1. A computer-implemented method, comprising: changing a privacy state of a privacy indicator to indicate that environmental data that is generated by a physical sensor is not being transmitted over a network or stored outside of a trusted portion of memory; while the privacy state of the privacy indicator indicates that the environmental data that is generated by the sensor is not being transmitted over the network or stored outside of the trusted portion of memory, receiving a command to access the environmental data that is generated by the sensor; determining that the command is not permitted without first indicating on the privacy indicator that the environmental data that is generated by the sensor is permitted to be transmitted over the network or stored outside of the trusted portion of memory, by a privacy policy that restricts performance of commands that involve transmission of environmental data over the network or storage of environmental data outside of the trusted portion of memory, wherein determining that the command is not permitted comprises verifying a digital signature associated with the command; and based on the determining that the command is not permitted by the privacy policy that restricts performance of commands that involve transmission of environmental data over the network or storage of environmental data outside of the trusted portion of memory, changing the privacy state of the privacy indicator to indicate that the environmental data that is generated by the sensor is permitted to be transmitted over the network or stored outside of the trusted portion of memory.