The Basics

First things first: There are six key components to the GDPR that establish European Union citizens’ data rights.

First, citizens have a right to be notified within 72 hours if a company has been hacked and the breach will risk their personal information, to prevent situations like Yahoo’s massive data leak that people only found out about years later. Users also have the right to access what data a company has on them and learn where and how it is being used. And people have the right to be forgotten–meaning that if you don’t want a company to have your data anymore, you can ask them to delete all traces of it from their system. That also means that companies have a legal directive to delete data if it’s no longer relevant, even if you haven’t asked them to do so. Likewise, asking for consent from users to capture their data must be presented in an accessible, easily understood way.

Another key element of the law is “data portability.” This means the ability to download your data from one place in a machine-readable format (like a CSV file) so that you can take it to another carrier if you desire. If you downloaded your data from Facebook after the Cambridge Analytica scandal, you were exercising this right–though that download mostly includes data you explicitly shared with Facebook, and doesn’t include every inference the company has made about you based on your activity.

Worth noting: Right to access and right to portability are slightly different. Right to access means a company has to provide all data it has on you, including what it’s been used for, how long the company will store it, the source (if it doesn’t come from you), and sometimes information about how automated decisions were made using your data. If you request to download your data, however, the company only has to supply data you’ve explicitly provided to it.

Crucially, a concept called “privacy by design” is part of the GDPR. It requires that all products that utilize user data integrate privacy as part of the design and development process, including only capturing data that’s absolutely necessary for it to function. And under the law, big companies that use lots of data will need to hire Data Protection Officers–which has led to a hiring scramble as companies move to comply.

Some of these requirements aren’t necessarily new–but they are being applied consistently across the EU for the first time. So why do non-European companies care about GDPR? Because the sweeping regulation applies to all EU states, that means that any company that has users in Europe or European offshoots has to comply with GDPR for those particular people; companies can also offer different services in the U.S. without the same data protections that EU citizens are entitled to as a way of toeing the line.

Companies have been panicking for over a year about complying because the GDPR mandates serious repercussions for failing to do so. Companies can be fined up to 4% of their annual global turnover, or as much as $23.8 million (20 million euros), whichever fee is larger. And while the stakes are high, the exact legal details of the regulation are muddy, adding to the confusion.

Though the regulation was ratified in April 2016, companies are still struggling to comply–and the deadline is just weeks way. Emily Hancock, the newly hired data protection officer at the internet services company Cloudflare, thinks much of the panic is coming primarily from U.S. companies, where data policy has been far laxer. “It applies to all countries across Europe, but it’s an evolution of a directive that was put in place in 1995,” she says. “In Europe, companies have been dealing with these kinds of data protection regs for a long time. It’s the added penalties and the extraterritorial scope that’s causing people outside of Europe to panic.”

With all of these new regulations in mind, here’s what designers and privacy experts have to say about the way GDPR is changing their business.

1. Designers can’t play ignorant about data anymore

Thanks to GDPR, designers will be forced to reckon with the underlying technology that powers their products–namely, databases. “We’re looking at a place where it’s no longer okay for designers to not understand what a database looks like or what goes into it,” says Sarah Gold, the CEO of the London-based privacy and design organization Projects By IF.

Gold believes there are big challenges for designers when it comes to notifying people about how to delete their information from systems that are powered by machine learning–systems that are becoming increasingly prevalent. “For designers it’s going to mean understanding the databases they’re using and the kind of technology being used in services,” she says. “You need to have a much greater understanding of that to design usable, understandable, accessible design patterns in the first place.”

3. Bad Design Will Become A Pricey Liability

A key part of designing for GDPR will be answering this question: What data should this product collect? The designers I spoke with all had an easy answer: Don’t collect data if it doesn’t make the UX better.

“There’s so many [companies] collecting data and they don’t know what they’re doing with it,” Rolston says. “That’ll just stop. We’re afraid of 4%.”

Laws like GDPR could spell the end of business models based purely on data collection–mostly because the risks and costs will be too great. “Here in the Valley not so long ago, I’m talking about a year or two ago, you would hear executives talking about how they package and sell users’ data and how this is the core valuation factor in their startups or established companies,” says Gadi Amit, the founder and principal  of the San Francisco-based agency NewDealDesign. “I think the cost associated with keeping track of all the regulation is just going to go up. It’ll come to a point where, obviously there will be benefits of keeping user data, but there will be quite a lot of costs and responsibilities associated with that.”

In practice, Cloudflare’s DPO Hancock says that deciding what data to collect means asking questions like: If I pull data from an API, do I really need all the fields of data that I could get, or do I narrow it for the specific purpose of this product? When thinking about geolocation data–do I really need it? And if I do capture geolocation data, what are the risks associated with that? “That’s the thought process you’d want developers to go through earlier in the cycle rather than after the product is built and ready to ship and someone just wants to get a sign off,” she says.

In a conversation that’s been dominated by data scientists, legal experts, and researchers, Sampath believes designers are the right ones to be asking these questions.

“The next step is to empower designers to participate in this conversation: These are the pieces of data I need to improve personalization. These are the pieces of data I need to improve anticipation. And this is where we can really add value using data,” she says. “In that regard, having them be both advocates and be a bit of a check and say, this kind of data will make users wary of our experience and reduce the joy of our experience.”

4. Design Could Help Solve One Of Today’s Biggest Problems–Or Not

The new directives have created a serious design challenge: creating better, clearer interfaces that make navigating privacy easier for users.

Today, privacy settings are often buried deep inside apps where no one can find them, and privacy policies are a mess of legalese that no one reads. Amit of New Deal believes that designers are partially complicit in this, and points to Facebook’s acquisition of WhatsApp to illustrate. “You had to really dig down very deeply to prevent WhatsApp from shifting all your contacts and sending them to Facebook,” he says. It’s unclear if that UI would be noncompliant legally under GDPR, but WhatsApp’s UI certainly didn’t make this significant data sharing easy to understand or access, making it virtually impossible to get meaningful consent. “I checked with my friends, most people didn’t know that WhatsApp is preying on their contact lists,” Amit adds. That’s all done by UX and UI designers. That is something patently designed to mislead and bury something very important. So I think we need to start having  a real discussion within the design industry about cooperation and willingly playing along with those traps.”

Many companies facing GDPR are relying on a familiar interface design to comply: the “settings” screen. These ubiquitous screens don’t do much to functionally protect users, though they may be technically compliant.

“The main response for GDPR has been to put in place a dashboard where people can adjust the data sharing permissions from one central location. That for me has been a real shame,” Gold says. “The preference center is an easy way out of GDPR, but none of the research we’ve done shows any individual that’s not a privacy specialist goes into those settings. [It] is a real wasted opportunity.”

Rather than relying on these old solutions, Tiago Luchini, a partner of technology at the New York-based agency Work & Co, believes in something he refers to as “micro-consent,” where users can learn what each piece of data they’re giving up is going to be used for–and how their experience might suffer if they decide not to provide it. He uses the example to illustrate: He recently signed up for an app to run a marathon, which asked him for his ethnicity.

“I’m like, I’m not comfortable actually giving you this information. What are the implications for me as a user?” he says. Unfortunately, the field was mandatory, with no explanation. “My whole point about this is we should be able to enter a new generation of design–both from an app perspective and web perspective–where it’s not about umbrella consent. It should be very clear, like micro-consent. I’m giving you my gender–what do I get from that, and what do I lose from not telling you?” Luchini sees similarities in the pop-ups on websites that request your permission to use cookies. “It’s never clear to users as to what are the implications. If I press no, will it affect my experience? If I say yes, what kind of information am I giving away?”

He prefers a system where users can determine what information they want cookies to have on a service-by-service basis. “Maybe you’re fine with Facebook, but not one of the retargeting programs they use,” he says. “It’s a fascinating design challenge. You have to communicate back to the user every time those take place.”

Rolston agrees. “We’re going to have to get better at making those data events transparent,” he says. “Privacy becomes a virtue that gets communicated through the interface.”

6. GDPR Is Just The Beginning Of A Sea Change

Designers are already working on many of these points. For Amit, simply doing good design means upholding many of the elements of the GDPR. “If you believe in good design values, that means you lead the user to understand exactly what the app is supposed to be doing. That’s my view of it,” he says. “If you’re doing good design, inherently it means you provide people with a tool that’s clear, that is easy, that is transparent, and therefore the chances of it being misused or miscommunicated to the end user are very low.” Sampath has a similar view. “[GDPR] really gels well with our views on user experience,” she says. “In that sense any push that leads to greater transparency is a net good.”

One of the most compelling reasons to embrace the GDPR is that these kinds of data standards are here to stay–even if they haven’t hit the U.S. yet.

Rolston uses the analogy of California emissions laws. To meet the state’s more stringent standards, car companies end up building cars for all states that comply with California law because it makes more sense to just build them all to the same regulation. The GDPR is similar, in that it’s going to force companies to comply in Europe–so why not just adopt the same standard everywhere? Of the companies I spoke with for this story, both Cloudflare and Mozilla will be GDPR compliant no matter where their customers are located. Facebook said it would comply, but sneakily decided to exclude 1.5 billion of its users. Others are taking an all-or-nothing approach: Mobile advertising company Verve is pulling out of Europe entirely.

Still, Sampath is certain this kind of data law is here to stay. “GDPR is only going to be the first regulation that looks like this,” she says. “Internally we’re all pretty confident that some version of the GDPR will be coming to the U.S. in the next year and a half. It’s a nice kick in the pants to think about it ahead of time.”

Ultimately, the designers I spoke with remain optimistic that the GDPR will be good for users and businesses. “I think the net is that each company will have a more mature product that’s better for people overall, and that will have a net positive,” Rolston says. “Aligning our interests with the market will make them better products. It’ll force them to grow up.”

About the author

Katharine Schwab is an associate editor at Co.Design based in New York who covers technology, design, and culture.