AAD Professional Ethics & Standards 2 — Questions and Answers
Question 1: When an Android app collects personal data, which approach best reflects ethical data practices?
- Collect all available data silently to improve analytics
- Collect only necessary data and clearly disclose it to users in a privacy policy (Correct answer)
- Collect maximum data now to support future unplanned features
- Store all user data indefinitely on the server for potential future use
Correct answer: Collect only necessary data and clearly disclose it to users in a privacy policy
Ethical data collection follows the principle of data minimization: collect only what is needed and be transparent about it.
Question 2: At what point in the user flow should an Android app request a runtime permission like location access?
- At app launch so all permissions are granted upfront
- In a background service without user awareness
- At the exact moment in the flow where the feature needing that permission is used (Correct answer)
- During onboarding only, and never request again
Correct answer: At the exact moment in the flow where the feature needing that permission is used
Contextual permission requests help users understand why the permission is needed, increasing trust and grant rates.
Question 3: A developer discovers their app accidentally stores user passwords in SharedPreferences in plaintext. What is the most ethical response?
- Leave it in place since no breach has been reported
- Schedule a fix for the next quarterly release
- Immediately patch the vulnerability and notify affected users (Correct answer)
- Delete the data silently and make no public disclosure
Correct answer: Immediately patch the vulnerability and notify affected users
Prompt disclosure and remediation protects users and is required by many data protection regulations.
Question 4: Under GDPR and CCPA, which user right must Android apps honor for applicable users?
- The right to discounted in-app purchases
- The right to request deletion of their personal data (Correct answer)
- The right to demand the app's full source code
- The right to unlimited ad-free usage
Correct answer: The right to request deletion of their personal data
Both GDPR and CCPA grant users the 'right to be forgotten' or right to deletion of their personal data.
Question 5: What is the most ethical practice when sharing user analytics data with third-party services?
- Share raw data without notifying users to protect business relationships
- Anonymize and aggregate data, and disclose third-party sharing in the privacy policy (Correct answer)
- Share all collected data since it is covered by the Terms of Service users accepted
- Only share data for users who have fewer than 50 contacts on the device
Correct answer: Anonymize and aggregate data, and disclose third-party sharing in the privacy policy
Informed consent and data anonymization are core principles of ethical third-party data sharing.
Question 6: An Android app is rated for users aged 13 and under. Which approach is ethically and legally required?
- Collect the same behavioral data as for adult users
- Comply with COPPA, avoid behavioral advertising, and obtain verifiable parental consent (Correct answer)
- Block all users who appear to be under 18 without explanation
- Use a simple age gate that users can bypass by entering any birth year
Correct answer: Comply with COPPA, avoid behavioral advertising, and obtain verifiable parental consent
COPPA imposes strict requirements on apps directed at children, including parental consent and restrictions on data collection.
Question 7: Which action violates the ethical principle of user autonomy in Android app design?
- Offering an opt-in for marketing emails
- Defaulting users into data sharing and making the opt-out difficult to find (Correct answer)
- Providing a clear settings screen for notification preferences
- Asking users once if they want to receive personalized recommendations
Correct answer: Defaulting users into data sharing and making the opt-out difficult to find
Dark patterns that default users into data sharing without clear opt-out mechanisms violate user autonomy and are increasingly illegal.
AAD Professional Ethics & Standards 2
When an Android app collects personal data, which approach best reflects ethical data practices?