The data you collect is other people's, and the law and ethics follow it

A consent form is a receipt for a conversation. It records that a participant was told something and agreed. It is filed when the study closes. The obligations it stands for do not close with it. What a study may collect is fixed by the setting the participant was in. What it may keep depends on whether the data can still be traced to a person. What it may hand on is governed by law written for institutions, not projects.

This ninth of ten units, after the eighth built the research infrastructure, argues that consent, privacy and data protection are design constraints rather than paperwork around a method. They bind before the first interview and stay attached to the data after the last one.

A signature is the weakest part of the warrant

Luger, Moran and Rodden (2013) asked what consent actually secures. They analysed the terms and conditions through which consent is obtained. They found them frequently complex and unreadable, which they take to place the validity of informed consent in doubt. Making a page accessible can encourage agreement, masking the complexity of the terms instead of resolving it.

Acquisti, Brandimarte and Loewenstein (2015) reviewed the empirical work on privacy. They found that people are uncertain about the consequences of their privacy decisions and about their own preferences over them. Concern depends on context, and commercial and governmental interests can mould it. A signed form cannot be read as a stable statement of what a person wants done with their data, and a form drafted to be legally complete may sit beyond the reading level of the person who signs it.

What may be collected is decided by the norms of the setting

Nissenbaum (2004) supplies the benchmark. Contextual integrity holds that privacy is not secrecy but the appropriate flow of information given the norms of the context in which it was shared. It judges a flow by five things: the context, the type of information, the roles of those receiving it, their relationship to the person, and the terms of any further transfer.

Contextual integrity ties adequate protection for privacy to norms of specific contexts, demanding that information gathering and dissemination be appropriate to that context and obey the governing norms of distribution within it. (Nissenbaum, 2004)

Solove (2006) makes the companion point that privacy names a family of harms rather than one. His taxonomy separates information collection, processing, dissemination and invasion. It argues that each requires a different response. A form that promises privacy in the abstract promises what it cannot specify. The specification must name which harm is prevented and which remains.

De-identification does not end the obligation

The familiar escape is to remove identifiers. Ohm (2010) reviewed the re-identification research that defeated nominally anonymous datasets and argued that the promise of anonymisation cannot be kept. His charge is that law and practice rely on deleting identifiers anyway.

For the practitioner the consequence is a limit on what may be claimed. A statement that a dataset is anonymous is an empirical claim about that dataset together with every other file that might be joined to it. Where the claim rests on a technique rather than a test, the risk has not been removed but moved out of sight.

The law follows the data past the end of the study

Peloquin and colleagues (2020) described the difficulties the General Data Protection Regulation created for secondary research use and argued that the disruption is avoidable rather than necessary. The law has since moved in one jurisdiction. The Data (Use and Access) Act 2025 amends the United Kingdom's data protection regime to treat scientific research as including commercial work, to allow consent for broad areas of related research, and to treat further processing for research as compatible with the original purpose. That answers part of Peloquin's complaint, though commencement is staged and the safeguards are untested. A study that cannot lawfully share its data has produced an asset only its own team may use.

Ethics is conducted during the study, not only approved before it

If the constraints are this specific, one approval cannot carry them. Frauenberger, Rauhala and Fitzpatrick (2016) argue that HCI's methods became situated, value-driven and participatory while ethics stayed a static, anticipatory formality. They propose in-action ethics to link anticipatory review with the conduct of research. Munteanu and colleagues (2015) report the field version. They describe the difficulties formal review creates for studies of interactive systems in difficult settings with vulnerable users. They draft recommendations to make the process workable.

Shilton (2012) offers the constructive move from inside a laboratory. She argues that particular design practices act as values levers which surface ethical questions the standard process leaves unexamined. Using those levers deliberately builds ethics into design. Bruckman (2014) gives the HCI frame: the constraint is met by conduct, in what is asked, what is recorded, and what is stopped when a session goes badly.

The obligation follows what you build, not only what you collect

The last extension is uncomfortable for the profession. The practice that governs a study's own data decisions is the practice that governs the interfaces others meet later. Zhang-Kennedy, Keleher and Valiquette (2024) interviewed 23 design practitioners about privacy dark patterns made by other designers, and found empathetic rationales for those intentions, including the theme that the designer followed the status quo.

Dark patterns have been counted. Mathur and colleagues (2019) crawled the product pages of about 11,000 shopping websites with automated techniques, then had experts classify what the crawler found. They identified 1,818 instances on 1,254 sites, grouped into 15 types, with 183 sites carrying messages the team judged deceptive. The more heavily trafficked sites were the more likely to use them. The crawl covered shopping sites and the classification ran over a hand-reviewed sample, so the figures bound the practice rather than the whole web.

The constraints described above are not enforced by a signature, a repository or a review board. They are held or lost in ordinary practice.

Contested question: is the constraint in the data, or in the law?

The literature agrees that data carry obligations past the end of a project. It disagrees about where those obligations come from, which decides whether reform can dissolve them. One position holds the constraint to be a property of the information itself. Nissenbaum (2004) grounds it in the norms of the context in which information was shared. Moving data to a new purpose can therefore violate privacy even when nobody is identified. Ohm (2010) grounds it in residual identifiability, which deleting names does not remove.

A second position holds the binding constraint to be legal and removable. Peloquin and colleagues (2020) treat the obstacles to secondary use as an artefact of how the regulation was drafted rather than of the ethics. They argue that the disruption is avoidable. A better permission regime, on that account, would let research reuse the data without ethical loss.

A third position makes the constraint a matter of weighing. Beauchamp (2016) sets out respect for autonomy, nonmaleficence, beneficence and justice as a common morality. That morality has to be specified and balanced in each case rather than applied as a rule. The obligation is real, but its strength varies with the case. That is neither the inherent view nor the removable one.

What would settle the disagreement is evidence on two questions: whether a de-identified dataset can be shared at a re-identification risk that is measured rather than asserted, and whether secondary use under a revised permission regime still respects the norms of the setting the data came from. Neither finding appears in this unit's list, and a professional states a position rather than assuming one.

The three positions rest on different kinds of evidence. Nissenbaum and Ohm reason from law and re-identification studies, Peloquin and colleagues read one regulation's drafting, and Beauchamp states a moral framework rather than a finding. None measures a de-identification risk. While the dispute is open, a designer should record what a setting licenses and leave a de-identified dataset open to challenge rather than certified. The strongest objection is that this over-reads the constraint, because much secondary research uses data lawfully and well.

Where the argument is heading

The direction of travel is from approval towards audit and training. Petrie (2025) treats ethics as an audit conducted across the stages of a study, from recruitment and consent through participants' activities to debriefing, and argues that the available codes are formulated too abstractly to guide practice. Zhang-Kennedy and colleagues (2024) point the same way from the practitioner side, asking what shapes design practice rather than what rules it. The claim still waiting for evidence is whether an audit discipline changes what studies collect and keep, or only how convincingly they describe it.

The sources this unit rests on

• Acquisti, A., Brandimarte, L. and Loewenstein, G. (2015). Privacy and human behaviour in the age of information. doi:10.1126/science.aaa1465 (the published title spells that word in the American form) Reviews the empirical research on privacy around three themes: uncertainty about privacy's consequences, the context-dependence of concern, and the malleability of concern by commercial and governmental interests. Grounds the claim that a signed form is not a stable preference.
• Beauchamp, T. L. (2016). The Principles of Biomedical Ethics as Universal Principles. In Intercultural Dialogue in Bioethics. doi:10.1142/9781786340481_0004 Sets out respect for autonomy, nonmaleficence, beneficence and justice as a common morality that must be specified and balanced in each case. Carries the third position in the contested question, that the strength of an obligation varies with the case.
• Brandimarte, L., Acquisti, A. and Loewenstein, G. (2013). Misplaced confidences: privacy and the control paradox. Social Psychological and Personality Science. doi:10.1177/1948550612455931 Found that increasing participants' perceived control over the release of their information increased their willingness to disclose sensitive material, leaving them more exposed. The primary experiment behind the claim that consent is not a stable statement of preference.
• Bruckman, A. (2014). Research Ethics and HCI. In Ways of Knowing in HCI. doi:10.1007/978-1-4939-0378-8_18 Reviews the ethical challenges created by HCI's expansion into every part of human activity, including the complications of online research, and supports researchers preparing a case for review. Carries the unit's account of what review is for.
• Data (Use and Access) Act 2025, c. 18. https://www.legislation.gov.uk/ukpga/2025/18 Amends UK data protection law to treat scientific research as including commercial work, to permit consent for broad areas of related research and to treat further processing for research as compatible with the original purpose. One jurisdiction, and it eases rather than removes the constraint.
• Frauenberger, C., Rauhala, M. and Fitzpatrick, G. (2016). In-Action Ethics. Interacting with Computers. doi:10.1093/iwc/iww024 Argues that HCI methods became situated, value-driven and participatory while ethics stayed a static, anticipatory formality, and proposes in-action ethics to link review with conduct. Carries the claim that approval cannot cover what a study meets in the field.
• Luger, E., Moran, S. and Rodden, T. (2013). Consent for all. CHI 2013. doi:10.1145/2470654.2481371 Analysed the terms and conditions through which consent is obtained and found them frequently complex and unreadable, placing the validity of informed consent in doubt. Carries the claim that a signed form is weak evidence of understanding.
• Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M. and Narayanan, A. (2019). Dark Patterns at Scale. Proceedings of the ACM on Human-Computer Interaction. doi:10.1145/3359183 Crawled about 53,000 product pages from about 11,000 shopping websites, finding 1,818 dark pattern instances on 1,254 sites, 183 sites carrying deceptive messages and 22 third parties selling patterns as turnkey products. Bounds the practice rather than the whole web.
• Munteanu, C., Molyneaux, H., Moncur, W., Romero, M., O'Donnell, S. and Vines, J. (2015). Situational Ethics. CHI 2015. doi:10.1145/2702123.2702481 Reports the difficulties formal ethics review creates for studies of interactive systems in difficult settings with vulnerable users, and drafts recommendations for making the process workable. Carries the evidence that the formal process can obstruct ethical conduct.
• Nissenbaum, H. (2004). Privacy as Contextual Integrity. Washington Law Review. https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10/ Sets out contextual integrity, that privacy is the appropriate flow of information given the norms of the context in which it was shared, judged by the context, the information, the roles and the terms of transfer. Carries the benchmark for what may be collected.
• Ohm, P. (2010). Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization. UCLA Law Review. https://www.uclalawreview.org/broken-promises-of-privacy-responding-to-the-surprising-failure-of-anonymization-2/ Reviews the re-identification research that defeated nominally anonymous datasets and argues that the promise of anonymisation cannot be kept, criticising the reliance of law and practice on deleting identifiers.
• Peloquin, D., DiMaio, M., Bierer, B. and Barnes, M. (2020). Disruptive and avoidable: GDPR challenges to secondary research uses of data. European Journal of Human Genetics. doi:10.1038/s41431-020-0596-x Describes the difficulties the General Data Protection Regulation created for secondary research use of data and biospecimens, and argues that the disruption is avoidable rather than necessary. Carries the position that the binding constraint is legal and removable.
• Petrie, H. (2025). The Ethics of Conducting Research with Human Participants in HCI. In Handbook of Human Computer Interaction. doi:10.1007/978-3-319-27648-9_86-1 Argues that the available codes are too abstract to guide practice and proposes an ethical audit running through recruitment, consent, the participants' activities and debriefing. Calls for clearer guidelines on online research and better training for new researchers.
• Shilton, K. (2012). Values Levers: Building Ethics into Design. Science, Technology, and Human Values. doi:10.1177/0162243912436985 Reports an ethnography of a laboratory engineering location-tracking software, arguing that particular design practices act as values levers which surface ethical questions the standard process leaves unexamined. Carries the constructive claim about building ethics into design.
• Solove, D. J. (2006). A Taxonomy of Privacy. University of Pennsylvania Law Review. doi:10.2307/40041279 Argues that privacy is too vague a concept to guide law and builds a taxonomy separating information collection, processing, dissemination and invasion, showing that the harms need different responses.
• Zhang-Kennedy, L., Keleher, M. and Valiquette, M. (2024). Navigating the Gray: Design Practitioners' Perceptions Toward the Implementation of Privacy Dark Patterns. Proceedings of the ACM on Human-Computer Interaction. doi:10.1145/3637374 Interviewed 23 design practitioners about the privacy dark patterns made by other designers, finding empathetic rationales for those intentions and the theme of following the status quo.