User Experience Design Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A UX designer notices that a cookie consent banner uses a large, colorful 'Accept All' button but a tiny gray 'Manage Preferences' link. Which regulatory body would classify this as non-compliant and why?
- NIST, because it violates cybersecurity framework principles
- EU Data Protection Authorities, because asymmetric choice design compromises freely given GDPR consent (Correct answer)
- ISO, because it fails usability standards
- FCC, because it misrepresents data practices
Correct answer: EU Data Protection Authorities, because asymmetric choice design compromises freely given GDPR consent
EU DPAs have ruled that visually imbalanced consent interfaces (nudging toward acceptance) undermine the requirement that GDPR consent be freely given and equally easy to refuse.
Question 2: Under the Americans with Disabilities Act Title III, which type of business is most clearly obligated to ensure its website meets accessibility standards?
- Any US federal agency
- A place of public accommodation (e.g., retail, restaurant, hotel) with a commercial website (Correct answer)
- Only businesses with more than 500 employees
- Non-profit organizations only
Correct answer: A place of public accommodation (e.g., retail, restaurant, hotel) with a commercial website
ADA Title III applies to places of public accommodation, and courts have extended this to their websites, requiring accessible digital experiences for customers.
Question 3: Which WCAG 2.1 principle is violated when a form error message only uses red color to indicate invalid fields, with no text label or icon?
- Robust
- Operable
- Perceivable (specifically, not relying solely on color to convey information) (Correct answer)
- Understandable
Correct answer: Perceivable (specifically, not relying solely on color to convey information)
WCAG SC 1.4.1 (Use of Color) under the Perceivable principle requires that color not be the only visual means of conveying information such as form errors.
Question 4: The EU's Digital Services Act (DSA) imposes which specific UX obligation on very large online platforms (VLOPs)?
- Mandatory dark mode support
- Offering users at least one recommendation system option not based on profiling (Correct answer)
- Storing all EU user data within EU borders
- Providing WCAG AAA compliance for all interfaces
Correct answer: Offering users at least one recommendation system option not based on profiling
DSA Article 38 requires VLOPs to offer users at least one recommendation system not based on profiling, giving users more control over their content feeds.
Question 5: A healthcare UX team wants to conduct usability testing with participants who will interact with screens showing real patient data. What HIPAA safeguard must be implemented?
- Participants must sign an NDA only
- A Business Associate Agreement (BAA) and de-identification or authorization of the data before exposure (Correct answer)
- Only encryption of test recordings is required
- HIPAA does not apply to usability testing contexts
Correct answer: A Business Associate Agreement (BAA) and de-identification or authorization of the data before exposure
Exposing PHI during usability testing requires either full de-identification of the data or participant authorization, plus a BAA with any third-party testing vendor.
Question 6: Which WCAG 2.1 Level AA success criterion requires that users be able to reflow content at 400% zoom without losing functionality or requiring horizontal scrolling for vertical text?
- 1.4.4 Resize Text
- 1.4.10 Reflow (Correct answer)
- 1.4.8 Visual Presentation
- 2.4.7 Focus Visible
Correct answer: 1.4.10 Reflow
SC 1.4.10 (Reflow), added in WCAG 2.1, requires that content can be presented in a single column at 400% zoom without loss of content or functionality, supporting users with low vision.
Question 7: When a SaaS company processes personal data on behalf of its enterprise clients under GDPR, it acts as a what, and what document formalizes this relationship?
- Joint controller, formalized by a joint controllership agreement
- Data processor, formalized by a Data Processing Agreement (DPA) (Correct answer)
- Data controller, formalized by a privacy policy
- Sub-processor, formalized by a standard contractual clause
Correct answer: Data processor, formalized by a Data Processing Agreement (DPA)
Under GDPR Article 28, a vendor processing data on behalf of a client is a data processor, and a Data Processing Agreement (DPA) is mandatory to formalize the relationship.
User Experience Design Regulatory Frameworks & Compliance 5
A UX designer notices that a cookie consent banner uses a large, colorful 'Accept All' button but a tiny gray 'Manage Preferences' link.
Which regulatory body would classify this as non-compliant and why?