In ambient mode, HomeView's OS gets 3 identity fields and never sees the room

Apple says HomeView's operating system never sees the room in ambient mode, only 3 fields about who is in it. That moves the privacy question from access to raw footage to control over identification.

Apple built HomeView so that, in ambient mode, its operating system can know who walked into the room without seeing the room. Apple says the main system receives 3 fields in each recognition result: a person identifier, a position and a confidence level. Raw footage and sound stay inside.

Count the flow. Two inputs, face and voice, go into one match score. Three fields come out. In ambient mode, zero frames or sound clips reach the main system. The Identity Firewall keeps biometric inputs inside the exclaves while letting the operating system act on identity metadata in ambient mode. In ambient mode, Apple's design limits raw-feed exposure but leaves a second privacy problem: what software can do with identity results.

The firewall holds in ambient mode, on Apple's own account

HomeView was announced on 13 Oct. Apple's Security Research post of 12 Nov, 30 days later and one day before the $299 device ships, adds the plumbing. Camera frames go to a camera exclave. Audio goes to audio exclaves. A Neural Engine exclave builds face and voice prints. A recognition exclave matches them to up to six enrolled people and "combines the face and voice identification" into a single score.

Apple says data processed in an exclave "cannot be accessed by the main operating system, apps, or Apple". Only the metadata, "person identifier, position, and confidence level", returns to the recognition daemon.

A separate notification tells the main system that a person may be present, with no image or audio. The catch is that the firewall is a claim about one mode. Apple describes two modes. In ambient mode only specific metadata is shared. In active mode, full sensor data is released to the main system behind a secure indicator. HomeView uses an LED run by the Exclave Indicator Controller. Apple gives the Siri case on iPhone a minimum of three seconds on screen and states no LED duration for HomeView.

Three fields still add up to a record of who is home

If stored or correlated, those identity results could turn household personalization into a record of who was present and when. No photograph is needed to log who was in the kitchen at 7pm, if anything keeps those results.

The post says raw data is discarded once processing completes. It is silent on how bystanders and guests are handled, and on whether the main system may store the three fields.

Isolation limits raw sensor exposure in ambient mode, but it does not settle whether identity results can be retained, correlated or used without consent. Apple does add a gate on personal content. Its launch release says Messages and Calendar content appears only when the enrolled user is recognised by face and the paired iPhone or iPad is present and recently unlocked.

CTOL's reading is that this gate also ties the household display to an Apple phone or tablet. Consent for being identified is still the open part. A recognised face alone does not open calendar entries, but it is one of the conditions for the person Apple enrolled. A guest who never enrolled has no stated place in that design.

HomeView extends Touch ID's wall from one owner to six people who do nothing

Apple's 2013 iPhone 5s release said fingerprint data was "encrypted and stored securely in the Secure Enclave inside the A7 chip". That was Apple's first hardware wall around a biometric, 13 years ago. Touch ID and HomeView both isolate biometric evidence, but they differ in two ways. Touch ID needed a deliberate touch from one owner. HomeView identifies up to six people who do nothing at all.

Google's Nest Hub Max, launched on 9 Sep 2019 at $229, drew the privacy line elsewhere. Google's help page says it analyses camera images "without sending those images to Google". Put differently, that is a promise about the cloud. Apple's claim is about the device itself, where in ambient mode its own operating system is denied the images. That $70 sticker-price gap accompanies two different privacy promises: Google's no-upload assurance and Apple's claimed barrier within the device.

Who controls identification is the test, and Apple's post leaves it open

The post names Calendar, Messages, Apple Music and compatible third-party audio and video apps from an iPhone as the consumers of the identity result. It does not say who decides when a person is identified, or what those consumers may keep. That is the question the 3-field boundary raises and does not answer.

The scope is narrow. Ambient mode shares only specific metadata. Active mode releases full sensor data to the main system behind a secure indicator. The post commits to the first design and describes the second. It does not tie the identity fields to a retention limit, a guest rule or a consent step.

Private Cloud Compute is an analogy for what outside checking can look like, not a schedule for HomeView. Apple said on 10 Jun 2024 that PCC software would be published within 90 days of entering a transparency log. It released research tools on 24 Oct 2024, 136 days after the architecture post on CTOL's arithmetic.

The exclaves post makes no commitment to a bounty, research tooling or outside verification, and the audits it mentions are Apple's own. Its qualifications point the same way. Formal verification was applied step by step, and Apple writes "we do not claim complete coverage of all aspects of the kernel".

Its line that Exclaves are "the most advanced architecture for ambient sensing in the industry" comes with no comparison. The launch release listed "the user" among those unable to reach the data. The later post lists the main system, apps and Apple.

Apple's own qualifications make independent testing central to whether the Identity Firewall is more than a published design claim. The stronger test is whether independent researchers can reproduce or refute the 3-field boundary. The same goes for the indicator-gated move from ambient to active mode, with or without Apple-provided tools. Raw-data isolation can be tested. Who may keep and use the identity result is the part Apple has not yet described.