Human-Centred IoT Design · Study deck
IoT Research Ethics: Context and Uncertainty
"The phone is near the home, so the user wants the door unlocked.".
UX Uma is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Test pitfall 1: treating context as certainty with a concrete scenario and pass criteria.
- Validate concept check: order the ethics review with a concrete scenario and pass criteria.
- Explain: These signals are useful, but they are not proof of what a person wants.
- Explain: Privacy creep happens when a team collects more data than the feature needs because the data might be useful later.
Major section
Pitfall 1: Treating Context as Certainty
These signals are useful, but they are not proof of what a person wants.
- "The phone is near the home, so the user wants the door unlocked.".
- "The phone is near the home, but intent is uncertain.
- Low-impact, reversible actions may be automated after evidence supports them.
Major section
Pitfall 2: Privacy Creep
Privacy creep happens when a team collects more data than the feature needs because the data might be useful later.
- "Collect raw presence, location, room activity, and device events continuously so future personalization features have data.".
- Privacy-respecting design does not rely on hidden settings or dense policy text.
- It makes the data practice visible enough for a reasonable user to understand the exchange.
Major section
Pitfall 3: Weak Consent
Consent is weak when people do not understand what is being recorded, what will happen to the data, or whether participation is optional.
- Good consent should be specific, understandable, and reversible.
- Participants should know what is collected, why it is collected, who will access it, how long it will be kept, and how to withdraw where withdrawal is feasible.
- For shared spaces, consent planning should include affected people, not only the account owner.
Major section
Pitfall 4: Sampling Bias
Sampling bias happens when the team studies people who are easy to recruit instead of people who represent the design decision.
- Sampling bias does not mean every study needs a large sample.
- If the decision affects shared access, include shared-access roles.
- If the decision affects installation, include installers or first-time setup participants.
Major section
Pitfall 6: Over-Automation
Automation fails when it removes control before trust is earned.
- Suggest: the system recommends an action but waits for the user.
- Act with easy override: the system acts, shows what happened, and makes reversal simple.
- Automation quality is not measured only by whether the rule fires.
Major section
Ethics Review Record
Owner and validation fields make the response testable; a concern is not closed merely because it was recorded.
- The decision and evidence fields state what feature or method is under review and what observations support the concern.
- An evidence boundary prevents a small interview or prototype result from being treated as proof about everyone.
- Risk and safeguard then connect a privacy, safety, control, or access issue to a concrete change.
Major section
What to Record
Evidence: observations, interviews, logs, support records, field notes, or prototype findings.
- Evidence boundary: what the evidence does and does not prove.
- Affected roles: users, buyers, installers, guests, bystanders, caregivers, operators, technicians, administrators, and support staff.
- Risk: consent, privacy, safety, bias, control, accessibility, maintenance, or support risk.
- Validation: how the team will check whether the safeguard works.
Major section
Incremental Examples
A home lighting system turns lights on when it detects a person in a room after sunset.
- Field notes show that presence detection works in normal evenings.
- A manual wall switch is still expected to work.
- A building team wants to use temperature, occupancy, and comfort feedback to tune heating and cooling.
- Facilities staff need actionable location and time information.
Major section
Incremental Examples (continued)
context inference error. Privacy discomfort if occupancy history is shown too broadly. Annoyance when automation contradicts occupants. Accessibility issue if the only override is in the app.
- Workers worry that occupancy data could be used for surveillance.
- Some areas have intermittent connectivity and irregular use.
- The camera doorbell records visitors and bystanders, not only account owners.
Major section
Incremental Examples (continued)
privacy creep from unnecessary individual tracking. Sampling bias if only office-based staff are surveyed. Weak consent if sensors are installed without explanation. Overconfident automation that changes comfort without local feedback.
- A property team studies a shared-entry system that combines phone credentials, a camera doorbell, installer tools, and support-console diagnostics.
- BLE RSSI and UWB ranging help estimate whether a credential holder is near the reader, but neither signal proves intent.
- MQTT access events, device-shadow state, firmware version, reader offline intervals, and support tickets help diagnose setup failures.
Major section
Common Defects
Consent theater: a form exists, but participants do not understand what is sensed or recorded.
- Owner-only thinking: the account owner is studied, but affected people are ignored.
- Early-adopter drift: the team optimizes for technical users while the product requires mainstream reliability.
- False certainty: location, presence, time, or routine is treated as user intent.
Major section
Common Defects (continued)
Dark defaults: privacy-invasive features are enabled by default or hidden behind confusing settings.
- Happy-path evidence: setup success is observed, but failure, maintenance, support, and removal are not.
- No disconfirmation rule: the team never states what evidence would change the design.
- Stale evidence: the decision survives after product, context, sensing, or policy changes make the evidence stale.
Major section
Why a Proximity Signal Cannot Stand for Intent
Location is a measurement with sampling delay and uncertain association to a person.
- The app may receive a stale position after the phone has moved, and a shared device may identify the wrong actor.
- The decision record therefore separates observed signal, inferred situation, authorised action, and evidence for that authorisation.
- The chapter’s signal-versus-inference distinction makes the boundary inspectable.
Major section
Summary
IoT research quality and ethics are inseparable.
- A team can make a harmful or low-quality design decision when it overtrusts context signals, collects unnecessary data, studies the wrong people, asks leading questions, hides automation, or ignores affected bystanders.
- The practical defense is an evidence-bound review record.
- This keeps ethical concerns connected to design action instead of leaving them as vague warnings.
Deck summary
Key takeaways
These signals are useful, but they are not proof of what a person wants.
- Privacy creep happens when a team collects more data than the feature needs because the data might be useful later.
- Consent is weak when people do not understand what is being recorded, what will happen to the data, or whether participation is optional.
- Sampling bias happens when the team studies people who are easy to recruit instead of people who represent the design decision.
- Automation fails when it removes control before trust is earned.
Retrieval practice
Recall check 1 of 2
UX Uma says: answer from memory, then check your reasoning.
Q1A team observes that a presence sensor usually detects when residents enter a room, then decides the system should automatically unlock a shared storage cabinet whenever presence is detected nearby. What is the strongest review concern?
Show answer
Answer: A IoT ethics review connects evidence strength, affected roles, consequence, transparency, and user control.
Retrieval practice
Recall check 2 of 2
UX Uma says: answer from memory, then check your reasoning.
Q2A door app receives a phone proximity event while the phone is shared. What should authorize unlocking?
Show answer
Answer: A The chapter separates a location signal from a person’s intent.
Q3A comfort sensor suggests a worker prefers a colder room. Which record keeps the inference reviewable?
Show answer
Answer: B The record separates observation, inference, and action.
Print reference
Answers
Answer key.
- A · IoT ethics review connects evidence strength, affected roles, consequence, transparency, and user control.
- A · The chapter separates a location signal from a person’s intent.
- B · The record separates observation, inference, and action.