Your router already senses you: Wi-Fi sensing and privacy at the FuSo Brown Bag Talk

On 13 October 2026, Bruno Rodrigues gave the talk Wi-Fi Sensing and Privacy: Uses and Misuses of CSI and Beamforming Feedback in the Brown Bag Talk series of FuSo, the Future Society Hub at the University of St. Gallen, where technology, law, and society meet.

Download the slides (PDF)

One measurement, two readings: the signal that raises a fall alert for someone living alone can also profile a household’s routine. What differs is who holds the data and who agreed.

Your router already senses you. To decode a packet, every Wi-Fi receiver first measures how the signal travelled: directly, off walls, through people. That measurement changes whenever someone moves, breathes, or types, and no new hardware is needed. The feedback that Wi-Fi 5 and later devices send back to the router is unencrypted, so any nearby radio can read it. Since August 2026 Comcast ships motion sensing on millions of home gateways, Rogers keeps seven days of motion history, and Deutsche Telekom has field-tested it on its Speedport routers. The fine print allows motion data to be handed over on a subpoena or sold in de-identified form “for any purpose”.

From presence to identity. Research has climbed the ladder: presence through walls, hand gestures, breathing rate, taps on a phone, and, in a 2025 study from KIT, which of 197 people is walking, with near-perfect accuracy. A privacy fix was proposed while the IEEE 802.11bf sensing standard was written, and rejected.

The inference ladder, from presence to identity: the further right, the more personal, and most of it works from feedback that any nearby radio can capture.

What our testbed shows, and what it does not. The group’s apartment deployment, 20 ESP32 boards and 380 links, decides occupancy every ten seconds from the Wi-Fi channel alone, and a low-cost receiver overheard 97% of the sounding requests at a lab router. But motion is the easy part: a person sitting still looks like an empty room, and an early breathing detector “confirmed” breathing in an empty home 21 times out of 27. Claims of capability and claims of privacy both need tests.

Use or misuse, same measurement. A fall alert or heating that follows occupancy on one side; profiling routines, evidence in a dispute, or checking from outside whether anyone is home on the other. The law has not caught up: EU and Swiss rules arguably reach the provider, nothing reaches the outsider, and nobody asks the visitor. In Kyllo v. United States (2001), a thermal camera pointed at a home was a search “at least where the technology is not in general public use”. Wi-Fi sensing now ships in millions of routers.

The testbed work builds on OpenCSI and the group’s passive sensing and privacy research areas. The full reference list is in the slides.