Privacy Design Patterns to Emulate (CIPT – Privacy Risk Management)
Introduction
In the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge, the Privacy Risk Management domain deals with how technologists find, assess and reduce privacy risks in systems, products and services. One important topic is privacy design patterns. The BoK groups them into two types: patterns to emulate, which are good, reusable solutions, and dark patterns to avoid, which are manipulative designs. This guide covers the patterns to emulate: what they are, why they matter, how they work, and how to answer exam questions on them.
What Are Privacy Design Patterns?
A design pattern is a reusable solution to a problem that keeps coming up in a given context. The idea comes from architecture (Christopher Alexander) and was adopted by software engineering (the 'Gang of Four'). A privacy design pattern applies this idea to privacy. It is a proven, documented way to solve a recurring privacy problem in system or interface design. Each pattern is usually described by:
- Name: a shared label for the solution.
- Context: when the pattern applies.
- Problem: the privacy issue or risk being addressed.
- Solution: the approach that resolves the problem.
- Consequences: trade-offs and results of using it.
Patterns to emulate are positive. They protect individuals, build trust and help with compliance. They are the opposite of dark patterns, which trick or pressure users into sharing more data or accepting choices that are not in their interest.
Why Privacy Design Patterns Are Important
1. They put Privacy by Design into practice. Ann Cavoukian's seven foundational principles say what to aim for. Patterns give engineers concrete ways to achieve it.
2. They support compliance. GDPR Article 25 (data protection by design and by default), CCPA/CPRA and other laws expect privacy to be built in. Patterns are evidence that this happened.
3. They save time and reduce errors. Teams can reuse tested solutions instead of inventing new ones and making avoidable mistakes.
4. They create a shared vocabulary. Privacy professionals, developers, UX designers and lawyers can discuss solutions using common names.
5. They build trust. Users who see clear notices, real choices and controls are more likely to trust a product.
6. They reduce risk. Each pattern targets a specific threat, such as over-collection, unexpected secondary use, surprising disclosure or loss of control.
How Privacy Design Patterns Work: Key Patterns to Know
The CIPT material draws on the privacypatterns.org catalog, Jaap-Henk Hoepman's privacy design strategies, and UX research on notice and choice. These are the patterns and themes most likely to appear on the exam.
1. Notice-Related Patterns
- Layered notice: A short summary first, with links to more detail. Users are not overwhelmed, and full information remains available.
- Just-in-time notice: Information is shown at the moment it matters. Example: explaining why location is needed when the user taps 'find nearby stores'.
- Contextual notice: The notice is placed where the processing happens, not hidden in a long policy.
- Privacy icons/labels: Standard visual symbols, similar to nutrition labels, that show data practices at a glance.
- Privacy dashboard: One place where users can see what data is held about them and how it is used.
2. Choice and Consent Patterns
- Privacy-protective defaults: The most protective setting is the default, and users opt in to anything more. This reflects Privacy by Default.
- Granular consent: Users choose for each purpose rather than accepting one bundled 'all or nothing' option.
- Opt-in for sensitive processing: Explicit, affirmative consent is required for sensitive data or high-risk uses.
- Easy withdrawal: Withdrawing consent is as easy as giving it.
- Balanced choices: 'Accept' and 'Reject' are equally visible and equally easy to use. This is the direct opposite of the dark patterns known as 'confirmshaming' or 'misdirection'.
3. Control Patterns
- User-managed settings: Clear, findable privacy settings that are easy to change.
- Selective disclosure: Users decide which attributes to share, and with whom. Example: proving you are over 18 without revealing your birthdate.
- Data portability and access tools: Self-service download and access features.
- Deletion and account closure: Simple ways to erase data or close an account.
4. Data-Oriented (Architectural) Patterns, based on Hoepman's strategies
Hoepman defines eight strategies in two groups.
Data-oriented strategies:
- Minimize: Collect and process as little personal data as possible. Tactics are select, exclude, strip and destroy.
- Hide: Protect data from plain view. Tactics are encryption, pseudonymization, mixing and obfuscation.
- Separate: Process data in separate places or compartments, for example through decentralization, so profiles cannot easily be combined.
- Aggregate (Abstract): Process data at the highest level of aggregation with the least detail that still works. Techniques include k-anonymity, generalization and noise.
Process-oriented strategies:
- Inform: Be transparent with data subjects.
- Control: Give data subjects meaningful agency.
- Enforce: Have and enforce a privacy policy that meets legal requirements.
- Demonstrate: Be able to prove compliance through logging, auditing and reporting.
5. Other Recognized Patterns
- Anonymity set / k-anonymity: Each person is indistinguishable from at least k-1 others.
- Differential privacy: Calibrated noise is added so that aggregate results reveal little about any individual.
- Onion routing / mix networks: Hide who is communicating with whom.
- Data retention limits / automatic expiry: Data is deleted after a set period, as with ephemeral messaging.
- Location granularity: Coarse location is used when precise location is not needed.
- Sticky policies: Machine-readable policies travel with the data and govern how it may be used downstream.
How Patterns Relate to Privacy Risk Management
In the CIPT framework, risk management uses models such as Solove's Taxonomy, Nissenbaum's Contextual Integrity, Calo's harms, FIPPs, NIST PRAM and the FAIR model. These identify the risks. Privacy design patterns are among the controls that treat those risks. For example:
- Risk of surveillance or aggregation (Solove): use Separate, Aggregate or Minimize.
- Risk of insecurity: use Hide (encryption).
- Risk of secondary use: use purpose-specific granular consent and sticky policies.
- Risk of a contextual integrity violation: use just-in-time notice and contextual consent.
- Risk of exclusion (the person is unaware of or cannot take part in processing): use dashboards and access tools.
Patterns to Emulate vs. Dark Patterns
The exam often tests the contrast between the two.
- Equal-prominence choices are emulated. 'Confirmshaming' (for example, 'No thanks, I don't like saving money') is a dark pattern.
- Protective defaults are emulated. Pre-checked consent boxes are a dark pattern.
- Easy cancellation is emulated. 'Roach motel' designs, which are easy to enter and hard to leave, are a dark pattern.
- Clear notices are emulated. Obstruction and hidden information are dark patterns.
- Neutral language is emulated. Misdirection and nagging are dark patterns.
Exam Tips: Answering Questions on Privacy Design Patterns to Emulate
1. Look for the most user-protective, transparent option. When several answers seem plausible, the CIPT usually rewards the one that gives the individual the most control with the least friction, while still meeting the business need.
2. Match the pattern to the problem. Questions often describe a scenario, such as an app that needs location only for one feature. Pick the pattern that fits: just-in-time notice plus coarse location (Minimize) is better than a one-time blanket permission at install.
3. Know Hoepman's eight strategies cold. Remember MHSA (Minimize, Hide, Separate, Aggregate) for data and IICED (Inform, Control, Enforce, Demonstrate) for process. Expect 'which strategy does encryption represent?' (Hide) or 'which strategy does audit logging support?' (Demonstrate).
4. Spot dark patterns used as distractors. Pre-ticked boxes, unequal buttons, guilt-tripping text, buried settings and hard cancellation flows are never the right answer when the question asks what to emulate.
5. Remember Privacy by Default. If a question asks what the initial state should be, choose the most privacy-protective setting.
6. Layered beats long. For notice questions, layered, contextual and just-in-time approaches are generally better than one long privacy policy.
7. Granular beats bundled. Separate consent for separate purposes is preferred, especially under GDPR.
8. Link patterns to risk models. If a question cites a Solove harm or contextual integrity, choose the pattern that directly reduces that harm.
9. Watch for trade-off wording. Phrases such as 'without compromising functionality' or 'while meeting business objectives' point to positive-sum solutions, which is Cavoukian's 'full functionality' principle.
10. Read qualifiers carefully. Words like BEST, FIRST, MOST effective and PRIMARY matter. Encryption (Hide) may be good, but if the data does not need to be collected at all, Minimize is the BEST answer.
11. Minimization usually comes first. Not collecting data removes risk completely. Other strategies only reduce it.
12. Use elimination. Discard answers that shift the burden onto users, depend only on legal text, or obscure information. Then choose between the remaining options based on user empowerment and risk reduction.
Sample Question Walkthrough
A fitness app wants to share aggregated workout trends with research partners. Which approach BEST reflects a privacy design pattern to emulate?
A) Share raw data with partners under a contract.
B) Apply aggregation with k-anonymity or differential privacy before sharing, and inform users through a layered notice with an opt-out.
C) Bury disclosure in the terms of service.
D) Pre-check a consent box at sign-up.
Answer: B. It combines Aggregate, Inform and Control. C and D are dark patterns. A relies only on contract and does not reduce identifiability.
Summary
Privacy design patterns to emulate are proven, reusable solutions that put Privacy by Design into practice. They cover notice (layered, just-in-time), choice (granular, protective defaults, balanced options), control (dashboards, selective disclosure, deletion) and architecture (Hoepman's Minimize, Hide, Separate, Aggregate, Inform, Control, Enforce, Demonstrate). For the exam, identify the risk, match it to the right pattern, prefer the most protective and transparent option, put minimization first, and treat dark patterns as wrong answers.
