In December 2025, tenants in a San Francisco high-rise sued their landlord and the vendor behind the building’s smart-home stack, arguing they had been forced to accept in-unit surveillance as a condition of living there. The case names digital door locks, thermostats, and leak sensors as the instruments of that surveillance.
It is a serious test of whether an intercom, a lock, and a wall thermostat can, together, function as an unlawful monitoring system inside someone’s home.
Anyone who specifies these systems for a living should pay attention. The device on the wall is no longer only a doorbell. It’s a data source, a legal record, and a piece of evidence.
What Is the Intercom Actually Recording?
A modern building intercom is a small networked computer with a camera, a microphone, and a link to a property-management platform. Each interaction produces a record. Some of what it captures is obvious; much of it isn’t.
- Entry events. Timestamped logs of every unlock, buzz-in, and denied attempt, usually tied to a named resident or a credential ID.
- Video and audio. Short clips of visitors at the door, and in many systems, the resident’s side of the conversation.
- Guest patterns. Who visits, how often, at what hours, and whether they were let in by the resident or a neighbor.
- Device metadata. The phone, tablet, or fob used to authenticate, plus the IP address and, sometimes, location data from the resident’s app.
None of that reads as sensitive on its own. Stitch it together over a year and it becomes a behavioral portrait: work schedule, romantic life, medical visits, political meetings, immigration status of guests. That’s the part designers rarely see when they pick a product off a spec sheet.
Who Can Actually See This Data?
More people than the resident expects can see this data. Property managers can typically pull logs on demand. The vendor keeps a copy on its own cloud infrastructure. Contractors doing maintenance sometimes get read access. And law enforcement can request the data straight from the manufacturer, often without the resident ever knowing.
A Brennan Center report maps the pathways police use to pull information out of connected home devices: through the user, through the manufacturer, or through a compelled disclosure backed by a warrant or subpoena. Retention periods vary wildly by vendor, and disclosure practices are inconsistent. The resident is almost never the one deciding what gets kept and for how long.
Why This Lands on an Architect’s Desk
Because the specification is where the data posture of the building gets set. The choice between a system that records audio and one that doesn’t, between a vendor that retains footage for 30 days and one that holds it for two years, between on-prem storage and third-party cloud, is a design decision made long before a resident signs a lease. That decision then constrains what the operator can promise, what the resident can refuse, and what a court can later compel.
Consent language on a lease addendum can’t undo a hardware choice. If the camera runs continuously, no amount of signage makes that fact go away. Architects and interior designers who treat access control as a low-voltage afterthought are, in practice, drafting the building’s privacy policy without reading it.
Design Teams Should Move Now
- Ask the vendor what data leaves the building, and get the answer in writing. If audio, video, or location data crosses to a third-party cloud, know that before you spec it.
- Insist on configurable retention. A system that lets the operator delete footage on a short cycle is meaningfully safer than one that defaults to indefinite storage.
- Give residents a real opt-out. A physical buzzer, a fob, or a PIN entry path that doesn’t require an app account works as a legal safety valve, not a nostalgia feature.
- Document the choices. When a resident later complains, or a plaintiff’s firm sends a preservation letter, the design record is what will show whether the specification was reasonable at the time.
- Loop in counsel earlier than feels necessary. Privacy law, credit reporting law, and debt collection law all touch data that flows out of a smart building, and firms that handle consumer protection cases are seeing more disputes trace back to records generated by building systems, not by the resident.
The Intercom Is Now Part of the Building’s Legal Surface
The device at the front door produces records that outlive the resident’s tenancy, travel to parties the resident never met, and can be summoned into a courtroom years later. Design teams don’t have to become privacy lawyers. They do have to stop pretending the intercom is only a doorbell.
