Protect people’s autonomy, dignity and information. Build the judgement to explain your choices—and the evidence to support them.
For students beginning research and practitioners making decisions about products, services, AI and data. Build your judgement through training, ethical dilemmas and documented cases.
Clarify the research and its responsibilities. Who could benefit or be harmed? Who can genuinely refuse? Follow the required ethics-review route before recruitment or data collection, including pilot work. Calling participant discussions “informal” does not settle whether review is needed. Record responsibilities, conflicts of interest and how findings will be reported.
Separate participation from data processing. An agreement to participate does not automatically establish the lawful basis for processing personal data. Confirm the controller, purpose, lawful basis and any additional conditions. Decide what you need, who may access it, how long it is kept and how people can exercise their rights.
Check the actual workflow. Review recruitment, consent, recording, transcription, shared folders, AI services, publication and deletion. Use approved tools and permissions. Check that refusal and withdrawal are understandable and usable; know where to report a concern or suspected data breach.
Editorial preparation prompts, informed by the ESRC and ICO guidance below. They do not replace a formal ethics review, DPIA or legal assessment.
Free and paid options selected for relevance, provider and syllabus. Published learner ratings include their sample size and check date; they are not independent measures of teaching quality. A course completion is not research approval.
Free regulator training
Data Protection Essentials
ICO United Kingdom · Current programme · checked 17 October 2026
Self-paced training and self-assessment for small organisations and sole traders. A useful foundation for handling personal information in a studio, consultancy or small research team. The learning platform requires an account.
Apply it: Identify one gap in your own project’s handling of personal information and record the action you will take.
Keep in mind: Completion is not an ICO certification, endorsement or confirmation of legal compliance. It does not replace institutional training or research approval.
What we reviewed
Public programme description, platform entry page and ICO explanation of the completion register; training modules not completed.
Free · account needed for all activities and completion recognition
Study time
18 hours · advanced
Learner rating
4.6 / 5 from 28 ratings · OpenLearn · checked 17 October 2026
Scenarios explore decisions before, during and after research: sensitive topics, insider relationships, power, participants’ voices, sponsors and dissemination. Designed to complement postgraduate study.
Apply it: Work through a scenario and explain whose interests conflict, which options you considered and why your decision is defensible.
Keep in mind: A small, self-selected rating sample. The badge is not an accredited OU qualification; completion does not grant project ethics approval.
What we reviewed
Public overview, syllabus, access terms and rating; course not completed.
Source checked 17 October 2026.
Loading count…
University course · paid certificate route
Ethics, Technology and Engineering
Eindhoven University of Technology & 4TU.Ethics · Coursera Netherlands providers · international relevance · Current listing · checked 17 October 2026
Paid certificate experience; price depends on enrolment offer. Free access to the full course not verified.
Study time
About 20 hours · beginner entry level
Learner rating
4.6 / 5 from 832 reviews · Coursera · checked 17 October 2026
Introduces ethical theories, moral argument, conflicting values, design trade-offs and responsibility across organisations. Useful foundations for making and explaining difficult technology decisions.
Apply it: Apply two ethical perspectives to a product decision, then identify who has the authority to act on the problem.
Keep in mind: Engineering-focused rather than UX-specific or GDPR training. Learner ratings are not evidence of professional competence. Check current fees, subscription terms and financial-aid eligibility before enrolling.
What we reviewed
Public syllabus, course rating and access FAQ; enrolment checkout and teaching not independently assessed.
Read the source, identify its scope, and connect it to a decision in your project. These resources explain responsibilities across recruitment, participation, data handling and design.
Regulator guidance
Participation consent and lawful processing are different decisions
ICO · Principles and grounds for processing United Kingdom · Living guidance · checked 17 October 2026
Agreement to take part in a study is distinct from consent as a UK GDPR lawful basis. The appropriate basis depends on the organisation and purpose. Special-category data also requires a relevant additional condition.
Apply it: Ask your institution or organisation to confirm the controller, lawful basis, relevant data conditions and participant information before collecting data.
Keep in mind: Guidance is under review following legal changes. Calling an activity “research” does not automatically qualify it for research exemptions.
What we reviewed
Research principles, lawful-basis and consent sections.
Informed participation involves understandable information, a genuine choice and continuing attention to consent. ESRC discusses coercion, incentives, withdrawal, confidentiality and alternatives to signed forms.
Apply it: Consider whether a student, employee or dependent participant can comfortably refuse. Explain recording, sharing and withdrawal arrangements in accessible language.
Keep in mind: Institutional guidance, not an empirical test or a universal legal procedure. Your project’s ethics review must resolve context-specific risks.
What we reviewed
Consent guidance, including voluntary participation, recording consent and confidentiality.
A practical account of participant information, observers, recording, evidence of consent and accessible consent formats. It also addresses research with colleagues inside an organisation.
Apply it: Check whether participants can explain what will happen to their recordings and who can access them, rather than merely asking them to sign.
Keep in mind: Older government practice guidance, not a complete account of current law. Read alongside the ICO’s distinction between participation consent and lawful basis.
Build appropriate privacy measures into the whole lifecycle. The updated guidance covers necessary data, access, retention and the additional considerations for online services likely to be accessed by children.
Apply it: Annotate a prototype with the purpose of each data field, its default visibility, access controls and retention decision.
Keep in mind: The measures depend on purpose, context and risk. A privacy notice alone does not establish compliance.
What we reviewed
Overview, practical measures, responsibilities and children’s protection sections.
Source checked 17 October 2026.
Loading count…
Regulator guidance
Data protection impact assessments
ICO United Kingdom · Living guidance · checked 17 October 2026
A DPIA examines risks to people arising from processing personal data. It is required where processing is likely to result in high risk, and can inform design decisions before a system or study starts.
Apply it: With your data protection lead, identify the people affected, potential harms, safeguards, unresolved risks and accountable decision-maker.
Keep in mind: A DPIA is distinct from research ethics approval. The ICO flags parts of the detailed guidance for review; use its current requirements and your institutional process.
What we reviewed
DPIA overview and the requirement described in current privacy-by-design guidance.
Source checked 17 October 2026.
Loading count…
Regulator guidance
AI tools, personal data and accountability
ICO · Guidance on AI and data protection United Kingdom · Living guidance · checked 17 October 2026
The ICO separates legal interpretation from recommended practice and organises the guidance around risks including fairness, transparency, security and individual rights.
Apply it: Before using an AI transcription or analysis service, ask who receives the material, what it is retained or reused for, and whether your organisation has approved that processing.
Keep in mind: Not a statutory code or a complete AI ethics framework. The guidance is under review following legal changes; it does not establish that a particular AI product is lawful.
What we reviewed
Introduction, scope, risk-based approach and links to the risk toolkit.
Explore tensions between business goals and autonomy, public visibility and privacy, or convenience and inclusion. Guidance, empirical findings and conceptual arguments are labelled separately.
Joint regulator position paper
Harmful design in digital markets
ICO and Competition and Markets Authority United Kingdom · 9 August 2023 · background reading
Examines how interface choices can undermine control over personal information, including obstructive journeys, biased framing, bundled choices and defaults. It calls for design testing that considers users’ interests.
Apply it: Review whether refusal, cancellation and privacy choices are as understandable as acceptance. Record evidence of informed choice, not conversion alone.
Keep in mind: A 2023 position paper, not a current consolidation of consumer or data law. The application to your interface depends on its context.
What we reviewed
Paper summary, examples listed in the contents and shared expectations; not a full legal appraisal.
Source checked 17 October 2026.
Loading count…
Peer-reviewed empirical research
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites
Mathur et al. · Proceedings of the ACM on Human-Computer Interaction Shopping websites · sampled web context · November 2019 · background reading
Analysis of roughly 53,000 product pages across 11,000 shopping websites identified 1,818 dark-pattern instances. The authors organised the findings into a taxonomy of design practices and potential harms.
Apply it: Use the taxonomy to question a design decision, then inspect the actual journey and evidence before making a claim about harm or legality.
Keep in mind: Abstract-only review of a historical website sample. It is not a current prevalence estimate, an experiment measuring individual harm or a legal finding against every site.
What we reviewed
University publication record and abstract; full methods not appraised. DOI: 10.1145/3359183.
Source checked 17 October 2026.
Loading count…
Research ethics guidance
Publicly visible does not settle whether research is ethical
UKRI · ESRC: Internet mediated research UK research context · cross-border online settings · Updated 12 May 2025 · background guidance
Examines privacy expectations, consent, covert observation, identity and cross-border responsibilities in online communities. Visibility alone does not resolve the ethical questions around collecting or publishing people’s contributions.
Apply it: Before analysing a forum or sharing a quotation, consider whether people expected that use and whether someone could trace the material back to its author.
Keep in mind: General guidance rather than permission for a particular study. Some further-reading references are older; seek review appropriate to the community and method.
What we reviewed
Full guidance page; linked further readings not individually appraised.
Source checked 17 October 2026.
Loading count…
Peer-reviewed conceptual article
From codes of conduct to ethical deliberation
Gogoll et al. · Philosophy & Technology Germany-based authors · software development · 21 April 2021 · background reading
Argues that broad ethical codes cannot resolve every concrete design choice. The authors examine team and management responsibilities, using examples such as restrictive care technologies and data structures that exclude people.
Apply it: Bring a difficult decision to a design review: identify the competing values, practical alternatives and which responsibilities belong to the team or management.
Keep in mind: A reasoned proposal, not an empirical demonstration that its approach improves outcomes. The illustrative scenarios are not reported enforcement incidents.
What we reviewed
Abstract, introduction and responsibility discussion, including the worked examples. DOI: 10.1007/s13347-021-00451-w.
Large language models (LLMs) create questions about participation, consent, accuracy, bias and reliance. These entries bring together published research, legal decisions and first-hand incident accounts. Each suggests a design or research decision to examine; findings apply to the systems and circumstances studied.
Final consent order
DoNotPay: evidence behind an “AI lawyer” claim
US Federal Trade Commission United States · consumer protection · Order approved 16 January 2025 · historical case
The FTC alleged that DoNotPay marketed its chatbot as a substitute for legal expertise without adequate testing. The order requires evidence for relevant performance claims and notice to past subscribers.
Apply it: Audit product copy, onboarding and demos. Can you substantiate what the interface leads people to believe the AI can do?
Keep in mind: A settlement: DoNotPay neither admitted nor denied the allegations, apart from jurisdictional facts. Not a GDPR fine or evidence that payment has been completed.
What we reviewed
Regulator announcement and the order’s consent, evidence and representation provisions.
Reported outcome In Al-Haroun, referral to the Solicitors Regulation Authority; contempt threshold not met
The Al-Haroun part of this joint judgment concerns fictitious authorities and unverified client research. The client said the material came from AI tools, search engines and online sources. The court emphasised the lawyer’s responsibility to verify it.
Apply it: For a research brief or literature review, open every cited source and check that it supports the actual claim. Keep the source and verification trail alongside the draft.
Keep in mind: The facts and outcomes differ between the two joined cases. This card covers Al-Haroun; later disciplinary outcomes were not reviewed. Applying the lesson to UX writing is an editorial inference, not a claim that lawyers’ rules govern all designers.
What we reviewed
Introduction and verification duties, plus Al-Haroun evidence and outcome (paragraphs 74–81). PDF source.
Source checked 17 October 2026.
Loading count…
Peer-reviewed empirical conference paper
When an apparently supportive chatbot responds inappropriately
Moore et al. · ACM FAccT 2025 US research team · English-language mental-health settings · June 2025 publication · background research
A review of therapeutic guidance informed experiments with GPT-4o, Llama models and commercial therapy bots. The tested systems expressed stigma and produced inappropriate responses in some sensitive scenarios.
Apply it: For a sensitive service, define harmful failure modes with qualified specialists, test escalation and recovery, and assess more than perceived warmth or fluency.
Keep in mind: Selected 2024–25 models, constructed prompts and a small commercial-bot sample; not a clinical trial or an assessment of today’s models. Survey-style stigma responses need not predict all downstream behaviour. The source discusses distressing mental-health scenarios.
What we reviewed
Author manuscript of the published conference paper: scope, methods, findings and limitations in sections 3–5. DOI: 10.1145/3715275.3732039.
Reviews proposals to replace research participants with generative AI. The authors question whether simulated responses can fulfil the purposes of representation, inclusion and understanding that motivate participation.
Apply it: Label synthetic personas and responses as generated material. Ask what direct participation, influence over decisions and lived experience would be lost by substituting them for people.
Keep in mind: Abstract-only review of a published conceptual and scoping contribution. It is not a benchmark of every model’s predictive accuracy, nor evidence that synthetic material has no possible supporting use.
What we reviewed
Author-institution publication record and abstract. DOI: 10.1145/3613904.3642703.
Source checked 17 October 2026.
Loading count…
First-hand incident account · not an enforcement decision
An AI persuasion experiment without prior community consent
r/changemyview moderators · published researchers’ apology Online community · University of Zurich researchers · Apology dated 5 May; posted 6 May 2025 · historical incident
Reported outcome Researchers’ statement: dataset use ended and research would not be published
The moderators published an apology from researchers acknowledging a study of LLM persuasion conducted without prior information or consent. The statement committed to informed participation in future designs.
Apply it: Ask how community expectations, moderator involvement, participant consent, disclosure and debriefing will work before testing AI persuasion in a live social setting.
Keep in mind: An involved community’s published account, not an independent audit or judicial finding. The commitments are reported statements; subsequent implementation and legal outcomes were not established.
What we reviewed
Moderator announcement and the researchers’ reproduced statement; reader comments not used as evidence.
Source checked 17 October 2026.
Loading count…
Provider self-report · practitioner material
When positive feedback rewards excessive agreement
OpenAI · GPT-4o incident account ChatGPT product · international use · 29 April 2025 · historical product incident
Reported outcome Provider reported rolling back a GPT-4o update
OpenAI described an update that made responses excessively agreeable. Its account linked the problem to overemphasising short-term feedback and outlined changes to evaluation and feedback collection.
Apply it: Evaluate whether an assistant can disagree constructively and acknowledge uncertainty. Pair satisfaction metrics with checks for misleading reassurance and longer-term user outcomes.
Keep in mind: The supplier’s own explanation, not independent causal evidence or a finding about current models. Proposed safeguards are not treated as proven effective.
What we reviewed
Full provider incident article; no independent evaluation reproduced.
Cases from universities and businesses show how ordinary workflows can affect people. Amounts are in their original currencies. A proposed fine, an imposed penalty and money for consumer refunds are different outcomes.
Reported administrative fine
Umeå University: protecting sensitive research material
Swedish Authority for Privacy Protection (IMY) Sweden · EU GDPR · 11 December 2020 · historical case
Reported outcome SEK 550,000 fine reported by the regulator
IMY reported inadequate protection of sensitive research records in cloud storage, transmission of sensitive material through unencrypted email, and failure to report the incident as a personal data breach.
Apply it: Check the approved storage route and actual sharing behaviour. A policy has little protective value when the research workflow does not follow it.
Keep in mind: The full Swedish decision and any later appeal were not reviewed. This is the reported outcome at that time, not a claim about present university practice.
What we reviewed
Regulator’s English account, published 2020 and updated 2021.
Source checked 17 October 2026.
Loading count…
Reported administrative fine
University of Agder: permissions in shared workspaces
Norwegian Data Protection Authority (Datatilsynet) Norway · GDPR in the EEA · Decision 4 September 2024 · historical case
Reported outcome NOK 150,000 fine reported by the regulator
Personal information concerning about 16,000 people was accessible in Teams folders to employees without a work-related need to see it. The regulator stressed permissions, staff training, logging and checks.
Apply it: Test folder permissions with an ordinary staff account. “Inside the university” is not the same as restricted to the right people.
Keep in mind: Summary-level review; later appeal or payment status was not established. This case concerns the university’s configuration and controls, not a finding that Teams is inherently unlawful.
What we reviewed
National regulator’s English account and EDPB decision summary.
Reported outcome £3,076,320 final penalty; agreement not to appeal
The ICO reported that a 2022 ransomware attack exposed weaknesses including incomplete multi-factor authentication, vulnerability scanning and patching. Personal information relating to 79,404 people was taken.
Apply it: Treat supplier assurance, usable secure authentication and recovery procedures as parts of the service experience. Check coverage rather than relying on a security feature being available.
Keep in mind: The final amount is lower than the £6.09m provisional proposal. The announcement records agreement to pay, not evidence reviewed here of completed payment.
What we reviewed
ICO enforcement entry and settlement announcement.
Reported outcome US$245m ordered for consumer refunds
The FTC finalised an order settling charges about unwanted Fortnite purchases and unauthorised charges. Its complaint described confusing button configurations and blocking access after payment disputes.
Apply it: Test purchase confirmation, cancellation and dispute journeys with people who may make mistakes. A click does not by itself demonstrate informed intention.
Keep in mind: This is consumer redress, not a GDPR fine. It is separate from the US$275m children’s privacy penalty. The complaint’s allegations are distinguished from a contested court finding.
What we reviewed
FTC final-order announcement and dated case record.
Make responsible practice visible in your portfolio
For an existing project, write a short decision record: the issue, who was affected, the source or policy you consulted, the options, your decision and what remains uncertain. Show how the evidence changed the design. Use fictional or appropriately anonymised material; do not publish consent forms, identifiable recordings or confidential correspondence.
An editorial reflection prompt. It demonstrates your reasoning, not a certification of compliance. For broader access needs, see our accessibility page.
Curated by Liz Coulter-Smith with OpenAI assistance · 17 October 2026 · Version 1. Sources and review limits are identified for each entry. Historical examples are not presented as new incidents or evidence of an organisation’s current practice. “Apply it” prompts are editorial suggestions.