Shuichiro Ogawa
日本語

Notes · updated 2026-10-24 · Markdown

What Can Designers Do, and Where Can They Add Value, as Personal Data Breaches Continue? (Academic Research)

This note examines what designers can do about continuing personal data breaches and where they can add value, drawing on 36 works from usable security and privacy research (SOUPS, CHI, USENIX Security, IEEE S&P, PoPETs, CSCW) and research on design ethics.

Contents (7)
  1. The question and the scope of this note
  2. Are users the weak link?
  3. Where on screens and in procedures has a design been shown to work?
  4. Consent screens and dark patterns
  5. What obstructs designers themselves?
  6. Where does designers’ added value lie?
  7. What research has not yet answered

The question and the scope of this note

When information security is discussed, designers tend to be cast in a supporting role. Cryptography, vulnerabilities, and access control belong to engineers, and designers are often assumed to receive the task of placing screens over mechanisms that have already been decided. Research on usable security and usable privacy, however, has argued the opposite for more than 25 years. It holds that many of the places where security mechanisms fail are the places where people touch those mechanisms, and that these places are objects of design.

This note examines what designers (UX/UI, service, and product designers) can do about data breaches and privacy problems, and how they can add value there, within the range of academic research. The question is divided into three parts. Are users really the weak link? Where on screens and in procedures has a given design been shown to work? Under what conditions that obstruct this work do designers themselves operate? From the answer to the third question, the note considers where added value lies. An account based on public documents and practitioner statements is in the industry counterpart, What Can Designers Do, and Where Can They Add Value, as Personal Data Breaches Continue? (Industry Sources).

The note draws on 36 works: peer-reviewed papers on usable security and privacy (SOUPS, CHI, USENIX Security, IEEE S&P, PoPETs, CSCW), research on design ethics and practice, and papers on arXiv whose acceptance is stated. Papers whose full text could not be obtained (for example, because the ACM site refused retrieval) are treated only within the range of their abstracts, and the text states “according to the abstract” in those cases.

Security has long held that people are the weakest link. In 1999, Adams and Sasse changed the direction of this view. According to the abstract, they argued that because security mechanisms are designed, implemented, applied, and breached by people, human factors must be considered in their design, and that attackers pay more attention to the human link than security designers do (Adams and Sasse 1999, abstract).

In 2009, Herley argued that users reject security advice not out of laziness but because doing so is economically rational (Herley 2009). Advice protects users from the direct costs of attacks but imposes the indirect cost of effort on everyone. In Herley’s estimate, if users spent one minute a day reading URLs to avoid phishing, the cost of that time would be two orders of magnitude greater than all phishing losses. He also wrote that 100% of certificate error warnings appear to be false positives. Advice that imposes a daily task on everyone to spare 0.01% of people a modest annual harm does not pay.

Cranor clarified the responsibility on the designers’ side with a framework for analyzing failures in systems that include people (Cranor 2008). She wrote that, whenever possible, designers of secure systems should find ways of keeping humans out of the loop, and that for tasks with no feasible alternative to humans, they should build systems so that humans can perform their roles well. The framework treats the human as a receiver who processes communications and checks, in turn, the points where failure can occur, such as communications that do not arrive, are not understood, or meet no motivation.

Zimmermann and Renaud analyzed how government, industry, and hackers conceptualize the problem, questioned the assumption that people are the source of the problem, and proposed “Cybersecurity, Differently”, which treats well-intentioned people as contributors to the solution (Zimmermann and Renaud 2019).

The research so far rejects the weak-link view as a restatement of design failure. Before asking people to be careful, it asks whether a design can avoid requiring people to make a judgment and, if a judgment is required, whether the design can support it. This is the very question of designers’ work.

Where on screens and in procedures has a design been shown to work?

Research first gathered around warnings. Dhamija and colleagues asked 22 participants to judge whether 20 websites were genuine, and reported that 23% did not look at the address bar or security indicators and that these participants made incorrect choices 40% of the time (Dhamija et al. 2006, abstract). From a survey of 409 people and an experiment with 100 participants, Sunshine and colleagues concluded that, although SSL warnings can be improved, a better approach may be to minimize the number of warnings by blocking unsafe connections and eliminating warnings in benign situations (Sunshine et al. 2009). Akhawe and Felt measured 25 million warning impressions in browsers and reported that users continued through about a tenth of Firefox’s malware and phishing warnings and 70.2% of Chrome’s SSL warnings (Akhawe and Felt 2013). The rate at which users clicked through varied widely with the construction of the warning.

Research that redesigned warnings showed that comprehension and behavior are different things. Felt and colleagues redesigned Chrome’s SSL warning following the recommendations of warning research; they did not reach the goal of improving comprehension, but nearly 30% more users overall chose to remain safe (Felt et al. 2015). The authors attributed this to “opinionated design”, which visually promotes the safe choice, and the proposal shipped as Chrome’s warning. Reeder and colleagues asked more than 6,000 people, at the moment they saw real warnings, for their reasons; the reasons were many and varied with context, and no single dominant failure such as habituation was found (Reeder et al. 2018, abstract). Improving warnings becomes a matter of resolving small contextual misunderstandings one at a time.

In authentication, the reasons that a technology for eliminating passwords does not spread were investigated from the organizations’ side. Lassak and colleagues interviewed 28 people, including CISOs and authentication staff, and identified account recovery, user friction, technical issues, regulatory requirements, and security culture as barriers to deploying passkeys (Lassak et al. 2024). Among these, account recovery is a flow problem of how to bring back users who have lost their keys, and it is an object of design.

Research on notices and labels showed the range of design choices for communication. Schaub and colleagues presented a design space that organizes privacy notices along four dimensions: timing, channel, modality, and the control options a notice provides (Schaub et al. 2015). Zhang and colleagues interviewed 24 iPhone users and reported that iOS privacy labels produced misunderstanding and dissatisfaction because of their confusing structure, unfamiliar terms, and disconnection from permission settings (Zhang et al. 2022). Zou and colleagues analyzed 161 breach notifications sent by companies; according to the abstract, the notifications were long and required advanced reading skills, downplayed the likelihood of being affected and the risks, buried the recommended actions in lengthy paragraphs, and gave little information on the urgency or priority of actions (Zou et al. 2019, abstract). Habib and colleagues asked 24 participants to find email opt-outs and data deletion on nine websites; options in account settings pages were easier to use than those in privacy policies, but many participants still consulted help pages or sent requests for assistance (Habib et al. 2020, abstract).

Consent screens are where research has shown most clearly that design moves decisions substantially. Utz and colleagues ran three experiments with more than 80,000 users on a German website and reported that, given a binary choice, more users accepted tracking than when they chose by purpose or by vendor (Utz et al. 2019). Nouwens and colleagues showed that, among 680 of the top 10,000 UK websites that used consent management platforms, only 11.8% met the minimal requirements of EU law (Nouwens et al. 2020). In the experiment in the same study, removing the reject button from the first page increased consent by 22 to 23 percentage points, and placing more granular controls on the first page decreased consent by 8 to 20 percentage points. Habib and colleagues inspected 191 consent interfaces against five dark pattern heuristics and compared 12 variants in an experiment with 1,109 participants; according to the abstract, a fully blocking consent interface with in-line cookie options and a persistent button for later changing the decision best met several design objectives (Habib et al. 2022, abstract). In an experiment with 3,947 participants in France, Bielova and colleagues reported that a “bright pattern” highlighting the decline option had a substantial effect on decisions, and that the effect of the design persisted in later choices on neutral banners (Bielova et al. 2024).

Research on consent screens shows two things at once. The construction of the screen moves consent rates by tens of percentage points. That same force can also be used in the direction that protects users.

Dark patterns are not limited to individual screens. Mathur and colleagues found 1,818 dark pattern instances of 15 types on about 53,000 product pages of about 11,000 shopping websites, and reported that 183 websites used deceptive practices and that 22 third parties offered dark patterns as turnkey solutions (Mathur et al. 2019). In a separate paper, Mathur and colleagues drew on psychology, economics, ethics, philosophy, and law to articulate normative perspectives for evaluating dark patterns, and showed a path for measurement that goes beyond subjective criticism of interfaces (Mathur et al. 2021). Gray and colleagues integrated 10 taxonomies from regulators and researchers into an ontology that defines 64 types at three levels, so that research, regulation, and practice can share a vocabulary (Gray et al. 2024).

What obstructs designers themselves?

Research on dark patterns began to question designers as the people who make them. Gray and colleagues analyzed examples of dark patterns identified by practitioners; according to the abstract, they showed that diverse ethical issues were conflated under a single term and that there was a shared concern that UX designers could easily become complicit in manipulative practices (Gray et al. 2018, abstract).

Designers’ ethical judgments are not determined by individual conscience alone. From observations and interviews with three practitioners, Gray and Chivukula described how organizational practices, personal ethical principles, and the characteristics of specific projects mediate ethical judgment (Gray and Chivukula 2019, abstract). From interviews with 11 practitioners, Chivukula and colleagues identified five dimensions that influence ethical outcomes across individual, collaborative, and methodological framings (Chivukula et al. 2020, abstract). In interviews with UX practitioners in New Zealand, Beattie and colleagues reported, according to the abstract, that designers try to act ethically following their “moral compasses” but are constrained by commercial pressure and the limited purview of their projects. Their understanding of ethics did not match the judgments of researchers, and the authors proposed independent regulation and ethics education (Beattie et al. 2024, abstract).

Designers can also be tolerant of other designers’ dark patterns. Zhang-Kennedy and colleagues showed 23 practitioners privacy dark patterns made by others and reported, according to the abstract, that participants offered sympathetic explanations such as “the designer followed the status quo”, and that these interpretations influenced their own practices (Zhang-Kennedy et al. 2024, abstract). Nelissen and Funk had 33 design students and professional designers design privacy UX for fictional clients, and showed that designers easily crossed ethical boundaries, even their own, and could rationalize dark patterns (Nelissen and Funk 2022).

In security, designers are sometimes not brought in at all. Chalhoub and colleagues interviewed 20 people at three companies building smart home cameras and reported that UX was used for innovative privacy solutions but not for security, because established, tried-and-tested solutions were demanded (Chalhoub et al. 2020). Chalhoub and Flechais studied users, designers, and business leaders, and reported that designers and business leaders had difficulty finding and applying suitable data protection practices and settled for “discount data protection” made of shortcuts and heuristics (Chalhoub and Flechais 2022). From interviews with 25 people, including developers and designers, Gutfleisch and colleagues showed that whether usable security ends up in products depends on context: stakeholder pressure, the presence of expertise, and collaboration culture (Gutfleisch et al. 2022). Hadar and colleagues reported that developers approached privacy problems with the vocabulary of data security, which narrowed their understanding of privacy to threats from outside the organization (Hadar et al. 2018). If developers frame privacy this way, the role of bringing in privacy as users see it is left to someone else in the organization.

Where does designers’ added value lie?

Alongside research on obstructing conditions, there is research on people who advocate for values. Tahaei and colleagues interviewed 12 people who advocate for privacy in software teams; according to the abstract, the barriers were a negative privacy culture, competing priorities, limited tools, unclear evaluation metrics, and technical complexity, and the advocates used informal discussions, management support, communication among stakeholders, and documentation and guidelines (Tahaei et al. 2021, abstract). Code reviews and practical training were perceived as more instructive than general awareness training. From interviews with UX professionals at large US technology companies and observations at UX meetups, Wong identified tactics aimed at three goals: creating space for UX expertise to address values, making values visible to other stakeholders, and changing organizational processes (Wong 2021). Wong characterized these tactics as “soft” resistance that relies on the logics of the industry, but argued that they can still produce value-oriented change. Yao and colleagues interviewed 12 UI/UX designers who advocate for privacy, and reported that the designers prioritized privacy while negotiating with business goals, teams, and technical constraints, including the statement that, although it was not a requirement, “We wanted to do better than the law” (Yao et al. 2026). From interviews with 15 experts and the literature, Maloku and colleagues compiled 14 design considerations and 14 factors for privacy in UI/UX into a pattern catalog (Maloku et al. 2026).

Wong and Mulligan argued that the “design” in privacy by design has been understood narrowly (Wong and Mulligan 2019, abstract). According to the abstract, they drew from the HCI literature the dimensions of the purpose of design, who does design work, and for whom design is done, and argued that, in addition to design as a tool for solving problems, design that foregrounds values and critique can help define the scope of privacy problems.

From the research above, designers’ added value can be found in three places. The first is choosing, on the basis of evidence, designs that support human judgment where humans cannot be removed from the loop (Cranor 2008; Felt et al. 2015). There are cases where designs that promote the safe choice and designs that reduce the number of warnings worked better than polishing the wording of warnings (Sunshine et al. 2009). The second is turning legal requirements into criteria that can be checked on screens. The study in which only 11.8% of consent screens met the minimal requirements, and the study that defined dark patterns in a shared vocabulary, provide material for that translation (Nouwens et al. 2020; Gray et al. 2024). The third is making users’ values visible within organizations (Wong 2021; Tahaei et al. 2021). However, this third kind of work does not come with the title of designer alone. In security settings, designers are not brought in (Chalhoub et al. 2020), and designers themselves can rationalize dark patterns (Nelissen and Funk 2022; Zhang-Kennedy et al. 2024). The designers who can add value are those who enter security discussions and accept having their own proposals checked against other people’s criteria.

What research has not yet answered

No study was found that measured whether designers’ participation in security or privacy design reduced the number or damage of breaches. The effects of screens are measured with intermediate indicators such as click-through rates for warnings and consent rates, and are not followed through to breaches as outcomes. Studies of designers are mostly interview studies with 3 to 33 participants, skewed toward the United States and Europe, and no study focused on designers in Japan was found. This review also found no study that treats documents handed to the wrong person and misdirected mail, which are common in Japan’s breach reports (see the industry counterpart), as problems of service design.

Unverified items

No unverified statements remain in the main claims. For thirteen papers, the full text could not be obtained after three or more routes, including the ACM site: Adams and Sasse; Dhamija et al.; Reeder et al.; Zou et al.; Habib et al. 2020 and 2022; Gray et al. 2018; Gray and Chivukula; Chivukula et al.; Beattie et al.; Zhang-Kennedy et al.; Tahaei et al.; and Wong and Mulligan. These papers are described only within the range of their abstracts, as stated in the text. Lederer et al. 2004 (five pitfalls for designers) could not be obtained in full text or abstract and was removed from the references.

References

Author: Shuichiro Ogawa (Design Researcher / Design Consultant) About me →