Category Archives: Legal

Legal, Privacy, Psychology

System 1 and System 2 in testing – part 2

In the previous blog post System 1 and System 2 were introduced.

For the fast observations System 1 is used in most cases. This way of thinking provides fast, almost effortless way to digest information. Like walking to a cinema.

For the thoughtful observations System 2 is used. An example is choosing which movie to watch in a cinema.

There was a focus on System 1 in the previous episode. In this episode I will turn your attention to System 2. And how this system might lead to other test ideas.

Supporting System 2

Categorising

During my regular visit to the web site, I was welcomed with a cookie banner. My first thought was to reduce the number of cookies to an absolute minimum. Of, course I could accept all cookies. But I pressed the Options button. Three groups of cookies were presented.

Each group of cookies had an explanation and a radio box for selection. I only chose the necessary cookies. The text was shown in agreeable font size, so i did not have to pinch my eyes to read it.

Then I had to look to the buttons. The button to accept all the cookies was in the right lower corner. The Save and Exit button was left to it. I pressed the button and was ready to use the web site.

“Categorised cookies, a simple explainer,
no scrolling needed, a normal sized font size.
These are a few of my favourite things.”
(On the melody of “My favorite things”)

Pondering

It was time for a new headset for my PC. I had already done my homework: I found a good headset. I only had to buy it.

After clicking on the link in my notes, the web page with the right product was shown in my browser. I added it to my shopping cart and opened the order form with the usual questions.

Yes, I would like the headset be delivered to my home address. And I was home on the first suggested date. Of course, I wanted to enter some numbers from my gift cards.

Now I only needed to pay. I chose the cheapest option. Sorry, I am Dutch.

In short, I had to answer some questions and there were some good suggestions from the web site. Thanks for the support.

Knowledge about System 2 in good hands

A well-designed program simplifies the choices of the user. It reduces the time to make an informed decision.

Abusing System 2

Micro selecting

In my never-ending quest for information, I encountered a new cookie banner. I like to minimise the number of my cookies, so I wanted to change the settings. A dialog opened for my eyes.

While l tried to get an overview, I had to scroll down. There were about 9 groups of cookies. The categories looked almost identical. The selection of the permission was represented by a circle in the left side of some ellipse. It looked nice, but we do not use these switches in the Netherlands.

Now I had a screen reader installed for accessibility testing. This program tells what is happening on screen. I pressed the switch and heard that it was switched on. I did not like it. Another press let my screen reader announce that the switch was off.

“Scrolling down, another switch,
‘Legitimate interest’,
based on some law, which I don’t know.
Keep me safe, privacy laws“
(On the melody of  the chorus of “Take Me Home, Country Roads”)

But wait, there was more. There was a link for vendor information. After a click, I saw every single vendor with 1 or 2 switches. And the font size on the cookie banner was smaller than the font size on the web page.

This was an overwhelming experience for me. And it was not clear which options led to which consequences for me.

“Individual cookies, enormous explainer,
a scrollbar required, a small sized font size
These are a few of my dislikeable things.”
(On the melody of “My favorite things”)

Knowledge about System 2 in bad hands

Nowadays it is impossible to use programs or web sites without making choices. An abundant number of options may strike fear.

“When System 2 rules, when the user thinks,
when anxiety grows,
there were too many choices to be made
and an increasing fear.”
(On the melody of “My favorite things”)

To be continued

Accessibility, Legal, Psychology

System 1 and System 2 in testing – part 1

In March 2024 Daniel Kahneman died. He wrote ”Thinking fast and slow”. This book is about how people handle certain situations. He introduced System 1 and System 2.

For the fast observations System 1 is used in most cases. This way of thinking provides fast, almost effortless way to digest information. Like walking to a shop.

For the thoughtful observations System 2 is used. An example is choosing which things to buy in a shop based on a shopping list or availability.

The way users behave, can lead to good test
ideas.

Supporting System 1

Pointing

For a test I needed a program. As usually, I went to the system administrator. He gave me some instructions to install the program on my own. I had to change one setting and only needed to press the Next button.

My thought process was like: is this the option? Yes, change it and press the Next button. Otherwise press the Next button. I had the program installed within minutes.

It went so smoothly, because the Next button was on the same place every time.

“The right lower corner of a well designed
dialog,
the group of a similar looking buttons.
These are a few of my favourite things.”
(On the melody of “My favorite things”)

Simplifying

One of the consequences of the privacy laws is the cookie banner. On one of my favourite web site there are only two buttons: ”Yes, I agree” and “No, thanks” buttons, This is clear and concise.

Knowledge about System 1 in good hands

A good design of the program stimulates the user to use System 1. The program is easy to use.

Abusing System 1

Hiding

In the past I stumbled on a cookie banner. It had the Accept All button and a More Info button. If I really wanted to visit this web site, then I needed to accept all the cookies. Something I was not looking forward to. It was also not compliant with the privacy laws. There was no way to reject the cookies.

But I was curious, I pressed on the More Info button, A dialog popped up with options to reject cookies. If I only used System 1, then I got unwanted cookies on my PC.

Distracting

On a cookie banner from another web site, I was looking for a way to avoid unnecessary cookies. In the right lower corner of the dialog there were no buttons. This is my favourite place to look for buttons.

My view went up and I noticed the Accept All button. It had a different background colour than the body of the dialog. I was about to press this button, when I noticed another button to the left.

The Reject all button had the same background as the body of the dialog. It did not get my attention because of the colours of the Accept All button.

This particular button had also a bigger impact on people, who have problems with reading. They might prefer the emphasised Accept All button over the normal Reject All button. Also. people with visual impairment would make the same choice because of the bad contrast.

“The right upper corner of a bad designed
dialog,
the group of different looking buttons.
These are a few of my dislikeable things.”
(On the melody of “My favorite things”)

Knowledge about System 1 in bad hands

It is possible to make programs in such way that people make bad choices. These situations are called dark patterns. Especially disabled people are easy victims.

“When System 1 rules, when the user clicks,
when the cookies come,
there was nor second thought, nor hesitation,
just a silent urge.”
(On the melody of “My favorite things”)

To be continued.

Accessibility, Legal

Dark Patterns For Disabled People

Years ago, I wanted to buy a car, so I tested the car. Everything went smooth, until I drove fast. “Huh?”. The sound of the car was different. I could not figure out why.

Afterwards I told the owner about this strange sound. His reaction was: “The car has winter tires.” I was driving in spring, so the hard tires made a lot of sound on the road.

If I would use these tires during spring and summer, then they would wear out more quickly than normal tires. That was not my intention.

My heuristic or effective way to determine this situation was: “Huh?”. For me, a heuristic is based on experience and useful in most cases.

I’m a tester after all

Some legal background

The last years the web sites changed for the users. General Data Protection Regulation, a European law, and California Consumer Protection Act, a Californian privacy law, became effective. For a tester like me these laws are legitimate reasons to report a bug.

For me, a law is an oracle, a reliable truthful source of information.

GDPR, General Data Protection Regulation, and CCPA, California Consumer Protection Act, explicitly require\ websites to request information from their website visitors.

The most popular way to gather information is cookies. A lot of people will think of sweet snacks as shown in the picture in the top of this blog post.

Today cookies are also small files left on the PC of the user. In the past cookies were mostly used for the proper working of the website. I need to buy a car with a digital radio and the website keeps track of my order. “That’s a good boy.”

Over time cookies were also used to increase sells. “Thanks for showing the cars with digital radio advertisements, but I do not consume them on an hourly basis.”

Disclaimer

I am not a legal expert, so it is better to consult your Legal department.
I am just a tester finding test ideas about privacy laws.
Thanks for joining in advance.

Some disabled personas

In the tester community personas can be useful during testing. Let me introduce some personas:

  1. My name is Andrew. I am blind.
  2. My name is Brian. I have a cognitive problem and have trouble to concentrate.
  3. My name is Cate. I am visually impaired. I cannot read small words or recognise small objects.

These personas will be used for testing a cookie banner. For them this is that annoying window popping up at the bottom of a website. Asking for all kinds of permissions.

Some first impressions

There is a simple trick to show a cookie banner: open the website in incognito mode. In this mode there are no cookies, so permission should be asked to gather personal information.

Heuristic in action

Cate has a mobile phone with increased font size. This way she can still read what is on her screen. It is easy for me to change the settings to get the same experience.

The cookie banner is too big for the screen. There is no scrollbar available. Huh? I cannot read all the information.

A cookie banner could contain a text like this:
“We use cookies for a number of reasons, such as keeping our sites reliable and secure, personalising content and ads, providing social media features and to analyse how our sites are used.”

Huh? For Brian with concentration problems, this is too much information to digest. Even I have to read this sentence several times to understand why cookies are used.

Andrew is blind and uses a screen reader, which reads the text aloud. He is fully aware of the presence of cookie banners.

I use the Tab key to get to the text of the cookie banner. After a lot of tabs, I hear the title of the banner and then “Accept”. Huh? The text of the banner is skipped. I went straight to the “Accept” button.

A look at the oracles

Andrew and Cate, the personas with sight problems, must be able to access all the information.

Note to the reader: in this blog post I will quote from some laws to show how I use oracles for testing purposes. If you want to save some time, then you can write down only the specific quote. E.g. GDPR Article 5. And continue reading after this article.

GDPR Article 5:
1.Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
Article 2 CCPA (2)
The notice at collection shall be designed and presented in a way that is easy to read and understandable to consumers. The notice shall:
[...]
d.
Be reasonably accessible to consumers with disabilities.

Brian is not able to understand all the shown information.

GDPR
Article 7; clear and plain language
2.If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

According to me Brian with a concentration problem did not get “an intelligible and easily accessible form”.

Some people think, that personal information is only shared with colleagues in the same company. It is possible to share this information with partners.

Imagine me looking for a car with a digital radio. “Huh? A car dealer from another company only showed me cars with digital radios.” He did not pay a penny for my thoughts.

It is even possible to sell this information to other companies. “Huh? When I visit a website, I see a lot of digital radio advertisements.” There is enough room, but I really need only one.

For all these situations I have to give permission in the cookie banner.

GDPR
Article 6:
4.Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia: (a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
CCPA Article 2:
§ 999.305. Notice at Collection of Personal Information.
(a) Purpose and General Principles
(1)
The purpose of the notice at collection is to provide consumers with timely notice, at or before the point of collection, about the categories of personal information to be collected from them and the purposes for which the personal information will be used.

Some buttons

Writing about giving permissions reminds me about buttons.

In many cookie banners there is a button to change the settings of the cookies. A lot of information and options are shown. There is a general story about the cookies. Then a list of all options is shown.

Heuristic in action

Let me show a button.
A horizontal button with the switch on the left!
Huh? Is this permission switched on or off?

There are cookie banners with a switch on the right in grey. After switching the button to the left the button with a switch on the left is shown. Huh? Brian with a cognitive problem has a tough time to figure this one out.

I might assume that the button is switched on in the left.
This is even not clear for people with normal sight. At first sight.

After clicking, the button will be shown in dark lines instead of grey lines. Huh? Brian is still struggling with the button.

Let me click the button switching from light grey to dark grey. Huh? Something might have changed for Cate with a bad sight. The contrast is not good enough to show which permission has been given.

There are at least 20 lines of information and permission. Huh? Brian with concentration problems is having a serious problem with all the information of the cookie banner.

Andrew, a blind person will use NVDA, a screen reader. I press on the button. Huh? I hear nothing. Is the button is switched on? Andrew would not have any clue at all.

A look at the oracles

During my research I was curious whether disabled people could rely onb any helpful articles in privacy laws.

GDPR Article 12; 1.
The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

Article 13 is about information to be provided where personal data are collected from the data subject.

I interpret these articles as follows: asking permission from a disabled person is like asking them to sign a contract.

According to me “electronic means” includes things like using buttons, which can provide information about the state. For example the button for permission to share information with partners is switched on.

Basically, A blind person must be able to understand the contract before signing.

CCPA Article 2. Also refers to ... 
For notices provided online, the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Web Consortium, incorporated herein by reference. In other
contexts, the business shall provide information on how a consumer with a disability may access the notice in an alternative format.
(3)
The notice at collection shall be made readily available where consumers

In this article there is a direct reference to accessibility standards.

Some confirmations

Now it is time to save the changed permissions.

Heuristic in action

Cate is not able to see small details. In a browser on a Windows computer, it is possible to use the Ctrl key and minus key at the same time to zoom out. I do this several times.

A solid green button is shown. This might be the Save button. I zoom in by pressing the Ctrl key and the plus key at the same time. Huh? I noticed that this is the “Accept all cookies” button.

Let me continue with experiencing Cate with a bad sight. I zoom out again using the Ctrl key and minus key several times in a row. Huh? There is no button to save the selected permissions.

I zoom in again using the Ctrl key and plus key several times in a row. Huh? A white button with a small green border appears. It is for “Save and exit”.

Brian with concentration problems has too much information to digest and presses a button. Huh? Did I give all permissions with the first button?

A look at the oracles

As oracles I use GDPR Article 12 1. and CCPA CCPA Article 2. These are described a few paragraphs above.

Disabled people must be able to fully understand, what they are agreeing to.

Some dark patterns

In this blog post I described some situations which can have disadvantages for disabled people. It is tempting to give a permission to a website, just to see a webpage.

For me, a dark pattern is an intentional or unintentional way to convince users to make choices without providing clear information. In all cases a tester should have a good look or listen to the website.

Some things to test

A lot of companies tend to buy software for cookie banners. This is a reasonable thing to do, because there are a lot of privacy laws in place. Cookie banner software takes care of all those differences in the international and national laws.

For the concerning people, there are different rules for countries within the European Union regarding GDPR. It is hard to keep track of them.

If your company wants to buy this software, it is advised to test it on accessibility. Ask for a website using this software and watch out for “Huh?”.

It is like buying a car. If I did not pay enough attention to the tires, then I would have a serious driving problem. If the car is broken, then the owner is still responsible.

Thanks for coming to my TED talk.

Some legal resources

These sources can be used as oracles:

  1. Overview of references to GDPR law in different languages
    https://op.europa.eu/en/publication-detail/-/publication/3e485e15-11bd-11e6-ba9a-01aa75ed71a1/language-en
  2. CCPA fact sheet
    https://oag.ca.gov/system/files/attachments/press_releases/CCPA%20Fact%20Sheet%20%2800000002%29.pdf
  3. CCPA full legal text
    https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oal-sub-final-text-of-regs.pdf
  4. A global overview of GDPR
    https://mindfultester.com/may-2018-testing