do. When people do plan to study use, reading exhibit analytics carefully matters partly because a log designed for convenience can hold more than you meant it to.
Use short retention. Decide in advance how long any data is kept and set it to delete automatically. “We might need it later” is not a purpose.
Separate identity from activity. If a visitor enters an email address to receive a souvenir, store it for that single delivery rather than attaching it to the rest of their activity.
Make the private option easy. Let visitors use the exhibit without signing in, uploading a photo or agreeing to recording. An exhibit that works fully without personal data is the strongest privacy design there is.
Be careful with phones and networks
Connecting an exhibit to a visitor’s phone changes the picture. When visitor phones act as a second screen, the exhibit may touch a personal device. Ask what the web page or app requests, such as location or camera access, and whether it truly needs those permissions. Third-party scripts embedded in a web page, such as analytics or embedded video, can send visitor information to outside companies, often without the museum noticing.
Wi-Fi and Bluetooth counting is another area where a well-meant idea can become tracking, because device identifiers can follow a person across a building and across visits. If you count devices, ask whether a simple door counter would answer the same question. Network design matters too, and good exhibit networks keep public-facing systems separate from any systems that hold staff or member records.
Children and vulnerable visitors
Children are especially sensitive. Rules about collecting information from minors are often stricter than for adults, and a child cannot meaningfully agree to being recorded. Exhibits aimed at young children are best designed to collect no personal data at all. Take similar care with exhibits in settings such as memorials or health-related displays, where even knowing that someone visited could be sensitive.
Tell people what is happening
Where anything is recorded, say so clearly, in plain language and at the point of use: what is captured, why, how long it is kept, and who to ask about it. Notices buried in a policy page do not count as meaningful notice for a visitor standing at a screen. Plain language helps here, and signs should be readable by people with low vision and in the languages your visitors use. Consent for filming and photographing is its own topic with its own signage questions, and it matters whenever a camera is pointed at people rather than at an object.
Operations and accountability
Privacy often fails during ordinary operations, not during design. Someone leaves a test recording on a laptop. A supplier keeps a copy of data after the contract ends. A contribution station fills with offensive or personal posts nobody reviews. If your exhibit accepts public contributions, decide who moderates them and how a person can ask to have something removed.
A few habits help:
- Keep a short written list of every data type each exhibit collects, where it goes and when it is deleted.
- Include privacy terms when you choose outside suppliers, including what happens to data when the contract ends.
- Brief front-of-house colleagues so they can answer a visitor’s question with confidence; staff training is the usual place to do this.
- Review the list whenever content is updated, since new features often bring new data.
- Have a plan for a data incident, including who decides and who is told.
A reasonable standard
No exhibit can promise zero risk, and requirements vary by place. A sound working standard is simple: collect the least you can, keep it for the shortest time, tell people honestly what happens, and let them say no without losing the experience. Exhibits designed that way are usually easier to run as well, because there is less to secure, less to explain and less to go wrong.