15.2 Value Sensitive Design
Key Takeaways
Value Sensitive Design, developed by Batya Friedman and colleagues at the University of Washington, integrates conceptual, empirical, and technical investigations iteratively.
Conceptual investigations identify stakeholders and values; empirical investigations study how people actually experience the technology; technical investigations examine and design mechanisms that support the values.
Indirect stakeholders are affected by a system without using it, such as bystanders filmed by a doorbell or people in an uploaded address book, and they often bear the privacy harm.
VSD makes value tensions, such as safety versus privacy, explicit and seeks designs that serve both.
Tools such as value scenarios and envisioning cards help teams anticipate misuse, long-term effects, and widespread adoption.
15.2 Value Sensitive Design
Quick Summary: Value Sensitive Design (VSD) is a method for building technology that accounts for human values, such as privacy, autonomy, trust, and fairness, throughout design. It combines conceptual, empirical, and technical investigations, applied iteratively, and pays special attention to indirect stakeholders: people affected by a system who never use it. The BoK asks technologists to understand and apply VSD.
VSD was developed by Batya Friedman and colleagues at the University of Washington beginning in the 1990s, and is described in depth in Value Sensitive Design: Shaping Technology with Moral Imagination (Friedman and Hendry, MIT Press, 2019). It treats values as design requirements rather than afterthoughts.
The Three Investigations
VSD operates through an iterative tripartite methodology comprising three interrelated modes of investigation:
+--------------------------------------------------------------------------+
| VALUE-SENSITIVE DESIGN: TRIPARTITE METHODOLOGY |
+--------------------------------------------------------------------------+
| |
| +-------------------------+ +-------------------------+ |
| | Conceptual Investigation| <--------> | Empirical Investigation | |
| | - Philosophical values | | - Human user research | |
| | - Stakeholder mapping | | - Mental models & tests | |
| | - Value trade-offs | | - Comprehension metrics | |
| +-------------------------+ +-------------------------+ |
| ^ ^ |
| | | |
| +------------------+-------------------+ |
| v |
| +-------------------------+ |
| | Technical Investigation | |
| | - Architectural design | |
| | - System mechanisms/PETs| |
| | - Implementation audit | |
| +-------------------------+ |
+--------------------------------------------------------------------------+
1. Conceptual Investigations
Conceptual investigations involve philosophical, ethical, and legal analyses of the values at stake:
- Value Articulation: Defining explicitly what "privacy" and "autonomy" mean within the specific system context (e.g., disassociability, informational self-determination, freedom from profiling).
- Stakeholder Mapping: Differentiating between direct stakeholders (individuals who directly interact with the interface, such as registered app users) and indirect stakeholders (individuals who never touch the system but whose data is processed, such as contacts in uploaded address books or bystanders captured by smart doorbells).
- Resolving Value Trade-offs: Systematically resolving tensions between competing values—such as balancing user accountability and fraud prevention against anonymity and data minimization.
2. Empirical Investigations
Empirical investigations apply qualitative and quantitative human research methodologies to evaluate how stakeholders actually experience the technology:
- Mental Model Research: Conducting contextual inquiries and interviews to understand how users perceive data flows and algorithmic processing.
- Usability and Comprehension Testing: Running behavioral experiments to evaluate whether users comprehend notice language and can successfully navigate privacy settings.
- Investigating the Privacy Paradox: Observing real-world user choices versus stated attitudes to identify where deceptive interface nudges subvert conscious intent.
3. Technical Investigations
Technical investigations focus on the operational and architectural properties of the technology itself. This mode consists of two activities:
- Technical Mechanism Analysis: Evaluating how existing system architectures, data schemas, API protocols, and UI components support or undermine the values identified in conceptual investigations.
- Proactive Architectural Design: Engineering novel technical mechanisms that embody identified values. In privacy engineering, this includes implementing client-side cryptographic hashing, zero-knowledge proofs, automated retention TTLs, and symmetric choice interfaces that make privacy preservation the path of least resistance.
Key VSD Concepts and Tools
- Direct and indirect stakeholders. Direct stakeholders use the system; indirect stakeholders are affected without using it, such as people in a user's uploaded contacts, bystanders recorded by a smart doorbell, or patients whose data trains a model. Privacy harms often fall on indirect stakeholders, who cannot consent or adjust settings.
- Value tensions. Values conflict: safety and privacy, convenience and autonomy, transparency and security. VSD makes tensions explicit and looks for designs that honor both values, echoing Cavoukian's positive-sum principle.
- Value scenarios. Short stories that imagine how a system affects stakeholders over time, including misuse and long-term or widespread adoption.
- Envisioning cards. A card deck (Friedman and colleagues) prompting designers to consider stakeholders, time, values, and pervasiveness.
- Iteration. The three investigations feed one another repeatedly rather than running once in sequence.
Worked Example: A Smart Doorbell
| Investigation | Questions and Findings | Design Response |
|---|---|---|
| Conceptual | Direct stakeholder: homeowner (values safety, convenience). Indirect stakeholders: neighbors, passersby, delivery workers (value privacy and freedom from surveillance). Tension: safety versus bystander privacy. | Treat bystander privacy as a requirement, not an afterthought |
| Empirical | Interviews show neighbors object to cameras that capture their doorways; delivery workers do not know whether audio is recorded. | Add visible recording indicators; default audio off |
| Technical | Camera field of view covers the street; cloud stores all video for 60 days; police request portal shares footage. | Privacy zones that mask neighboring property; on-device person detection; short default retention; footage shared only with the owner's explicit choice per request |
The result protects the homeowner's safety goals while reducing harm to people who never agreed to be filmed, which is VSD's purpose.
Applying VSD in a Privacy Program
VSD fits naturally into the processes covered elsewhere in this guide:
- Privacy impact assessments (Section 13.2): the conceptual investigation supplies the stakeholder list and the values at stake, including indirect stakeholders a data-centric DPIA might miss.
- Privacy goals (Section 14.2): values identified in VSD become explicit goals and measurable objectives.
- Usability testing (Section 15.1): empirical investigations reuse the same methods, but ask what people value and fear, not only whether they can complete a task.
- Design reviews: technical investigations become a checklist item: which mechanism supports each value, and which value tensions remain unresolved?
VSD also has limits that candidates should recognize. Choosing which values and stakeholders count is itself a judgment, so teams should document their reasoning and invite outside perspectives, especially from groups who are often overlooked. VSD guides design but does not replace legal requirements, and a value-sensitive process can still produce a harmful product if its findings are ignored when they conflict with business goals.
In Batya Friedman's Value-Sensitive Design (VSD) methodology, which tripartite investigations must privacy engineers iteratively conduct to ensure software architectures embody human values such as privacy and autonomy?
Static code analysis, dynamic fuzzing, and cryptographic audit certification.
Waterfall requirements gathering, agile sprint planning, and regression testing.
Conceptual investigations, empirical investigations, and technical investigations.
Penetration testing, vulnerability scanning, and threat surface mapping.
A social app lets users upload their phone address books so the app can suggest friends. In Value Sensitive Design terms, the people listed in those address books who never joined the app are best described as what?
Empirical investigators, because their data reveals usage patterns
Indirect stakeholders, because they are affected by the system without using it
Technical investigators, because their data tests the matching algorithm
Direct stakeholders, because their data is processed by the app
During a Value Sensitive Design project for a home security camera, the team interviews neighbors and delivery workers about how they feel being recorded. Which type of investigation is this?
A technical investigation, because it concerns camera hardware
A penetration test, because it evaluates attacks on the camera
An empirical investigation of how stakeholders experience the technology
A conceptual investigation, because it defines and analyzes the value of privacy philosophically before any design work
Sections you finish are checked off in the contents.