User Experience Design Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A UX team is designing a telemedicine platform. Which regulation most directly governs how patient health information must be handled in the UI?
- GDPR
- HIPAA Privacy and Security Rules (Correct answer)
- CCPA
- SOC 2
Correct answer: HIPAA Privacy and Security Rules
HIPAA's Privacy and Security Rules set strict requirements for how protected health information (PHI) is displayed, accessed, and transmitted in digital health applications.
Question 2: Under WCAG 2.1, what is the minimum contrast ratio required for normal-sized body text to meet Level AA compliance?
- 3:1
- 4.5:1 (Correct answer)
- 7:1
- 21:1
Correct answer: 4.5:1
WCAG 2.1 Success Criterion 1.4.3 requires a contrast ratio of at least 4.5:1 for normal text to meet Level AA.
Question 3: The California Consumer Privacy Act (CCPA) grants consumers which right that most directly affects opt-out UX patterns?
- Right to data portability
- Right to opt out of the sale of personal information (Correct answer)
- Right to erasure of all data
- Right to restrict processing
Correct answer: Right to opt out of the sale of personal information
CCPA requires businesses to provide a prominent 'Do Not Sell My Personal Information' link, directly shaping opt-out UX patterns on California-facing sites.
Question 4: Which of the following is considered a 'dark pattern' that violates FTC guidance and GDPR consent requirements?
- Providing a one-click unsubscribe link
- Pre-ticking consent checkboxes for marketing emails (Correct answer)
- Showing a confirmation dialog before account deletion
- Offering a clear 'Reject All' cookie option
Correct answer: Pre-ticking consent checkboxes for marketing emails
Pre-checked consent boxes do not constitute freely given, specific consent under GDPR and violate FTC guidelines against deceptive design.
Question 5: EN 301 549 is the European standard for ICT accessibility. Its requirements are primarily derived from which internationally recognized guidelines?
- Section 508
- WCAG 2.1 and ATAG 2.0 (Correct answer)
- ISO/IEC 40500
- ARIA 1.2
Correct answer: WCAG 2.1 and ATAG 2.0
EN 301 549 incorporates WCAG 2.1 success criteria and ATAG 2.0 for authoring tools as the core technical requirements for ICT accessibility.
Question 6: A financial services app must comply with the Gramm-Leach-Bliley Act (GLBA). What UX artifact does GLBA specifically require institutions to provide to customers?
- A cookie consent banner
- A clear and conspicuous privacy notice explaining data sharing practices (Correct answer)
- An accessibility statement
- A terms of service agreement
Correct answer: A clear and conspicuous privacy notice explaining data sharing practices
GLBA mandates that financial institutions deliver a privacy notice to customers explaining what information is collected and with whom it is shared.
Question 7: When designing for WCAG 2.1 Success Criterion 2.5.3 (Label in Name), what must a UX designer ensure about interactive controls with visible text labels?
- The accessible name must exactly match the visual label character for character
- The accessible name must contain the visible text label (Correct answer)
- The visible label must always be hidden from screen readers
- The control must have no accessible name if it has a visual label
Correct answer: The accessible name must contain the visible text label
SC 2.5.3 requires that the accessible name of a control contains the same text as its visible label so voice input users can activate it by speaking what they see.
User Experience Design Regulatory Frameworks & Compliance 3
A UX team is designing a telemedicine platform.
Which regulation most directly governs how patient health information must be handled in the UI?