post

B2B product management

Artificial Intelligence (AI) & Machine Learning (ML)

Customer Research

Hardware

Digital Transformation

Our Privacy Policy is changing on April 5, 2022 - for more information and a description of the updates, <a href="https://mtpdevwpe.wpengine.com/privacy/" style="color:#FFFFFF;text-decoration:underline;">see the policy here.</a>

Switching back the focus from ‘Build only’ to ‘Build-measure-learn’

Product career special part 2: Making a change

Build what matters with vision-led product management

Lessons in fearless leadership

Building a product organisation from scratch by Kevin Mansfield

Footer About

Footer Contribute

Footer Get Involved

Footer Links

Mind the Product

Product Management

The executive product leader persona

Test blog post

Rob Shavell is CEO of Abine / DeleteMe, The Online Privacy Company. Rob has been quoted as a privacy expert in the Wall Street Journal, New York Times, The Telegraph, NPR, ABC, NBC, and Fox. Rob is a vocal proponent of privacy legislation reform, including the California Privacy Rights Act (CPRA).

Rob Shavell

<p>For tech giants like Apple and Google, user privacy has traditionally been seen as something to avoid rather than a selling point for their products. However, driven by changing consumer sentiment and <span style="text-decoration: underline;"><a href="https://www.politico.com/news/2021/06/15/big-tech-house-antitrust-changes-494506" target="_blank" rel="noopener">mounting political pressure</a></span>, the same companies that previously appeared to approach privacy as an obstacle are now pushing it to the forefront of product marketing.</p>
<p>At a <span style="text-decoration: underline;"><a href="https://www.cnet.com/news/google-io-2021-every-announcement-developers-conference/" target="_blank" rel="noopener">developers conference</a></span> last month, Google showcased its intent to give users the ability to increase their privacy. In a small but essential contribution to user privacy, the company intends to allow people to rapidly delete their recent search history on Chrome, create locked photo folders on Pixel devices, and become more aware of location tracking when using Maps. Android will also get an enhanced suite of privacy features, giving users the ability to more easily restrict an app&#8217;s access to device functions such as location tracking, sound recording, and camera usage.</p>
<p>Meanwhile, Apple&#8217;s recent iOS 14.5 update included a powerful new privacy tool called &#8220;App Tracking Transparency,&#8221; within which iOS device users gain greater visibility and control over what data apps they’ve installed on their phones share with third parties. Critically this update prompts users to &#8220;opt-in&#8221; rather than &#8220;opt-out&#8221; of tracking. Apple has also made privacy a focal point on its <span style="text-decoration: underline;"><a href="https://9to5mac.com/2021/06/02/apple-pay-apple-wallet-webpages-new/" target="_blank" rel="noopener">new websites</a></span> for its Apple Wallet and Apple Pay products.</p>
<p>Similarly, while Microsoft recently <span style="text-decoration: underline;"><a href="https://www.theguardian.com/technology/2020/nov/26/microsoft-productivity-score-feature-criticised-workplace-surveillance" target="_blank" rel="noopener">experienced backlash</a></span> over the productivity score feature within its 365 product, the Seattle-based tech giant has been using privacy as a selling point at least since it ran its <span style="text-decoration: underline;"><a href="https://www.adweek.com/brand-marketing/new-microsoft-privacy-campaign-promotes-consumer-control-148781/" target="_blank" rel="noopener">privacy-focused ad campaign in 2013.</a></span> The company has also continually called for tighter regulation around personal consumer data and has taken <span style="text-decoration: underline;"><a href="https://blogs.microsoft.com/on-the-issues/2019/02/11/next-generation-washington-our-priorities-for-2019/" target="_blank" rel="noopener">a pro-data protection political stance</a></span>.</p>
<p>While big tech&#8217;s move to increase user privacy is welcome, it is also vital from a business point of view. Behind today&#8217;s movement to pivot products towards greater user privacy are unavoidable trends in consumer preferences and legislative tolerance, which product teams can’t afford to ignore.</p>
<h2>Consumers want privacy</h2>
<p>In 2019, over <span style="text-decoration: underline;"><a href="https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/" target="_blank" rel="noopener">60% of adult respondents</a></span> to a Pew Research Center poll agreed with the statement that &#8220;it&#8217;s not possible to go through daily life without having data collected by companies or the government.&#8221; Since then, consumer awareness of privacy has continued to evolve.</p>
<p>Critically for businesses, a heightened awareness of privacy now informs consumer choices. As shown in a recent report from Flurry, an analytics company, globally, only around <span style="text-decoration: underline;"><a href="https://www.flurry.com/blog/ios-14-5-opt-in-rate-att-restricted-app-tracking-transparency-worldwide-us-daily-latest-update/" target="_blank" rel="noopener">13% of users</a></span> have chosen to opt into tracking when prompted under Apple&#8217;s recent IOS update.</p>
<p>User reactions to Apple&#8217;s new privacy update demonstrate that consumers prioritize privacy whenever they have the option to do so. This idea is also backed up by research that shows that many consumers will prioritize privacy when choosing products. In a recent large-scale global <span style="text-decoration: underline;"><a href="https://hbr.org/2020/01/do-you-care-about-privacy-as-much-as-your-customers-do" target="_blank" rel="noopener">consumer sentiment survey by CISCO</a></span>, 32% of privacy-aware respondents said they would, or already have, switch service providers due to a company&#8217;s data sharing policy.</p>
<p>Even among loyal brand acolytes, poor privacy can become a turn-off. A 2021 survey of Australian tech users with several devices from a particular company showed that long-time brand fans <span style="text-decoration: underline;"><a href="https://www.theguardian.com/technology/2021/may/19/privacy-by-design-google-to-give-people-more-power-over-their-personal-data" target="_blank" rel="noopener">were more concerned</a></span> than ever about their privacy when using that specific brand’s services or products.</p>
<h2>Politicians and legislators want to promote privacy</h2>
<p>Throughout the last several years, tech companies have repeatedly had to face stricter scrutiny from legislators globally. As a result, big tech is no stranger to privacy-related lawsuits. However, as privacy becomes a focal point for voters, what has in the past amounted to endless legal battles or empty political discourse is increasingly turning into real legislative change.</p>
<p>The recent passing into law of the <span style="text-decoration: underline;"><a href="https://www.natlawreview.com/article/california-voters-approve-another-overhaul-california-consumer-privacy-laws-meet#:~:text=The%20CPRA%20permits%20law%20enforcement,personal%20information%20for%2090%20days.&amp;text=If%20a%20business%20receives%20such,personal%20information%20from%20the%20consumer." target="_blank" rel="noopener">California Privacy Rights Act</a></span> (CPRA) is one example. At the same time as the US presidential election last November, voters in California, the world&#8217;s sixth-largest economy, passed a law that will give them GDPR-like protection by 2023. Across the US, similar consumer privacy-focused bills are <span style="text-decoration: underline;"><a href="https://iapp.org/resources/article/us-state-privacy-legislation-tracker/">now in train</a></span> in other major states such as Texas and New York.</p>
<p>Within the EU, a <span style="text-decoration: underline;"><a href="https://techcrunch.com/2021/06/15/cjeu-ruling-could-open-big-tech-to-more-privacy-litigation-in-europe/" target="_blank" rel="noopener">recent ruling by the Court of Justice of the European Union</a></span> also opens tech companies to a vastly increased volume of GDPR penalties. As per the ruling, GDPR complaints will no longer necessarily have to come through the country where an organization is based but, rather, will be able to originate in the complainants&#8217; jurisdiction. This new status quo will clear the backlogs which have held countless complaints up in court.</p>
<h2>Change is guaranteed, proactive response is vital</h2>
<p>Whether driven by tighter interpretations of existing legislation, new laws (such as <span style="text-decoration: underline;"><a href="https://iapp.org/news/a/federal-data-privacy-regulation-is-on-the-way-thats-a-good-thing/" target="_blank" rel="noopener">the increasingly likely prospect </a></span>of a US federal privacy law), or by consumer preferences, the privacy requirements placed on product-focused businesses are only expected to get stricter. Ultimately, all trends point to a future where the end-user will expect and demand to control how their personal data is processed and used.</p>
<p>Accordingly, and as is already happening in some big tech firms, product teams will need to take the initiative and make privacy features inherent to product design. The concept of <span style="text-decoration: underline;"><a href="https://www.privacysecurityacademy.com/wp-content/uploads/2020/08/PbD-Principles-and-Mapping.pdf" target="_blank" rel="noopener">Privacy by design</a></span> (PbD) gives a framework for how proactive privacy can work practically.</p>
<h2>Privacy by design needs to become standard practice</h2>
<p>Not a new concept, the thesis for PbD was developed in the mid-1990s by a team led by Ontario Privacy Commissioner Ann Cavoukian. Though over 25 years old, its fundamental principles can still make for a refreshing read for product design teams struggling to co-mingle privacy and functionality.</p>
<p>While the concept of PbD outlined by Cavoukian incorporates seven fundamental principles, three, in particular, may have relevance to product design teams today:</p>
<h3>Privacy should be proactive</h3>
<p>Just like how the best products often anticipate user desires and pain points before they happen, product privacy ideally needs to be designed as a core feature from the get-go.</p>
<p>One way of doing this is to involve a privacy-focused professional, such as your organization&#8217;s data protection officer, in the design process from the beginning. With product requirements growing increasingly crowded, at least one person on the team needs to champion user privacy to ensure it&#8217;s not seen as an afterthought or expendable.</p>
<p>At the beginning of the project and later through regular check-ins, the “privacy champion” needs to constantly question the product from a privacy point of view. In practice, this means bringing the team’s attention to any requirements, both internal and external, that may be applicable when designing a specific product.</p>
<p>Depending on the product that’s being designed, teams may also have to adhere to best practices or code of conduct for a specific technology. Here it’s good to be aware of not only regulations and acts that are already in place but also of pending legislation, such as the proposed ePrivacy Regulation.</p>
<p>All privacy practices relating to the project should be shared with both the user community and other stakeholders so as to create a community of continuous improvement. Ideally, the privacy professional should also carry out a risk assessment pinpointing the potential privacy risks to users.</p>
<h3>Privacy should be user-centric</h3>
<p>To empower users to take control of their data, products should be designed around their interests and needs. As outlined by Cavoukain, doing this means working critical principles such as consent, accuracy, access, and compliance into all aspects of a product. Ultimately, product teams need to put the user at the center of privacy controls and see privacy from their perspective.</p>
<p>To do that, teams need to provide users with a clear path to understanding how data is used, give appropriate notice in the event that something is about to change, and support individuals with access to strong privacy controls.</p>
<p>For example, the team behind the Metadistretti e-monitor, a device that lets medical professionals and family members monitor cardiac patients remotely, made sure that patients wearing the e-monitor were able to <span style="text-decoration: underline;"><a href="https://hbr.org/2015/05/customer-data-designing-for-transparency-and-trust" target="_blank" rel="noopener">see exactly what type of data was collected</a></span> about them and to whom it was sent via a browser and an app. Users even have the ability to send different types and quantities of data to different groups and individuals.</p>
<p>In general, the entire product should be designed in such a way that the user understands the potential consequences of their choices and is not manipulated to make a specific one. Data collection that is not necessary for the core function of the product should be “opt-in” only (i.e., the highest privacy setting).</p>
<p>Additionally, the contact information for those responsible for user data protection for the product (or the organization behind the product) should be available and easy to access for users.</p>
<h3>Data use should be transparent</h3>
<p>Vital for gaining trust, data use needs to be as transparent as possible. Anyone using your product should be able to find out what happens to any information they give you.</p>
<p>At the most basic level, this could take the form of a straightforward, “plain language” privacy policy that anyone who wants to use your products has to read. For example, an information exchange for biomedical researchers, which collates participant’s genomic data, asks its volunteers to watch an educational video about the potentialities of having their genomes sequenced. After watching this video, the participants must also give their explicit preliminary consent to the process. It is only after the volunteers complete these two steps and understand the potential consequences of having their highly sensitive personal data collected that the company sends them a saliva sample collecting kit.</p>
<p>“<span style="text-decoration: underline;"><a href="https://iapp.org/media/pdf/resource_center/UX_FINAL.pdf" target="_blank" rel="noopener">The UX Guide to Getting Consent</a></span>” by The International Association of Privacy Professionals (IAPP) provides advice on how to obtain user consent in relation to the GDPR.</p>
<p>Remember that your claimed use of the information you collect also needs to be verifiable by an independent third party. Discussing this concept in terms of privacy by design, Cavoukain paraphrases Ronald Reagan in saying the user should be able to &#8220;trust, but verify.&#8221;</p>
<h2>Privacy is not a net loss</h2>
<p>With legislation and consumer attention honing in on privacy, no company can afford to treat privacy as a bolt-on in addition to their products. However, giving users control of their personal information does not have to be a drain on a product&#8217;s business case either. On the contrary, products that use the minimum amount of consumer data will ultimately be safer from a <span style="text-decoration: underline;"><a href="https://www.isaca.org/resources/news-and-trends/industry-news/2021/data-minimization-a-practical-approach" target="_blank" rel="noopener">cybersecurity perspective</a></span> and more attractive for consumers—a <span style="text-decoration: underline;"><a href="https://www.ey.com/en_ie/consulting/ey-global-consumer-privacy-survey/has-lockdown-made-consumers-more-open-to-privacy" target="_blank" rel="noopener">growing percentage of whom</a></span> place a premium on privacy.</p>
<p>This changing status quo around privacy points to a future where privacy concerns will move from design obstacles into product features. Getting ahead of this trend is vital for today&#8217;s product teams. Rather than looking at privacy as a trade-off between business needs and user requirements, product-focused professionals who see privacy as a &#8220;win-win&#8221; feature are likely to understand their users better and create more attractive products. The reason why is that done right, user privacy is never a negative.</p>
<p>Discover more content on <a href="https://mtpdevwpe.wpengine.com/category/product-ethics/" target="_blank" rel="noopener">product ethics</a>. For even more content on a range of product management topics, see our <a href="https://mtpdevwpe.wpengine.com/content-a-z/" target="_blank" rel="noopener noreferrer">Content A-Z</a>.</p>
<div class="g g-16"></div>
<div class="pt-5">
<div id="mtp_social_share" data-gtm-vis-first-on-screen-12316679_9="3252" data-gtm-vis-total-visible-time-12316679_9="100" data-gtm-vis-has-fired-12316679_9="1">
<div class="row row-7"></div>
</div>
</div>
<div class="g g-21"><div class="g-single a-93"><a class="gofollow" data-track="OTMsMjEsMSw2MA==" href="https://mtpdevwpe.wpengine.com/product-management-training/public-workshops/communication-alignment-workshop/"><img decoding="async" src="https://mtpdevwpe.wpengine.com/wp-content/uploads/2022/04/Training-CA-layer-of-strategy-FOOTER-scaled.jpg" /></a></div></div>

Privacy by design: flipping the script on privacy in product

Rob Shavell

Comments

Read next