Chapter 5 — Privacy and data protection: design alternatives | Postgraduate Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Privacy and data protection: design alternatives

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 The consent problem"]
  N2["5.2 Alternatives"]
  N3["5.3 Behavioural insight"]
  N4["5.4 Choosing what to test"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 The consent problem"]
  N2["5.2 Alternatives"]
  N3["5.3 Behavioural insight"]
  N4["5.4 Choosing what to test"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 The consent problem]
    |
    v
[5.2 Alternatives]
    |
    v
[5.3 Behavioural insight]
    |
    v
[5.4 Choosing what to test]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) generate alternatives for a consent interface; (2) evaluate alternatives against law and user behaviour; (3) choose an alternative for testing.

5.1 The consent problem

Corvina's app asks customers to accept marketing cookies and personalised offers. The current banner shows a large Accept button and a small link to settings. Article 5(3) of the ePrivacy Directive requires consent for non-essential cookies, and EDPB Guidelines 05/2020 say consent must be freely given and as easy to refuse as to give. Priscila suspects the design nudges customers. She sets out to design alternatives and test them properly. Design A shows a large Accept button and hides refusal behind a settings link, which EDPB Guidelines 05/2020 treat as a warning sign.

5.2 Alternatives

Priscila's team designs three alternatives: A, the current banner; B, a banner with Accept all and Reject all buttons of equal size and colour, plus settings; C, a layered choice with separate toggles for analytics and marketing, all off by default. She evaluates each against legal criteria and expected user experience. A likely fails the equal-ease criterion. B and C both appear compliant. C gives more granular choice but takes longer. She records each design's screenshots and criteria in the test plan so reviewers can see exactly what customers saw.

5.3 Behavioural insight

Acquisti, Brandimarte and Loewenstein (2015) describe how defaults and framing influence privacy choices. Priscila expects acceptance to fall under B and C, because the design no longer pushes acceptance. She notes that a fall in acceptance is not a failure: it means choices reflect customers' preferences more accurately. The marketing team worries about fewer consents. She argues that consents obtained by nudging are fragile, both legally and in customer trust. A consent that customers regret leads to withdrawals, complaints and possibly regulatory scrutiny, so a lower acceptance rate may be the more valuable result.

5.4 Choosing what to test

Priscila chooses to test A against B, because B is the minimal change likely to achieve compliance and is easy to implement. C will be considered later if B performs well. She defines outcomes: acceptance rate and withdrawals within ninety days as a measure of regret. She writes a test plan with sample sizes and an analysis method, so that the decision will rest on evidence rather than opinion. She chooses A against B because B is the simplest compliant design and C needs more engineering work.

Worked example

Priscila designs three consent banners, judges the current one non-compliant on equal ease of refusal, explains why lower acceptance is acceptable and chooses an A/B test of the current banner against equal buttons.

Synthetic case. Banners are synthetic; ePrivacy Directive Article 5(3), EDPB Guidelines 05/2020 and Acquisti et al. (2015) are real.

Errors and limits

Banner tests measure behaviour, not understanding; add comprehension checks if possible.

Exercises

EX021 — Banner A problem. Why does banner A likely fail? Rubric: 3 = refusing is harder than accepting;; 2 = mentions ease;; 1 = compliant;; 0 = none.
EX022 — Lower acceptance. Why is a fall in acceptance not a failure? Rubric: 3 = choices reflect real preferences; nudged consents are fragile;; 2 = mentions preferences;; 1 = is failure;; 0 = none.
EX023 — Why test B. Why test B rather than C first? Rubric: 3 = minimal change likely compliant and easy to implement;; 2 = mentions simplicity;; 1 = random;; 0 = none.
EX024 — Regret measure. What outcome measures regret? Rubric: 3 = withdrawals within ninety days;; 2 = mentions withdrawals;; 1 = vague;; 0 = none.
EX025 — Cookie consent law. Which provision requires consent for non-essential cookies? Rubric: 3 = ePrivacy Directive Article 5(3);; 2 = mentions ePrivacy;; 1 = GDPR only;; 0 = none.

Synthesis

Chapter 5 designs alternatives. Chapter 6 evaluates them in a controlled test.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →