Published on | Prototyping: From UX to Front End — Medium Kinneret Yifrah

Our job as microcopy (and copy) writers, as part of the GDRP is:

Phrase the consent request from users, allowing us to collect and use their data.
Rethink the way the privacy policy is written and make it much more friendly, so the users can actually read it.
Write copy for the interface that allows users to withdraw their consent and even ask their data be deleted.

And if all this sounds like gibberish to you, you probably haven’t read the first post on the subject yet, describing the intersection where GDPR and UX meet, and the shared challenges they pose to us. I recommend you go ahead and read it first, before continuing. Here it is

Three balls in the air

Like I wrote in the first post, when writing the request for consent and the privacy policy, we need to serve three purposes:

User Experience — make it easy for users to understand the terms and make choices best suited for them.
Business goals — user data is an important basis for business activity, so we would like as many users as possible to grant us their consent.
The law — we must of course comply with what is considered as consent and what is not, what it means to be transparent, and more, according to legal counsel.

How do we achieve these three goals?

1. At the end of the day, it’s all just a call to action, so give the users a good reason to agree

There is a hurdle we have to overcome with each CTA: users don’t really like to pay, register or watch our promotional video, but we want them to do it nonetheless.

My favorite way to make users act (in any context, not just here) is by suggesting value, a benefit: tell users in a simple and clear way, using everyday wording, how their lives are going to be better if they take the required action.

If you indeed persuade them their lives are going to become better — the chances are high they will act.

And by ‘better lives’ I don’t mean promising users they can take an early retirement, but rather that something in their lives will become easier to deal with, better, more interesting, more efficient, less complicated, happier etc.

We are already implementing this in the context of privacy regardless of the GDPR, for example:

To encourage users to provide us with their phone number, we will explain that by doing so they make it easier to schedule a shipment at the best suitable time for them or send them last minute updates.
When we ask for their birth date, we will explain it by sending them a birthday perk or by providing a suitable experience for their age.
If we are asking for an email address, it’s best to promise to only send emails that will benefit their lives, like a daily recipe to help them tackle the ‘what to eat’ challenge, or posts with interior design inspiration, etc.

Each product or service has its own benefits and values, and you need to know them well in order to succeed in prompting users to use them. In my book “Microcopy: The Complete Guide”, I demonstrate step by step, in the chapter about voice and tone design, how to identify these advantages and incorporate them in our messaging and microcopy.

Requesting the GDPR consent is exactly the same.

Like Ryan Cordell wrote in his excellent post on the GDPR and microcopy:

“This microcopy will need to sell. It needs to convert users into giving over their data […] They need to know that by handing over their data it will help improve their future experiences with the product. But dig deeper than that if you can. What about the product will improve specifically? Will it mean something they love will get even better or is it a case of fixing something that has caused frustration?”

So, to make users give their consent, it’s not enough just to tell them we need it by law. We need to show them how using their data also leads to them getting a much better product, and exactly how that happens.

Pinterest, for example, gathers and processes my data in order to give me the best fitted feed, thus helping me achieve the goals for which I signed up to Pinterest in the first place — to get my kind of ideas and inspiration on matters that are interesting to me. Pinterest should be clever enough to phrase it from my point of view, remind me what I specifically love about this product and how the processing of my data is essential for getting this experience.

Only if we literally offer users a good and specific reason for sharing their information — they might consent.

(It’s important to point out here that not everything online requires prior consent. These issue is discussed briefly in my previous post.)

2. And vice versa: If users choose not to share their data, they should know what they are missing

Are there features that will malfunction or stop functioning altogether without the users’ data?
What can’t you notify them about should they choose not to consent for their data to be used?
Which perk won’t you be able to give them if they disallow sharing that information with the third party supplying this perk?

Both in a general request for consent and in the privacy policy, you should advise the users about the implications of their choices (and it can also pop up dynamically, i.e. the notice will appear only if it becomes relevant).

For example, in the case of Pinterest, it would be worthwhile to prepare a short, direct message that appears as soon as users decline to give permission for their data to be collected and used. It can read something like:

This message is not really from Pinterest. I made it up to make a point

As you can see in this suggested message, the goal is not to intimidate the users in any way, not even to try and persuade them to change their mind, but only to notify them, as a matter of fact, on what will (or will not) happen if this data is lacking, and to give them the power to make their own choice based on all the information available.

3. The right to delete your data can be used as a Click Trigger

In the common mailing list pop-up, users are often reminded that: “You may unsubscribe at any moment”.

This tiny addition is a Click Trigger (a term coined by Joanna Wiebe), i.e. it encourages people to sign up, as it reminds them there is no commitment here and nothing to lose: if you don’t like it — you can disengage with a click.

The users’ legal right to remove themselves from mailing lists is actually an encouragement to make them sign up for it.

It may also be useful in the context of the GDPR, since users are reminded of this before giving their consent to having their data collected: “You can change your mind at any time and request that it be deleted”.

This might make it easier for them to give their consent, and even boost their trust in you.

4. Plain unequivocal language

The GDPR requires us to be clear, accessible and transparent to provide users with a real choice based on their full understanding.

Being clear here will not only serve the requirements of the law — it is also the only way for us to gain the users trust by demonstrating that we aren’t hiding anything and all is laid out in plain sight, for the users to control and make decisions by. Such trust can make more users share their data.

This is why some things should be given special consideration.

The first most important thing is to convert legal talk into everyday clear and simple language.

Phrase the texts in the language people actually use. If the legal department insists on using legal language, remind them that clarity and simplicity are GDPR requirements, exactly like data security.

Here are some examples of legal talk written in non-legal language. The examples are not about privacy, but exemplify well how to deliver legal information in conversational language (give your legal team a chance to see these).

Lemonade sells insurance using everyday language accompanied by concrete examples that help the users understand things clearly:

Tal Florentin ‘s Summurai Conference terms of use can be understood by anyone in seconds:

And if you woke up feeling especially brave, you can even write legal texts in the tone of voice most suited to your brand. Check out Really Good Emails terms of use:

Yes, it takes guts. I wrote about risk management for being innovative with your legal stuff at the end of my previous post, check it out.

Other writing principles worth adopting in the microcopy of consent and privacy

Read everything several times and make sure there’s one simple meaning, not too sophisticated or over-complex.
Avoid confusing lingual structures like double negatives: “Are you sure you don’t want us to not use your information?”
Avoid phrasing that sounds like a threat: “If you don’t consent…”
Break down complex sentences to a few short ones, each with its own single simple message.
Provide a complete sentence and don’t make due with a short heading that sounds good.

Facebook eliminated headings entirely and only displays simple questions with unequivocal answers. See how it help in making an informed choice:

Another good example is in the mailing setting of Hello Fresh. They give a clear heading followed by a simple explanation sentence (which also offers value).

In the privacy terms — give summaries, and summaries of summaries. Otonomo’s privacy policy is segmented into very short chapters with clear headings, and each has a summary on its left. It’s hard to read the text here, but you should look them up and see how easy they are to use.

When possible, give examples for specific pieces of information you will be gathering and how you will use it, so users can easily understand what it’s all about and not feel as if hidden processes are kept in secret from them.
Use language that gives the control back to the users, for example, on buttons use first person and words of choice and decision, such as Give me more info or Let me choose or I agree.
If users decide to ask you to delete their data — respect their wishes in the microcopy of both the form and in the confirmation message that follows. Explain the consequences, as I explained in section 2 above, and be true to your word — that the user is in control and the choice is theirs.
Avoid “We’re so sorry to see you go” or “You’re breaking our heart” (two too common phrases following an unsubscribe action).
Thank the users for putting in the time to make a decision and promise them that should they opt for a personalized product with all its features and benefits — they are welcome to change the settings at any time.

But mainly remember, this law is trying to balance between the users’ benefits and that of the business activity. This is exactly what we do when we write microcopy in any other context. At the end of the day, you should apply all the principles of microcopy we know on writing microcopy for the GDPR as well.

<a href="https://medium.com/media/b85dfbb5286d8a25cf2e754b9462cf45/href">https://medium.com/media/b85dfbb5286d8a25cf2e754b9462cf45/href</a>

The microcopy of GDPR (part 2) was originally published in Prototypr on Medium, where people are continuing the conversation by highlighting and responding to this story.

The microcopy of GDPR (part 2)

Cool stuff, every week

More Articles