Study guide
15.2 Value Sensitive Design
Certified Information Privacy Technologist CIPT
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIPT Exam Overview and Study Plan
1.1 CIPT Exam Facts, Blueprint, and Study Plan
2 Chapter 2: The Privacy Technologist's Legal and Procedural Role
2.1 Privacy Function Roles: DPO, Data Owner, Steward, Custodian, Legal, and Security 2.2 Translating Legal and Regulatory Requirements into Technical Controls 2.3 Notices, Policies, and Oversight of Privacy Operations, Audits, and Third Parties
3 Chapter 3: Technical Responsibilities: Risk Concepts and Incident Response
3.1 Risk Concepts: Threat, Vulnerability, Attack, Exploit, and Privacy Risk 3.2 Technical Support for Privacy Incident and Breach Response
4 Chapter 4: Privacy Risk Models, Frameworks, and Threat Models
4.1 Privacy Risk Models and Frameworks: Contextual Integrity, Calo, Solove, FIPPs, OECD, NIST, and FAIR 4.2 Privacy Threat Models: LINDDUN and MITRE PANOPTIC
5 Chapter 5: Data Ethics and Automated Decision-Making
5.1 Legal Versus Ethical Processing and the Social Impact of Privacy-Affecting Designs 5.2 Identifying and Minimizing Bias in Automated Decision-Making
6 Chapter 6: Minimizing Privacy Risk During Data Collection
6.1 Notice, Consent Management, and Choice Architecture 6.2 Managing Privacy Risk in Automatic Collection and Telemetry 6.3 Extracting Personal Data from Publicly Available Sources 6.4 Data Retention, Destruction, and Cryptographic Erasure 6.5 Data Minimization Techniques 6.6 Implementing Data Processing Segregation
7 Chapter 7: Minimizing Privacy Risk During Data Use: Aggregation, PETs, and Secondary Use
7.1 Minimizing Privacy Risk from Aggregation and Inference 7.2 De-identification, Pseudonymization, and Tokenization 7.3 Microdata Protection: k-Anonymity, l-Diversity, and t-Closeness 7.4 Advanced PETs: Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption 7.5 Secondary Use, Function Creep, and Purpose Limitation Controls
8 Chapter 8: Minimizing Privacy Risk During Dissemination
8.1 Disclosure and Accessibility Controls: APIs, Egress, and Clean Rooms 8.2 Countering Distortion, Exposure, Breach of Confidentiality, Blackmail, and Appropriation 8.3 Defense in Depth: Identity, Access Management, and Authentication
9 Chapter 9: Intrusion, Decisional Interference, and Dark Patterns
9.1 Minimizing Intrusion and Decisional Interference: Behavioral Advertising, Profiling, Cyberbullying, and Social Engineering 9.2 Dark Patterns and Deceptive Design
10 Chapter 10: Privacy Risks Related to Software Security
10.1 Detecting and Fixing Software Privacy Vulnerabilities 10.2 Intrusion Detection and Prevention, and Privacy in Change Management 10.3 Service Providers, Third-Party SDKs, and Supply Chain Risk
11 Chapter 11: Tracking and Surveillance Technologies
11.1 Privacy Risks and Impacts of E-Commerce 11.2 Audio and Video Surveillance, Wearables, and IoT 11.3 Privacy Issues Around Biometrics: Facial, Voice, Fingerprint, and DNA Data 11.4 Privacy Risks and Impacts of Location Tracking 11.5 Internet Monitoring and Web Tracking: Cookies, Fingerprinting, and GPC
12 Chapter 12: Workplace Technologies: AI, Communications, and Monitoring
12.1 Identifying and Minimizing Privacy Risks in AI, Machine Learning, and Deep Learning 12.2 Privacy Risks of Communications Technologies: Video Calls, Messaging, Mobile Devices, Social Media, and Gaming 12.3 Workplace Monitoring and BYOD Privacy
13 Chapter 13: Monitoring and Managing Privacy Risk
13.1 Privacy Audits, IT Control Reviews, KRIs, and KPIs 13.2 Completing Privacy and Data Protection Impact Assessments
14 Chapter 14: Implementing Privacy by Design
14.1 Cavoukian's Seven Foundational Principles of Privacy by Design 14.2 Privacy Goals, Objectives, and Translating High-Level Specifications into Low-Level Specifications 14.3 Hoepman's Privacy Design Strategies: Data-Oriented Strategies 14.4 Hoepman's Privacy Design Strategies: Process-Oriented Strategies
15 Chapter 15: Evaluating Privacy Risks in User Experiences
15.1 Privacy in User Experience: UX Concepts and Usability Testing 15.2 Value Sensitive Design
16 Chapter 16: Privacy Engineering Objectives, Architecture, and the Development Life Cycle
16.1 NIST Privacy Engineering Objectives: Predictability, Manageability, and Disassociability 16.2 Enterprise Architecture, Data Flow Mapping, Lineage, and Cross-Border Transfers 16.3 Managing Privacy Risk in the Software Development Life Cycle 16.4 Applying LINDDUN Threat Modeling in Engineering
17 Chapter 17: Managing and Monitoring Privacy Controls
17.1 Data Inventories, Records of Processing Activities, and Asset Discovery 17.2 Privacy Code Review and Runtime Behavior Monitoring
15.2 Value Sensitive Design
Key Takeaways Explain This Topic AI
Value Sensitive Design, developed by Batya Friedman and colleagues at the University of Washington, integrates conceptual, empirical, and technical investigations iteratively.
Conceptual investigations identify stakeholders and values; empirical investigations study how people actually experience the technology; technical investigations examine and design mechanisms that support the values.
Indirect stakeholders are affected by a system without using it, such as bystanders filmed by a doorbell or people in an uploaded address book, and they often bear the privacy harm.
VSD makes value tensions, such as safety versus privacy, explicit and seeks designs that serve both.
Tools such as value scenarios and envisioning cards help teams anticipate misuse, long-term effects, and widespread adoption.
Last updated: October 2026
15.2 Value Sensitive Design
Quick Summary: Value Sensitive Design (VSD) is a method for building technology that accounts for human values, such as privacy, autonomy, trust, and fairness, throughout design. It combines conceptual , empirical , and technical investigations, applied iteratively, and pays special attention to indirect stakeholders : people affected by a system who never use it. The BoK asks technologists to understand and apply VSD.
VSD was developed by Batya Friedman and colleagues at the University of Washington beginning in the 1990s, and is described in depth in Value Sensitive Design: Shaping Technology with Moral Imagination (Friedman and Hendry, MIT Press, 2019). It treats values as design requirements rather than afterthoughts.
The Three Investigations
VSD operates through an iterative tripartite methodology comprising three interrelated modes of investigation: +--------------------------------------------------------------------------+
- | VALUE-SENSITIVE DESIGN: TRIPARTITE METHODOLOGY |
- +--------------------------------------------------------------------------+
- | |
- | +-------------------------+ +-------------------------+ |
- | | Conceptual Investigation| <--------> | Empirical Investigation | |
- | | - Philosophical values | | - Human user research | |
- | | - Stakeholder mapping | | - Mental models & tests | |
- | | - Value trade-offs | | - Comprehension metrics | |
- | +-------------------------+ +-------------------------+ |
- | ^ ^ |
- | | | |
- | +------------------+-------------------+ |
- | v |
- | +-------------------------+ |
- | | Technical Investigation | |
- | | - Architectural design | |
- | | - System mechanisms/PETs| |
- | | - Implementation audit | |
- | +-------------------------+ |
- +--------------------------------------------------------------------------+
- 1. Conceptual Investigations
Conceptual investigations involve philosophical, ethical, and legal analyses of the values at stake:
Value Articulation: Defining explicitly what "privacy" and "autonomy" mean within the specific system context (e.g., disassociability, informational self-determination, freedom from profiling).
Stakeholder Mapping: Differentiating between direct stakeholders (individuals who directly interact with the interface, such as registered app users) and indirect stakeholders (individuals who never touch the system but whose data is processed, such as contacts in uploaded address books or bystanders captured by smart doorbells).
Resolving Value Trade-offs: Systematically resolving tensions between competing values—such as balancing user accountability and fraud prevention against anonymity and data minimization.
2. Empirical Investigations
Empirical investigations apply qualitative and quantitative human research methodologies to evaluate how stakeholders actually experience the technology:
Mental Model Research: Conducting contextual inquiries and interviews to understand how users perceive data flows and algorithmic processing.
Usability and Comprehension Testing: Running behavioral experiments to evaluate whether users comprehend notice language and can successfully navigate privacy settings.
Investigating the Privacy Paradox: Observing real-world user choices versus stated attitudes to identify where deceptive interface nudges subvert conscious intent.
3. Technical Investigations
Technical investigations focus on the operational and architectural properties of the technology itself. This mode consists of two activities:
Technical Mechanism Analysis: Evaluating how existing system architectures, data schemas, API protocols, and UI components support or undermine the values identified in conceptual investigations.
Proactive Architectural Design: Engineering novel technical mechanisms that embody identified values. In privacy engineering, this includes implementing client-side cryptographic hashing, zero-knowledge proofs, automated retention TTLs, and symmetric choice interfaces that make privacy preservation the path of least resistance.
Key VSD Concepts and Tools
Direct and indirect stakeholders. Direct stakeholders use the system; indirect stakeholders are affected without using it, such as people in a user's uploaded contacts, bystanders recorded by a smart doorbell, or patients whose data trains a model. Privacy harms often fall on indirect stakeholders, who cannot consent or adjust settings.
Value tensions. Values conflict: safety and privacy, convenience and autonomy, transparency and security. VSD makes tensions explicit and looks for designs that honor both values, echoing Cavoukian's positive-sum principle.
Value scenarios. Short stories that imagine how a system affects stakeholders over time, including misuse and long-term or widespread adoption.
Envisioning cards. A card deck (Friedman and colleagues) prompting designers to consider stakeholders, time, values, and pervasiveness.
Iteration. The three investigations feed one another repeatedly rather than running once in sequence.
Worked Example: A Smart Doorbell
Investigation Questions and Findings Design Response
Conceptual Direct stakeholder: homeowner (values safety, convenience). Indirect stakeholders: neighbors, passersby, delivery workers (value privacy and freedom from surveillance). Tension: safety versus bystander privacy. Treat bystander privacy as a requirement, not an afterthought
Empirical Interviews show neighbors object to cameras that capture their doorways; delivery workers do not know whether audio is recorded. Add visible recording indicators; default audio off
Technical Camera field of view covers the street; cloud stores all video for 60 days; police request portal shares footage. Privacy zones that mask neighboring property; on-device person detection; short default retention; footage shared only with the owner's explicit choice per request
The result protects the homeowner's safety goals while reducing harm to people who never agreed to be filmed, which is VSD's purpose.
Applying VSD in a Privacy Program
VSD fits naturally into the processes covered elsewhere in this guide:
Privacy impact assessments (Section 13.2): the conceptual investigation supplies the stakeholder list and the values at stake, including indirect stakeholders a data-centric DPIA might miss.
Privacy goals (Section 14.2): values identified in VSD become explicit goals and measurable objectives.
Usability testing (Section 15.1): empirical investigations reuse the same methods, but ask what people value and fear, not only whether they can complete a task.
Design reviews: technical investigations become a checklist item: which mechanism supports each value, and which value tensions remain unresolved?
VSD also has limits that candidates should recognize. Choosing which values and stakeholders count is itself a judgment, so teams should document their reasoning and invite outside perspectives, especially from groups who are often overlooked. VSD guides design but does not replace legal requirements, and a value-sensitive process can still produce a harmful product if its findings are ignored when they conflict with business goals.