.png)
Checking your messages, traveling to work, paying for lunch, and watching television can all create records about you. Some come from services you choose to use, but others come from cameras, connected devices, and systems operating around you.
So how much personal data could an ordinary day generate?
Web3 Foundation’s white paper, Everyday Surveillance: What One Ordinary Day May Reveal About You, explores that question through six model households in the United Kingdom and United States. It examines what published privacy policies, technical materials and other evidence indicate could be collected, generated or inferred during a 24-hour period.
The findings show how everyday activities can produce information about our health, movements, money, relationships and habits. They also reveal the reading burden attached to understanding what organizations say they may do with that information: for one model family, around 83 hours.
A digital footprint includes more than the information you deliberately share online. A fitness tracker generates measurements, a quick payment creates a transaction record, while a camera may capture you as you walk. Other information can be inferred from the records those activities produce.
The paper distinguishes between three forms of information:
These distinctions matter. You might supply an address or upload a photograph yourself. A service might also record when you use it, combine information from other sources, or infer something about your interests and likely behavior.
The study follows a working adult living alone, a family with two children, and an older adult living independently in the UK and US. These are evidence-based scenarios, rather than observations of real people or national averages. A documented permission establishes what an organization says it may do; it does not prove that every permitted action happens.
The modeled routines involve work, travel, shopping, communication, entertainment, and household tasks. Across the six scenarios, between 44 and 88 organizations are linked to the day and its associated data flows.
In the UK working-adult scenario, the day includes approximately 271 modeled processing events, alongside more than 1,100 possible body and health measurements. Potential camera captures are estimated separately, at between 60 and 190.
The different measures describe different things. One payment, one heart-rate reading, and one camera image cannot tell us the same amount about a person. Keeping them separate makes the findings more useful than combining everything into a single headline total.
Television is one of the clearest examples of how a familiar activity can produce a large stream of observations as Automatic Content Recognition, or ACR, identifies content appearing on a smart TV screen using signatures or fingerprints. Viewing information can contribute to a profile of the programs and advertisements associated with a household.
The paper assumes Samsung’s relevant Viewing Information Services are enabled and uses a modeling interval of approximately one observation every half-second. On that basis, three hours of viewing produces around 21,600 potential observations.
That interval requires care. The methodology uses a rate alleged in a Texas Attorney General petition; it is not a confirmed measurement of the model households or a rate Samsung has publicly confirmed. Samsung describes its technology as generating content signatures and says it does not record or watch the content displayed on the television.
The paper’s headline totals depend heavily on this assumption. Removing ACR observations reduces the four single-adult daily observation floors to approximately 1,100, 1,000, zero and zero respectively. Other exposures, including camera captures, remain separately reported. Product settings and opt-outs also affect the potential footprint.
The documents are available, but understanding the terms attached to an ordinary day can require substantial time.
For the model family in Leeds, the study’s reading roster contains 257 documents and almost 1.19 million words. At the study’s assumed reading speed of 238 words per minute, that amounts to around 83 hours, or more than ten eight-hour working days.
Across all six household rosters, the estimated reading burden ranges from 37 to 83 hours. These figures measure the time needed to read the included material. They do not measure whether people actually read or understood it. The paper highlights the importance of that burden when people are expected to make informed choices about data use across numerous services, each with its own documents and permissions.
The paper examines more than collection. It also records additional uses described in organizations’ documents.
Across the 143 organizations examined:
Separately, at least 35 contain an affirmative statement that user data may be used to train or improve AI or machine-learning systems. These findings reflect the documentation examined, not proof that every practice applies to every user. A document without a fixed retention period does not establish that an organization keeps every record forever.
The findings nevertheless help explain why the purpose of an initial interaction may be only one part of its potential data relationship.
School systems, cameras and connected services also appear in the family scenarios. In the UK model, 25 of the 88 organizations have documents indicating that they may collect information relating to the children. The scenario includes around 100 potential school-camera captures in a day, and 11,400 logged keystrokes across a school week, including text that may be deleted or never sent.
Those are different time periods and different forms of information, but both illustrate why a household’s potential footprint extends beyond the apps its members actively choose. Furthermore, the paper highlights that children have limited practical choice over the systems their schools use, making privacy protections in those systems particularly important.
Many of the systems examined serve useful purposes, including healthcare, safety, payments and public administration. The research raises a design question: how much information does each service actually need? An age check may need to establish that someone is over 18 without retaining their full date of birth or a copy of an identity document. Other services may be able to verify an entitlement or answer a specific question without receiving the complete underlying records.
The paper proposes clearer, narrower permissions, fewer unnecessary copies and ways to reuse proofs without creating a permanent identifier that makes activity across services easier to link. It also calls for extra protection where people have less practical choice, particularly children and older people.
Web3 approaches could help address parts of this problem by giving people greater control over how information is disclosed and verified. They cannot prevent every camera or connected device from creating a record. Assess their value against the specific privacy problem a system is designed to solve.
The white paper sets out the six household routines, evidence, calculations and limitations in detail. The Your Day in Data questionnaire offers another way to explore the subject through everyday habits.
Read the research
Explore the full findings and methodology in Everyday Surveillance: What One Ordinary Day May Reveal About You.
Explore your day in data
Try our questionnaire to explore how everyday activities connect to the data issues examined in the research.
© 2026 Web3 Foundation. All rights reserved.
.png)
