User Experience Design Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Under GDPR, which legal basis allows a website to process user data for personalization without asking for explicit consent each session?
- Vital interests
- Legitimate interests (Article 6(1)(f)) after a balancing test (Correct answer)
- Public task
- Special category data exemption
Correct answer: Legitimate interests (Article 6(1)(f)) after a balancing test
Legitimate interests can lawfully justify processing for personalization if a balancing test shows it doesn't override user rights and interests.
Question 2: The FTC's 'click-to-cancel' rule (announced 2023) primarily targets which UX practice?
- Overly long checkout flows
- Making subscription cancellation as difficult as sign-up (Correct answer)
- Excessive push notification requests
- Forced account creation before purchase
Correct answer: Making subscription cancellation as difficult as sign-up
The FTC's click-to-cancel rule requires that canceling a subscription be as simple as the sign-up process, prohibiting manipulative retention flows.
Question 3: Which WCAG 2.1 success criterion addresses the need for users to be able to pause, stop, or hide moving or auto-updating content?
- 1.2.2 Captions (Prerecorded)
- 2.2.2 Pause, Stop, Hide (Correct answer)
- 1.4.2 Audio Control
- 2.3.1 Three Flashes or Below Threshold
Correct answer: 2.2.2 Pause, Stop, Hide
SC 2.2.2 requires that any moving, blinking, or scrolling content that starts automatically can be paused, stopped, or hidden by the user.
Question 4: A UX designer adds a 'Remember Me' checkbox on a login form. Under GDPR, storing an extended authentication token requires what action?
- No additional action if stated in the privacy policy
- Explicit user consent via an opt-in mechanism, since it involves storing data on the user's device (Correct answer)
- Only a session cookie notice
- Compliance with PCI DSS only
Correct answer: Explicit user consent via an opt-in mechanism, since it involves storing data on the user's device
Under GDPR and ePrivacy Directive, storing persistent cookies or tokens on a user's device beyond essential functionality requires prior, freely given consent.
Question 5: Section 508 was significantly updated in 2018 to align with which set of standards, replacing the original 2001 provisions?
- WCAG 1.0 Level A
- WCAG 2.0 Level A and AA (Correct answer)
- EN 301 549 v1.1.2
- ISO 9241-11
Correct answer: WCAG 2.0 Level A and AA
The 2018 Section 508 refresh (the 'ICT Final Standards and Guidelines') adopted WCAG 2.0 Level A and AA as the technical standard for web and software accessibility.
Question 6: When must a GDPR Data Protection Impact Assessment (DPIA) be conducted by a UX team building a new digital product?
- Only after a data breach occurs
- Before processing that is likely to result in high risk to individuals' rights and freedoms (Correct answer)
- Only for products handling financial data
- After the product launches and reaches 10,000 users
Correct answer: Before processing that is likely to result in high risk to individuals' rights and freedoms
GDPR Article 35 mandates a DPIA before processing operations that pose a high risk, such as systematic profiling or large-scale sensitive data processing.
Question 7: The Web Accessibility Initiative's ARIA (Accessible Rich Internet Applications) specification primarily helps UX developers do what?
- Improve page load performance for assistive technologies
- Communicate the purpose, state, and properties of dynamic UI components to assistive technologies (Correct answer)
- Replace semantic HTML elements in modern frameworks
- Automate accessibility testing in CI/CD pipelines
Correct answer: Communicate the purpose, state, and properties of dynamic UI components to assistive technologies
WAI-ARIA provides roles, states, and properties that expose the semantics of custom UI widgets (like modals and carousels) to screen readers and other assistive technologies.
User Experience Design Regulatory Frameworks & Compliance 4
Under GDPR, which legal basis allows a website to process user data for personalization without asking for explicit consent each session?