Capstone: ethics, deceptive design and an end-to-end HCI project

The methods in this course give designers real power over what people notice, believe and choose. The same knowledge of perception, attention and decision-making that makes a fare purchase effortless can be used to push people into purchases they did not intend, subscriptions they cannot cancel and data sharing they did not want. This final lesson examines the ethics of interaction design, the catalog of deceptive design patterns and the laws that now target them in Canada and the United States, privacy-respecting design, and broader frameworks such as value sensitive design and design justice. It then brings the whole course together in an end-to-end project plan for the RideLine redesign, with a final summative evaluation.

Persuasion and its limits

All design influences behavior. Defaults, ordering, emphasis and wording shape choices even when designers do not intend them to, which Richard Thaler and Cass Sunstein called choice architecture in Nudge (2008). Some influence is benign and even welcome: a default that auto-renews a commuter's pass when the commuter asked for it, or a reminder to activate a ticket before boarding. B. J. Fogg's work on persuasive technology at Stanford in the late 1990s and 2000s described how computers can change attitudes and behavior and raised ethical questions from the start. The line between legitimate persuasion and manipulation is drawn by asking whether the design works with people's interests and informed choices or against them: whether it exploits cognitive limits to produce outcomes people would not choose if they understood what was happening.

Deceptive design patterns

In 2010 the user experience designer Harry Brignull coined the term dark patterns for interface designs that trick or pressure users into doing things they did not mean to; he and others now often prefer deceptive design patterns. Colin Gray and colleagues (CHI 2018) proposed a taxonomy of five strategies: nagging (repeated interruptions, such as prompts to enable notifications that cannot be permanently declined), obstruction (making a task harder than necessary, as in the roach motel, easy to get into and hard to get out of), sneaking (hiding or delaying information, such as sneaking items into a basket or revealing fees late), interface interference (manipulating the interface to privilege certain actions, such as visual emphasis on 'Accept all' and a faint 'Manage settings' link, preselected options and trick questions with double negatives) and forced action (requiring an unrelated action, such as creating an account or sharing contacts, to proceed). Confirmshaming, which guilt-trips users into opting in with labels like 'No thanks, I prefer paying full price', and false urgency or scarcity ('Only 2 left!', countdown timers that reset) are other common forms.

Deceptive patterns are widespread. Arunesh Mathur and colleagues at Princeton (CSCW 2019) built a crawler that examined about 11,000 shopping websites and found 1,818 instances of dark patterns on 1,254 of them, about 11 percent, including 183 sites with outright deceptive practices such as fake countdown timers and fabricated activity messages. Studies of cookie consent banners in Europe found that most did not meet legal requirements and that interface manipulation, such as burying the reject option, sharply increased the share of users who accepted tracking. Jamie Luguri and Lior Strahilevitz (2021) showed experimentally that mild dark patterns more than doubled the share of people who accepted a dubious data protection plan, and aggressive ones nearly quadrupled it, with less educated participants affected more.

Because deceptive patterns are often defined by measurable properties of an interface, some can be audited automatically, as the state-machine check in lesson 4 suggested. The program below compares two flows on three checks: whether the final price exceeds the advertised price, whether add-ons are preselected, and whether canceling takes more steps than subscribing.

# Auditing two checkout and subscription flows for common deceptive patterns:
# drip pricing (advertised vs final price), preselected add-ons, and asymmetry between
# the effort to subscribe and to cancel (shortest path lengths in the flow graph).
from collections import deque
def steps(graph, start, goal):
    dist = {start: 0}; q = deque([start])
    while q:
        s = q.popleft()
        for t in graph.get(s, []):
            if t not in dist:
                dist[t] = dist[s] + 1; q.append(t)
    return dist.get(goal)
flows = {
    "competitor app (invented)": {
        "advertised": 3.25, "final": 4.60, "preselected": ["trip insurance 0.95", "carbon offset 0.40"],
        "graph": {"Home": ["Offer"], "Offer": ["Subscribed"],
                  "Account": ["Settings"], "Settings": ["Membership"], "Membership": ["Survey"],
                  "Survey": ["Retention offer"], "Retention offer": ["Confirm by phone"], "Confirm by phone": ["Cancelled"]},
        "cancel_from": "Account"},
    "RideLine redesign": {
        "advertised": 3.25, "final": 3.25, "preselected": [],
        "graph": {"Home": ["Passes"], "Passes": ["Auto-renew on"], "Auto-renew on": ["Subscribed"],
                  "Account": ["Passes and renewals"], "Passes and renewals": ["Turn off auto-renew"], "Turn off auto-renew": ["Cancelled"]},
        "cancel_from": "Account"},
}
for name, f in flows.items():
    drip = f["final"] - f["advertised"]
    sub = steps(f["graph"], "Home", "Subscribed"); can = steps(f["graph"], f["cancel_from"], "Cancelled")
    issues = []
    if drip > 0: issues.append(f"drip pricing (+{drip:.2f} added after the advertised price)")
    if f["preselected"]: issues.append("preselected add-ons: " + ", ".join(f["preselected"]))
    if can > sub: issues.append(f"cancel takes {can} steps vs {sub} to subscribe")
    print(f"{name}: subscribe {sub} steps, cancel {can} steps")
    print("   ", "; ".join(issues) if issues else "no issues found by these checks")

competitor app (invented): subscribe 2 steps, cancel 6 steps
    drip pricing (+1.35 added after the advertised price); preselected add-ons: trip insurance 0.95, carbon offset 0.40; cancel takes 6 steps vs 2 to subscribe
RideLine redesign: subscribe 3 steps, cancel 3 steps
    no issues found by these checks

The invented competitor flow fails all three checks: the price grows by more than a dollar after the advertised fare, two paid add-ons are preselected, and cancellation takes six steps ending in a phone call, while subscribing takes two. The RideLine redesign shows the all-in price from the start, preselects nothing and lets riders turn off auto-renewal in three steps, close to the effort of turning it on. Simple checks like these cannot detect every deceptive pattern, especially those that depend on wording and visual emphasis, but they can run on every build and catch regressions.

Law and regulation

In the United States, section 5 of the FTC Act prohibits unfair or deceptive acts or practices, and the Restore Online Shoppers' Confidence Act (ROSCA) requires clear disclosure, express informed consent and a simple cancellation method for online subscriptions. The Federal Trade Commission's 2022 staff report Bringing Dark Patterns to Light set out its view of deceptive design, and it has brought major cases: Epic Games agreed in December 2022 to pay 245 million dollars in refunds over interface designs that led to unwanted purchases, and in September 2025 Amazon agreed to pay 2.5 billion dollars, including a civil penalty and customer refunds, to settle FTC claims that it enrolled customers in Prime without consent and made cancellation difficult. The FTC's 2024 'click-to-cancel' amendments to its negative option rule were vacated by a federal appeals court in July 2025, leaving ROSCA and section 5 as the main federal tools, while its rule on unfair or deceptive fees, requiring all-in pricing for live-event tickets and short-term lodging, took effect in May 2025. State laws add requirements: California's privacy regulations state that agreement obtained through dark patterns is not consent, and several states have automatic-renewal laws.

The European Union has gone furthest: the Digital Services Act, fully applicable since February 2024, prohibits online platforms from designing interfaces that deceive, manipulate or otherwise materially distort users' ability to make free and informed decisions (Article 25), and the General Data Protection Regulation's requirements for freely given, specific and unambiguous consent underlie enforcement against manipulative cookie banners. Products used in several jurisdictions increasingly design to the strictest standard.

Privacy by design

Ann Cavoukian, then Information and Privacy Commissioner of Ontario, formulated privacy by design in the 1990s as seven foundational principles, including privacy as the default setting, privacy embedded into design, and full functionality (positive-sum rather than zero-sum). The principles were endorsed by the International Conference of Data Protection and Privacy Commissioners in 2010 and influenced the GDPR's data protection by design and by default. For interaction designers, privacy by design means collecting only what is needed (RideLine stores trip history only if riders turn it on), making privacy choices understandable and symmetrical ('Accept' and 'Reject' presented equally), asking for permissions in context when they are needed rather than all at launch, and showing users what is collected and letting them delete it. Location data deserves special care: a transit app knows where people live, work and worship.

Values, justice and responsibility

Batya Friedman and colleagues' value sensitive design, developed from the 1990s, offers a method for accounting for human values throughout design through conceptual investigations (which values and stakeholders, direct and indirect, are implicated?), empirical investigations (how do stakeholders understand and prioritize those values?) and technical investigations (how do system properties support or hinder them?). For RideLine, indirect stakeholders include drivers, whose workload changes when riders show passes on phones, and people without smartphones, who must not be left with worse service as the agency shifts to app-based fares. Sasha Costanza-Chock's Design Justice (2020) asks who participates in design, who benefits and who is harmed, and argues for design led by the communities most affected. Participatory design, from the Scandinavian tradition, gives users real influence over design decisions, not just a role as test subjects.

Professional codes reinforce these obligations. The ACM Code of Ethics and Professional Conduct (2018) asks computing professionals to contribute to society and human well-being, avoid harm, be honest and trustworthy, respect privacy and design for inclusiveness. Engineers in Canada and professional engineering bodies in the United States have codes of their own. In practice, ethical design often comes down to individual designers raising concerns in meetings, documenting harms, measuring outcomes that matter to users rather than only to the business, and refusing to build patterns that deceive.

An end-to-end HCI project

The RideLine redesign illustrates how the course's methods fit together. Research (lessons 5 and 6): analytics located the abandonment at the zone screen; field observation and interviews with commuters, visitors, older adults and screen reader users explained it; a diary study captured disruptions; findings were synthesized into personas, scenarios and a journey map; and an open card sort and tree test shaped the information architecture. Requirements: measurable targets such as 90 percent first-time success buying the correct fare, a median time under 90 seconds, a SUS score above 75 and WCAG 2.2 AA conformance. Design (lessons 4 and 7): a wallet conceptual model, destination-based fares that remove zone choice, a list-first arrivals screen, bottom-anchored primary actions, a design system with accessible components and a privacy-respecting account model. Evaluation (lessons 3, 8 and 9): KLM estimates for expert flows, heuristic evaluations and cognitive walkthroughs on each iteration, three rounds of formative testing with six participants per user group, an accessibility expert review and sessions with screen reader and switch users, and a final summative comparison.

A project plan for a team in this course follows the same arc in miniature: choose a real interface and a specific user group; run a small study to understand their tasks and problems (with consent and, for course projects that will be published, ethics review); write personas, scenarios and measurable requirements; sketch alternatives and choose one; build a prototype at appropriate fidelity; evaluate it with heuristics and a walkthrough, fix what you find, then test with five or more representative users; iterate; check accessibility; and report findings with evidence, intervals and honest limitations. The final summative comparison for RideLine is below.

# Capstone summative comparison: old RideLine versus the redesigned prototype, 10 first-time
# riders per version (between-subjects), task "buy the right fare for a planned trip".
# Completion with adjusted-Wald intervals, geometric mean times with t intervals on logs,
# and a Welch test on SUS. Invented, seeded data.
import math, random, statistics as st
from scipy import stats
random.seed(4214)
def adj_wald(k, n, z=1.96):
    nn = n + z * z; p = (k + z * z / 2) / nn; h = z * math.sqrt(p * (1 - p) / nn)
    return max(0, p - h), min(1, p + h)
def geo_ci(ts):
    logs = [math.log(t) for t in ts]; m, s = st.mean(logs), st.stdev(logs)
    h = stats.t.ppf(0.975, len(logs) - 1) * s / math.sqrt(len(logs))
    return math.exp(m), math.exp(m - h), math.exp(m + h)
versions = {"old app": (0.55, 150, 48), "redesign": (0.92, 70, 80)}   # success prob, median time, typical SUS
sus_scores = {}
for name, (ps, med, sus_c) in versions.items():
    done = [random.random() < ps for _ in range(10)]
    times = [med * math.exp(random.gauss(0, 0.35)) for d in done if d]
    sus_scores[name] = [min(100, max(0, round(random.gauss(sus_c, 12) / 2.5) * 2.5)) for _ in range(10)]
    lo, hi = adj_wald(sum(done), 10); g, gl, gh = geo_ci(times)
    print(f"{name:8}: completed {sum(done)}/10 (95% CI {lo:.0%}-{hi:.0%}); geometric mean time {g:.0f} s "
          f"(95% CI {gl:.0f}-{gh:.0f}); mean SUS {st.mean(sus_scores[name]):.1f}")
w = stats.ttest_ind(sus_scores["redesign"], sus_scores["old app"], equal_var=False)
diff = st.mean(sus_scores["redesign"]) - st.mean(sus_scores["old app"])
print(f"SUS difference {diff:.1f} points, Welch t = {w.statistic:.2f}, p = {w.pvalue:.2g}")

old app : completed 5/10 (95% CI 24%-76%); geometric mean time 212 s (95% CI 152-296); mean SUS 46.8
redesign: completed 9/10 (95% CI 57%-100%); geometric mean time 59 s (95% CI 43-80); mean SUS 78.8
SUS difference 32.0 points, Welch t = 5.18, p = 0.00011

The redesign meets or approaches its targets: a much higher completion rate, a geometric mean time well under the 90-second target and a mean SUS score near 80, about 30 points above the old app, with the SUS difference clearly significant. The confidence intervals are the honest part of the report. With ten participants per version, the completion intervals are wide and overlap a little, so the report states that the redesign is very likely better and that the completion target of 90 percent is plausible but not demonstrated; a larger benchmark after launch, using analytics and a sample survey, will measure it at scale. The report also lists what the study cannot show: long-term use, behavior under real service disruptions, and the experience of riders who were not represented, such as people with cognitive disabilities, whom the team plans to include in the next round.

Human-centered design never really finishes. After launch, analytics, support calls, accessibility feedback and periodic usability benchmarks keep the cycle going, and new contexts, such as fare capping, contactless payment with bank cards and AI trip assistants, bring new questions. The methods of this course are the tools for answering them.

Worked examples