Teaching Usable Privacy in HCI Education: Designing, Implementing, and Evaluating an Active Learning Graduate

Why Read This from an HCI Perspective

This article is meaningful to HCI practitioners and researchers because it frames privacy not as a ‘piece of technology,’ but as a question of how people actually understand and behave. In particular, the way the curriculum is designed by bundling role-play, case discussions, and staged research assignments shows how abstract theory comes to life in practice. It is also practical that the authors evaluate and reflect on the course to confirm its educational impact.

CIT's Commentary

The core of this article is not how to ‘build privacy well,’ but how to teach and design so that people can properly experience it and meaningfully intervene. In particular, role-play and case discussions are far more powerful than simply delivering knowledge—they are well suited for training the common ‘there are notifications, but users can’t act’ problem seen in safety-critical systems. However, in real products there isn’t the same room for discussion as in a class, so it becomes even more important how short and clear the interface makes the user’s path to intervention. Adding LLMs is an interesting extension as well: beyond simple automation, it could be used to quickly analyze student responses or UX assignments and build evaluation tools. In environments like Korea’s Naver, Kakao, and startup ecosystems—where features change rapidly—this kind of education is especially helpful for bridging the gap between ‘principles’ and ‘operations.’

Questions to Consider While Reading

• Q.When translating this curriculum into real product-team training, what short, practice-oriented format for role-play and case discussions would be most effective?
• Q.To measure learning outcomes for privacy interfaces with an LLM, what qualitative and quantitative metrics should be designed together?
• Q.In a context like Korea’s service environment—where releases and improvements iterate quickly—what design principles satisfy both user intervention pathways and regulatory response at the same time?