Human-Centred IoT Design · Study deck
IoT Research Ethics: Consent and Boundaries
Ask what is truly needed.
UX Uma is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Instead of asking whether a feature is helpful, ask what people currently do, what goes wrong, what they would notice, what they would need to override, and who else is affected.
- Explain: A worker saying "this room is always too cold" might justify a local feedback control, a facilities review, a better sensor placement plan, or a privacy-invasive occupancy history.
- Explain: A responsible design might prepare the credential, show a ready state, require biometric app confirmation, preserve keypad or physical-key fallback, and pause automation after a manual override.
Major section
Begin With the Person Who Bears the Risk
The team wants to learn when rooms are empty.
- A worker may instead feel watched or may be left in the dark while sitting still.
- Include people whose work or access differs from the easy sample.
- A fast automated choice can save effort, but it can hide bias or remove a human check.
Major section
In 60 Seconds
For connected products, ethics and research quality are tightly connected because the system can sense physical spaces, infer behavior, affect people who did not install it, and continue operating after the research session ends.
- IoT user research can fail even when a team talks to real users.
- Ethical research does not slow design down.
- It prevents false confidence, privacy creep, biased personas, harmful automation, and brittle requirements.
Major section
Ethics Protects Evidence
In IoT design, an ethics issue is often also a research-quality issue.
- A field study that records more than participants expected will produce distrust.
- A sample that includes only account owners will miss guests, technicians, caregivers, tenants, workers, and bystanders.
- The design must account for what they can understand, refuse, correct, pause, or escalate.
Major section
Ethics Protects Evidence (continued)
Complex setup can become coercive when consent, account recovery, or an essential service depends on completing unclear steps.
- A prototype that treats proximity as intent will make the product look smarter in a demo than it will be in daily use.
- Frustration is the visible symptom, not the whole risk.
- Shared environments make the issue sharper.
Major section
Ethics Protects Evidence (continued)
That protects participants and keeps the team from converting a narrow observation into an oversized requirement.
- A location-aware door, workplace occupancy sensor, medical-adjacent reminder, smart speaker, camera doorbell, or building-control system can affect people who never opened the app.
- The research plan should therefore name affected roles before recruiting participants.
- Ethics also protects future maintainability.
Major section
Ethics Protects Evidence (continued)
Multi-user conflict adds bystanders and shared-space users whose choices may differ from the account owner's.
- The ethical review should ask who bears each failure, what control or fallback remains, and whether the interface makes uncertainty and recovery understandable.
- People boundary: include account owners, shared users, guests, bystanders, staff, installers, support agents, and administrators when they are affected.
- The practical reason to do this early is that the same study evidence can support very different decisions.
Major section
Ethics Protects Evidence (continued)
Action boundary: separate low-risk suggestions from actions that change access, safety, privacy, money, health, comfort, or shared-space conditions.
- A worker saying "this room is always too cold" might justify a local feedback control, a facilities review, a better sensor placement plan, or a privacy-invasive occupancy history.
- The ethical design asks which decision the evidence actually supports and what the evidence does not prove.
- An account owner can approve a device, but a child, visitor, cleaner, night-shift worker, patient, tenant, installer, or neighbor may be sensed or affected.
Major section
Pitfalls as Design Constraints
If a phone is near a lock, the signal may be GNSS, BLE RSSI, UWB ranging, Wi-Fi association, or an app geofence.
- A responsible design might prepare the credential, show a ready state, require biometric app confirmation, preserve keypad or physical-key fallback, and pause automation after a manual override.
- If automation affects access, the design may require explicit confirmation and an audit trail.
- A safeguard that cannot be tested is still only an intention.
Major section
Pitfalls as Design Constraints (continued)
Instead of asking whether a feature is helpful, ask what people currently do, what goes wrong, what they would notice, what they would need to override, and who else is affected.
- If occupancy data supports comfort tuning, the acceptance condition may require aggregation and a worker-facing explanation.
- If support diagnostics are needed, the support view may show event ids, firmware version, and device state without exposing unrelated video or location history.
- Those signals are not separate from UX research; they are evidence that the original study missed a role, context, failure mode, or maintenance burden.
Major section
Ethics Reviews Need Handles
A pitfall review becomes enforceable when it is tied to concrete implementation handles.
- Privacy creep may map to event schema fields, telemetry flags, retention TTLs, role-based access control, OAuth scopes, support-console permissions, export/delete jobs, and data warehouse tables.
- Inference risk also needs system names.
- System handles make ethical promises auditable.
- Engineering should also test absence.
Major section
Ethics Reviews Need Handles (continued)
Weak consent may map to consent version, collection purpose, recording indicator state, participant withdrawal status, and whether a device keeps sending telemetry after study closeout.
- Consent can be represented by purpose_id, consent_version, granted_at, withdrawn_at, data_category, retention_until, and sharing_scope.
- Automation risk can be represented by confidence, source list, stale_after, override state, last_manual_action, and consequence tier.
- Those fields let tests assert that the system behaves according to the review.
- The same record helps when the product changes.
Major section
Ethics Reviews Need Handles (continued)
A privacy-preserving occupancy feature should not emit named-user room histories.
- A support dashboard for setup recovery should not expose unrelated household routines.
- A study closeout should stop telemetry collection or switch the device back to normal product logging.
- An export or deletion request should include downstream stores, analytics tables, retained MQTT topics, and partner webhooks if they hold the affected data.
Major section
Pitfall Review Loop
The record preserves the reasoning, limits, and unresolved issue for reviewers.
- The system senses motion, infers that a room may be empty, and acts by turning lights off.
- A still worker is the hard case: the signal can be absent while the person is present.
- The ratings shown are prompts for validation, not trial results.
Deck summary
Key takeaways
The team wants to learn when rooms are empty.
- For connected products, ethics and research quality are tightly connected because the system can sense physical spaces, infer behavior, affect people who did not install it, and continue operating after the research session ends.
- In IoT design, an ethics issue is often also a research-quality issue.
- Complex setup can become coercive when consent, account recovery, or an essential service depends on completing unclear steps.
- That protects participants and keeps the team from converting a narrow observation into an oversized requirement.
Retrieval practice
Recall check 1 of 4
UX Uma says: answer from memory, then check your reasoning.
Q1A team wants to use workplace comfort sensors to tune HVAC without making occupants feel monitored. Which ethics review record is strong enough?
Show answer
Answer: C IoT ethics review should tie sensing, consent, affected roles, safeguards, validation, ownership, and change conditions to the design decision.
Retrieval practice
Recall check 2 of 4
UX Uma says: answer from memory, then check your reasoning.
Q2A comfort sensor infers that a worker wants a different room setting. Which first action fits an uncertain inference?
Show answer
Answer: C An uncertain signal permits a suggestion; changing a shared setting needs a decision that accounts for the affected people.
Retrieval practice
Recall check 3 of 4
UX Uma says: answer from memory, then check your reasoning.
Q3A team asks only early fans, “Is our new automation helpful?” and writes every yes as proof. Which change addresses the main research bias?
Show answer
Answer: D Recruit affected roles, ask neutral task questions, and label observation apart from inference.
Retrieval practice
Recall check 4 of 4
UX Uma says: answer from memory, then check your reasoning.
Q4A researcher sees a worker turn off a comfort alert and writes, “Workers distrust the system.” What should the study record say?
Show answer
Answer: D The action was seen; the reason is an inference until the team gathers more evidence.
Print reference
Answers
Answer key.
- C · IoT ethics review should tie sensing, consent, affected roles, safeguards, validation, ownership, and change conditions to the design decision.
- C · An uncertain signal permits a suggestion; changing a shared setting needs a decision that accounts for the affected people.
- D · Recruit affected roles, ask neutral task questions, and label observation apart from inference.
- D · The action was seen; the reason is an inference until the team gathers more evidence.