Ambient Light Sensor

1. Introduction

The Ambient Light Sensor extends the Generic Sensor API [GENERIC-SENSOR] to provide information about ambient light levels, as detected by the device’s main light detector, in terms of lux units.

1.1. Scope

This document specifies an API designed for use cases which require fine grained illuminance data, with low latency, and possibly sampled at high frequencies.

Common use cases relying on a small set of illuminance values, such as styling webpages according to contrast level or preferred color scheme that may be influenced by a device’s measured ambient light level are best served by the the prefers-contrast and prefers-color-scheme CSS media features [MEDIAQUERIES-5] as well as the accompanying matchMedia API [CSSOM-VIEW-1] and are out of scope of this API.

Note: The [MEDIAQUERIES-5] specification used to contain a light-level media feature that was more directly tied to ambient light readings. It has since been dropped from the specification in favor of the higher-level prefers-color-scheme and prefers-contrast media features.

2. Examples

const sensor = new AmbientLightSensor();
sensor.onreading = () => console.log(sensor.illuminance);
sensor.onerror = event => console.log(event.error.name, event.error.message);
sensor.start();

navigator.permissions.query({ name: 'ambient-light-sensor' }).then(result => {
    if (result.state === 'denied') {
        console.log('Permission to use ambient light sensor is denied.');
        return;
    }

    const als = new AmbientLightSensor({frequency: 20});
    als.addEventListener('activate', () => console.log('Ready to measure EV.'));
    als.addEventListener('error', event => console.log(`Error: ${event.error.name}`));
    als.addEventListener('reading', () => {
        // Defaut ISO value.
        const ISO = 100;
        // Incident-light calibration constant.
        const C = 250;

        let EV = Math.round(Math.log2((als.illuminance * ISO) / C));
        console.log(`Exposure Value (EV) is: ${EV}`);
    });

    als.start();
});

const als = new AmbientLightSensor();

als.onreading = () => {
    let str = luxToWorkplaceLevel(als.illuminance);
    if (str) {
        console.log(`Light level is suitable for: ${str}.`);
    }
};

als.start();

function luxToWorkplaceLevel(lux) {
    if (lux > 20 && lux < 100) {
        return 'public areas, short visits';
    } else if (lux > 100 && lux < 150) {
        return 'occasionally performed visual tasks';
    } else if (lux > 150 && lux < 250) {
        return 'easy office work, classes, homes, theaters';
    } else if (lux > 250 && lux < 500) {
        return 'normal office work, groceries, laboratories';
    } else if (lux > 500 && lux < 1000) {
        return 'mechanical workshops, drawing, supermarkets';
    } else if (lux > 1000 && lux < 5000) {
        return 'detailed drawing work, visual tasks of low contrast';
    }

    return;
}

3. Security and Privacy Considerations

Ambient Light Sensor provides information about lighting conditions near the device environment. Potential privacy risks include:

• Profiling. Ambient Light Sensor can leak information about user’s use patterns and surrounding. This information can be used to enhance user profiling and behavioral analysis.

• Cross-device linking. Two devices can access web sites that include the same third-party script that correlates lighting levels over time.

• Cross-device communication. A simple broadcast communication method can use device screen or camera LED flashes to broadcast messages read out with an Ambient Light Sensor in a close by device.

• Cross-origin leaks. Light emitted from the screen can be reflected back to the sensor from nearby reflective surfaces. Malicious sites can embed resources from different origins and scale the content to display particular pixels to allow distinguishing the contents, pixel by pixel.

• Hijacking browsing history. Styling visited links to allow distinguishing the light levels associated with visited and unvisited links i.e. visited links styled as a block of black screen; white for unvisited.

Works such as [ALSPRIVACYANALYSIS], [PINSKIMMINGVIASENSOR], [STEALINGSENSITIVEDATA], [VIDEORECOGNITIONAMBIENTLIGHT], and [IMAGINGPRIVACY] delve further into these issues.

To mitigate these threats specific to Ambient Light Sensor, user agents must reduce accuracy of sensor readings. User agents may also limit maximum sampling frequency.

These mitigation strategies complement the generic mitigations defined in the Generic Sensor API [GENERIC-SENSOR].

3.1. Reducing sensor readings accuracy

In order to reduce accuracy of sensor readings, this specification defines a threshold check algorithm (the ambient light threshold check algorithm) and a reading quantization algorithm (the ambient light reading quantization algorithm).

These algorithms make use of the illuminance rounding multiple and the illuminance threshold value. Implementations must adhere to the following requirements for their values:

• The illuminance rounding multiple must be at least 50 lux.

• The illuminance threshold value should be at least half of the illuminance rounding multiple.

Note: Choosing an illuminance rounding multiple requires balancing not exposing readouts that are too precise while also providing readouts that are still useful for API users. The value of 50 lux as a minimum for the illuminance rounding multiple was determined in GitHub issue #13 after different ambient light level measurements under different lighting conditions were gathered and shown to thwart the attack described in [STEALINGSENSITIVEDATA]. 50 lux is also higher than the 5 lux required to make video recognition using ambient light sensor readings ([VIDEORECOGNITIONAMBIENTLIGHT]) infeasible.

Note: The illuminance threshold value is used to prevent leaking the fact that readings are hovering around a particular value but getting quantized to different values. For example, if illuminance rounding multiple is 50, this prevents switching the illuminance value between 0 and 50 if the raw readouts switch between 24 and 26. The efficacy of the threshold check algorithm as an auxiliary fingerprinting mitigation strategy has not been mathematically proven, but it has been added to this specification based on implementation experience. Chromium bug 1332536 and Chromium review 3666917 contain more information about this.

4. Model

The Ambient Light Sensor sensor type’s associated Sensor subclass is the AmbientLightSensor class.

The Ambient Light Sensor has a default sensor, which is the device’s main light detector.

The Ambient Light Sensor is a powerful feature that is identified by the name "ambient-light-sensor", which is also its associated sensor permission name. Its permission revocation algorithm is the result of calling the generic sensor permission revocation algorithm with "ambient-light-sensor".

The Ambient Light Sensor is a policy-controlled feature identified by the string "ambient-light-sensor". Its default allowlist is 'self'.

The Ambient Light Sensor has a virtual sensor type, which is "ambient-light".

The current light level or illuminance is a value that represents the ambient light level around the hosting device. Its unit is the lux (lx) [SI].

Note: The precise lux value reported by different devices in the same light can be different, due to differences in detection method, sensor construction, etc.

The Ambient Light Sensor has an illuminance rounding multiple, measured in lux, which represents a number whose multiples the illuminance readings will be rounded up to.

The Ambient Light Sensor has an illuminance threshold value, measured in lux, which is used in the ambient light threshold check algorithm.

Note: see § 3.1 Reducing sensor readings accuracy for minimum requirements for the values described above.

5. API

5.1. The AmbientLightSensor Interface

[SecureContext, Exposed=Window]
interface AmbientLightSensor : Sensor {
  constructor(optional SensorOptions sensorOptions = {});
  readonly attribute double? illuminance;
};

To construct an AmbientLightSensor object the user agent must invoke the construct an ambient light sensor object abstract operation.

5.1.1. The illuminance attribute

The illuminance getter steps are:

1. Let illuminance be the result of invoking get value from latest reading with this and "illuminance" as arguments.

2. Return illuminance.

6. Abstract Operations

6.1. Construct an ambient light sensor object

6.2. Ambient light threshold check algorithm

The Ambient Light Sensor sensor type defines the following threshold check algorithm:

Note: This algorithm invokes the ambient light reading quantization algorithm to ensure that readings that round up to the same value do not trigger an update in the main update latest reading algorithm. Not doing so would indicate to users that the raw illuminance readings are within a range where they differ by at least the illuminance threshold value but do not round up to different illuminance rounding multiple.

6.3. Ambient light reading quantization algorithm

The Ambient Light Sensor sensor type defines the following reading quantization algorithm:

7. Automation

This section extends Generic Sensor API § 9 Automation by providing Ambient Light Sensor-specific virtual sensor metadata.

The per-type virtual sensor metadata map must have the following entry:

key

"ambient-light"

value

A virtual sensor metadata whose reading parsing algorithm is illuminance reading parsing algorithm.

8. Use Cases and Requirements

• A Web application provides input for a smart home system to control lighting.

• A Web application checks whether light level at work space is sufficient.

• A Web application calculates settings for a camera with manual controls (aperture, shutter speed, ISO).

• A Web application checks the current light level to determine whether a camera stream will contain data that is accurate enough for its purposes (e.g. human presence verification).

While some of the use cases may benefit from obtaining precise ambient light measurements, the use cases that convert ambient light level fluctuations to user input events would benefit from higher sampling frequencies.

9. Acknowledgements

Doug Turner for the initial prototype and Marcos Caceres for the test suite.

Paul Bakaus for the LightLevelSensor idea.

Mikhail Pozdnyakov and Alexander Shalamov for the use cases and requirements.

Lukasz Olejnik for the privacy risk assessment.