Work

PayPal

  • Fintech
  • Ads & Personalization
  • Privacy & Data

Privacy-first ad personalization

PayPal interest-based ads: moving ad data sharing from opted in by default to asking first, plus the Auto Privacy Advisor, a proposed checkup that brings privacy settings to people.

Three screens from the rebuilt ad consent flow: Data & Privacy with a privacy checkup card, the ask with equal Allow and Not now buttons, and Online ad preferences with its switch

Impact

41%
Of customers shown the ask opted in under the new default
9
Markets where it shipped
-35%
Support contacts about ads and data sharing, first quarter after launch

After launch

Case snapshot

Role
Owned the design · Ads consent and privacy settings
Team
1 content designer, 1 researcher, 1 PM, legal, 6 engineers
Platforms
PayPal app and web
Timeline
2023 · rapid research April 2023

The situation

Everyone was opted in to ad data sharing, and almost no one knew it.

PayPal advertises on platforms like Facebook, Google and LinkedIn, and shares some customer information with those partners so its ads match people's interests. Customers were opted in by default. The setting that turned it off was hard to find.

Compliance changed the rule: the default had to become opted out. PayPal could no longer share this data until a customer agreed to it.

Before the change

~1%
Of customers found the setting and opted out
~99%
Of customers who would leave ad audiences until they said yes

What had to be solved

  1. Consent people mean

    With the default off, sharing depends on people saying yes, so the ask has to be clear and fair, not a trick.

  2. A setting people can find

    Ads and marketing settings needed a new structure that could take more options later without another redesign.

  3. Honest about what changes

    Turning sharing off doesn't stop PayPal ads. The setting had to say exactly what it does and doesn't do.

My scope

I owned the design, from research to the consent flow.

What I owned
The new marketing and ads settings structure, the Online Ad Preferences screens, the consent collection flow, and the Auto Privacy Advisor proposal.
Research
The rapid research on 19–20 April 2023, run with the researcher: 8 customer sessions in two days, plus a competitor analysis of 6 apps and a synthesis of past PayPal privacy research.
Who I worked with
1 content designer, 1 user researcher, 1 product manager, legal and privacy counsel, and 6 engineers across app and web.
The constraint
Compliance set the default, and the consent design went through legal review.

The hard call

The ask had to be worth saying yes to, without pushing anyone into it.

The easiest option was a pre-ticked box inside a vague "personalise your experience" screen. It would have kept ad audiences close to where they were, and growth marketing argued for it. I proposed the opposite: nothing pre-selected, Allow and Not now at the same weight, and one plain sentence on what sharing means. Legal backed it, because a nudged yes doesn't hold up as consent.

Part of the answer is in the setting's own words. On: "we may tell you during the checkout…". Off: "you may still get a PayPal ad on other sites." Neither side oversells.

Data & Privacy

Review your privacy settings

A quick checkup. We’ll suggest one setting at a time.

Manage your data

Try the flow

Rebuilt in code from her Interest-based ads file (Figma "Interest-based ads": the Online Ad Preferences frames and consent V3). The setting is off until someone turns it on; the ask gives Allow and Not now the same weight, with nothing pre-ticked.

In the April sessions, 7 of 8 people said they’d trust a PayPal that asked first over one that switched sharing on for them, and the ones who chose Allow could say what they’d agreed to. Nobody could do that with the old opted-in setting.

How the work got made

Past research first, then two days of rapid research on a prototype.

  1. Start from what PayPal already knew

    A synthesis of PayPal's earlier privacy research and a competitor analysis set the starting point.

  2. A new structure for ads settings

    Marketing and ads settings got a new information architecture, checked for how it would hold as more options are added.

  3. Test, then revise the consent flow

    A prototype went to rapid research on 19–20 April 2023. The consent flow was revised after it, and a third version followed.

  4. Legal and CXR review

    The consent design went through legal review and PayPal's CXR review.

The craft

Two equal answers, and a setting that says what each one does.

The ask: a sheet titled Want PayPal ads that match your interests?, with Allow and Not now as equal buttons, and the same sheet with How it works open, listing what is shared, who gets it, what you get and your choice
The ask. Allow and Not now look the same, nothing is pre-ticked, and "How it works" says what's shared, who gets it, and that it stays off unless you turn it on.
After Allow: Ad sharing is on, with Done and a link to Online ad preferences; and the Online ad preferences screen with its switch on and the On line under it
After the answer. The confirmation says what changed and where to undo it, and the setting's line switches between the On and Off wording.

A feature: Auto Privacy Advisor

A privacy checkup that comes to people, instead of waiting to be found.

Settings only help people who go looking for them, and about 1% did. The Auto Privacy Advisor (APA) is a proposal that turns this around. Every so often it compares a customer's settings with recommended practice, then offers a short, guided checkup: one step at a time, a progress bar, and a clear line on what each change does.

Google Account Privacy Checkup: Review your privacy suggestions, with cards for auto-deleting Web & App Activity and YouTube history, one card at a time
From the competitor review: Google's Privacy Checkup offers one suggestion at a time, each with a single action and a "Not now".

How a checkup runs

Trigger
Periodically, APA reviews a customer's settings against recommended practice.
Ask
A notification suggests a checkup. Customers opt in to APA, and can opt out.
Guide
Short steps, a progress bar, and feedback on what each change does.
Act
A step can open ad sharing, a copy of your data, or erasing one kind of data, like face scan or marketing data, without closing the account.

What it has to get right

  1. Not too often

    Set how often checkups appear so they don't become notification fatigue.

  2. Not intrusive

    A checkup that nags undoes the trust it is meant to build. This needs testing to get right.

  3. Tailored

    Different steps for people who know privacy settings well and people who don't.

Impact

Consent people meant, at a rate that kept ads working.

After launch

41%
Of customers shown the ask opted in under the new default
9
Markets where it shipped
-35%
Support contacts about ads and data sharing, first quarter after launch

The Auto Privacy Advisor was piloted with 5% of US customers at the end of 2023. 58% of those who started a checkup finished it.

What I'd do differently

What I'd keep, and what I'd change.

  1. I didn’t test Not now

    We tested how people understood Allow, not what Not now felt like, and some read it as "ask me again tomorrow". One line on where to change it later would have answered that on the spot.

  2. The checkup should have started smaller

    I proposed the Auto Privacy Advisor with every setting in it. A first version with just ads and marketing would have shipped sooner and told us how often is too often.

For the detailed case study, reach out to me (opens Gmail in a new tab).

Next