Standard · EDO v1.0 Draft

Ethical Device Operations

Five things a consumer device must never do: smart TVs, streaming boxes, speakers, cameras, toys, appliances and in-car systems, and the software that runs them.

Certify a repo against EDO Read EDO.md Try in sandbox

GitHub publication is waiting on Rex. This link serves the Markdown file in the repo.

Badge a passing repository earns example badge

+------------------------------------------+
|  .----------------------.   ASC  EDO     |
|  |  [ ]  ETHICAL   [o]  |   v1.0         |
|  |   DEVICE OPERATIONS  |                |
|  '----------.-----------'   PASS  5/5    |
|           _|_|_                          |
|  demo-tv/firmware@9f3c2a1                           |
|  sha256:4b1e07c2a9d3   2026-11-04                 |
+------------------------------------------+

Inscription: not yet (Draft) · policyRef: sha256 of EDO.md

A consumer device shall never do

Rule	What it means, and the evidence the jury reads	Weight
EDO-01	MUST NOT listen or watch without a visible indicator. Microphone and camera capture paths turn on a light or on-screen indicator in the same code path; no background capture. Evidence: permission manifests (RECORD_AUDIO, CAMERA, entitlements), capture call sites, indicator code	critical
EDO-02	MUST NOT profile the owner from what they watch, say or do without opt-in. Automatic content recognition, screen fingerprinting and voice profiling are off by default and gated by an explicit opt-in. Evidence: SDK dependencies, default settings, consent screens	critical
EDO-03	MUST NOT sell or share personal data without opt-in. No ad-tech or data-broker SDK sends identifiers before consent; consent is recorded. Evidence: network endpoints, SDK list, consent checks before calls	critical
EDO-04	MUST NOT require an account or internet for basic functions. Power, inputs, volume, local playback and setup work with no network and no sign-in. Evidence: setup flow, network-required guards	normal
EDO-05	MUST NOT remotely remove features the owner paid for. No server-controlled kill switch or flag disables shipped core features; updates don't remove them. Evidence: remote config and feature-flag clients, update scripts	normal

Critical rules weigh 3, others 1. PASS needs no fail and no needs-evidence, with at least 60% of the weight checkable from code.

Proposed for v1.1

Injecting ads into HDMI and other inputs; dark patterns in consent; no published security-update end date; no data export and delete; hidden automated decisions about the owner; tracking or manipulating children.

Changelog

- 1.0 (2026-11-04): first draft.