Work

PayPal

  • Fintech
  • Privacy & Data
  • Information Architecture

Privacy settings people can read

75% of settings traffic stopped on the first page. I owned the design of PayPal's privacy settings so that every setting is one tap away and says what it does. Launched in early 2023, now used by more than 80 million people.

Impact

60%
Fewer support calls about privacy settings
76%
Faster data access time
4.7/5
Average rating of the new settings, from 150 users

After launch in early 2023

Case snapshot

Role
Owned the design · Research through delivery
Team
4 other designers, content strategist, lead researcher, 3 PMs, 2 privacy officers, 15+ engineers
Platforms
PayPal app, mobile first, and web
Timeline
March 2021 – January 2023

The situation

75% of settings traffic stopped on the first page. The settings had grown one control at a time.

A list of controls in legal language, with no structure underneath. New features and new GDPR and CCPA rules had nowhere to go. Customer service heard the same privacy questions again and again.

One page with three headings replaced a list of legal controls.

  1. 01. Before: Five rows under one heading, in no order. After: Three headings group every setting.
  2. 02. Before: Interest-based marketing, a row of its own. After: Deals & ads, under Permissions and shared data.
  3. 03. Before: Download, correct and delete share one row. After: Your data rights: three rows. "Correct" became "Update".

What was broken

  1. No structure

    Controls added one at a time, in jargon, with no information architecture.

  2. No transparency

    People couldn't tell how their data was used or which controls they had.

  3. No room to grow

    New features and new GDPR and CCPA requirements had nowhere to go.

  4. Nothing explained

    Nothing told people what their data rights were, or how to use them.

It's not explained clearly. I have to fill in the holes with my own prior knowledge.

A participant in customer research

The bet

How might we give people privacy settings they can read and change in one tap, and meet GDPR and CCPA on the same screens?

My scope

I owned the design from the first card sort to delivery, across every team with a setting on these screens.

How data is used in context & how to control
View marketing / education about a PayPal product or capability
Explain how data is used / protected related to product
Sign up for product or account
Visiting for the first time
Explain that we use cookies (banner)
Contextual setting / preview
Continue with site
Logged into PayPal (web or app)
Have privacy concern within product flows / experiences (during a task)
Explain how data is used / protected related to product
Contextual setting / preview
Continue in flow
Within 3rd party contexts (e.g. shopping integrations)
Explain how data is used / protected related to product
Contextual setting / preview
Continue in context
Where privacy questions come up, and what the product does at each one.
What I owned
The design direction, end to end: the information architecture from the card sorts, the five questions every setting answers, and the call to drop the first version's extra layer (below). I designed the Data and privacy page myself and set the direction for every flow in this case.
Research
I ran four closed card sorts and the unmoderated prototype tests, and design tests every two weeks with product managers and engineers asking the questions. I built prototypes for the researchers and helped take notes and synthesise.
How the designers worked
I set up one file system, a log of changes and a sprint planning site, so five designers could work on one set of screens. I mentored two of them on mobile patterns.
Who I worked with
A content strategist on every string, a lead UX researcher, three product managers, two data and privacy officers, more than 15 engineers, customer service, and the product teams whose features needed a setting here.
The constraint
GDPR and CCPA decide what has to be disclosed and what PayPal has to keep. Deleting your data can't remove what regulation requires PayPal to retain, and the delete screen says so.

The hard call

The first structure tested well and cost a tap. I kept the groups and dropped the extra layer.

The first version came straight from the card sorts. Four tiles: Profile privacy, Feature preferences, Notifications, and Ads and data. Each tile opened a sheet of its settings. Each setting answered five questions: what we collect, where it comes from, why, whether it's shared, and what you control.

Data and Privacy

Control how info is displayed and who sees it.

Privacy hub link
Learn more

The first version: four tiles, and a sheet of settings behind each. Tap a tile to open it.

In rapid research the groups worked. The sheets didn't: one more tap before any real setting, on every task. Some labels failed too:

What rapid research found

Critical
People couldn't tell deals from ads.
Medium
To change marketing email, people looked under Notifications, not Data and Privacy.
Medium
People didn't understand the "Your data rights" section, and read "Correct your data" as something other than updating their details.

So I kept the groups and dropped the sheets. Every setting now sits on one page under three headings: Profile privacy, Permissions and shared data, and Your data rights, each with a line saying what it does. "Correct your data" became "Update your data". Emails and notifications got their own link at the bottom, where people looked for them.

First version → revised

2 → 1
Taps from the privacy page to any setting
4 → 3
Groups: four tiles became three headings on one page

Data and Privacy

Control how info is displayed and who sees it.

Privacy hub link
Learn more

Data and privacy

Set your privacy controls and manage your data.

Profile privacy

Permissions and shared data

Your data rights

Before, the first version, and the revised page. The blue card at the top of the revised page is the yearly privacy reminder, a later proposal.

How the work got made

Four card sorts, three prototypes, and only one cleared the 70% bar.

  1. Start from what people do

    A year of settings traffic, a review with the product triad, and sessions with customer service and the teams whose features needed a setting. The most-used tasks set the order on each page, balanced against stakeholders and GDPR.

  2. Card sorts, then prototypes

    Four closed card sorts tested the current structure against three alternatives: 20 tasks, and people picked the tab each belonged in. Three options survived, and each became a high-fidelity prototype.

  3. Contextual privacy

    Most privacy questions start somewhere else: a first visit, a shopping integration, the middle of a payment. Each of those moments got a short explanation in place, with a link to the setting.

Unmoderated test of the three prototypes · 70% success was the bar

74%
Task success, prototype 3, with no one abandoning
68%
Task success, prototype 1
67%
Task success, prototype 2

The craft

Each setting says what it does, what it's set to, and what changes if you switch it.

Data and privacy

Set your privacy controls and manage your data.

Profile privacy

Permissions and shared data

Your data rights

Data and privacy

Set your privacy controls and manage your data.

Profile privacy

Permissions and shared data

Your data rights

Deals & ads

Deals on PayPal

See relevant deals on PayPal based on what you browse or buy on or off PayPal.

Deals on PayPal is ON

Ads on other sites

Choose whether we use your info to show you PayPal ads on other sites.

Every setting is one tap away, with a line saying what it does. The blue card at the top is a later proposal: once a year, it asks whether your settings still suit you.

A switch that says what's on replaced a single "Turn off" button.

  1. 01. Before: "Turn off" is the only control. Nothing says it's on. After: A switch that shows its state, with a line on what it does.
  2. 02. Before: Two bullets on what you get. Nothing on how it works. After: "Learn how it works" opens an example.
  3. 03. Before: Nothing on what happens to your data. After: It ends on "We never sell your personal information."

Personalized deals and offers

Get offers from PayPal to save at your favorite online stores.

Get personalized offersPersonalized deals and offers is turned off. Turn it on to get money saving deals that are personalized to you.

We never sell your personal information.

The new screens. Flip the switch, or open "Learn how it works".

Grouped data types replaced one long checklist.

  1. 01. Before: A checkbox for every item: six before Usage info. After: One tick per data type, with a line on what it's for.
  2. 02. Before: Every item listed up front. After: Each type's items fold under "What's included".
  3. 03. Before: "Unselect all", with no count. After: "Select all", and a count: 6 of 7 selected.

Get a copy of your data

Choose what data you want to download.

Data types

This helps us keep your account safe, personalize your experience, and contact you when needed.

This lets you check out faster, and send or receive money in just a few clicks.

This info helps us personalize your experience and provide relevant ads and offers.

Your location, the type of device you use and your mobile network.

Other connected apps

You also have data related to these PayPal services.

Choose file format

File typePDF

PDF files can be easily opened on any computer.

Your info is safely encrypted.

Get a copy of your data

Choose what data you want to download.

Data types

This helps us keep your account safe, personalize your experience, and contact you when needed.

This lets you check out faster, and send or receive money in just a few clicks.

This info helps us personalize your experience and provide relevant ads and offers.

Your location, the type of device you use and your mobile network.

Other connected apps

You also have data related to these PayPal services.

Choose file format

File typePDF

PDF files can be easily opened on any computer.

Your info is safely encrypted.

Connected apps (Xoom, Venmo, Honey) are listed too, and the request ends on a note that your info is encrypted.

"Clean up your data" now comes before "Delete and close".

  1. 01. Before: One path: delete everything and close the account. After: Two ways to delete.
  2. 02. Before: Closing the account is the only way to delete anything. After: Clean up first: delete parts, keep the account.
  3. 03. Before: What closing means is spread over paragraphs. After: Closing is still there, second, in one line.

Clean up your data

Improve your experience by deleting these. You’ll remove over-retained, outdated and irrelevant data.

Face scan, marketing, package tracking and third-party profile data can each go on their own, each saying what you lose.

Privacy is explained where the question comes up, not only in settings.

Exclusive offers just for you

14% Off

Nike

$136 $160

$2.00 Cash Back

(200 points)
2h left

Nike

$40

$1.80 Cash Back

(180 points)
40m left

Select PayPal option at checkout to earn Cash Back. Terms apply. PayPal exclusions may apply.

Earn cash back at our top stores

UniqloPostmates

Deals & Offers

Pay with PayPal to save instantly

CVS$5 offDec 1 – 31
Shopping and Privacy

Get top deals inspired by your shopping activity

Today’s top deals

UniqloPostmates

Deals & Offers

Offers carry a "Personalize your experience" link, and a Shopping and Privacy card explains why you see these deals: "We never sell it, and won't share it without your permission."

A white sub-navigation replaced blue on blue: up to 85% better on some tasks, in unmoderated tests.

  1. 01. Before: Blue on blue: in baseline testing, many people never saw it. After: White, set apart from the global navigation.
  2. 02. Before: Small type: Account, Security, Payments, Notifications. After: Larger type: Personal info, Financial settings, Privacy and security, Communications.
  3. 03. Before: A small notch marks the current page. After: A clear marker under the current page.

Your data rights

Get a copy of your data, or delete part of it, without closing your account.

A three-panel storyboard: Samantha worries about her online privacy, decides to request a copy of her data from PayPal, then chooses the type of data from a clear list
The storyboard the data request flow was built around: someone worried about her privacy, who wants to see what PayPal holds and pick what to ask for.

Every request passes through six steps

Intake
The request comes in through the intake portal.
Verification
PayPal confirms it's really the customer asking.
Validation
The requester is a PayPal customer, or a guest account holder.
Eligibility
The request meets the criteria.
Fulfilment
The data is gathered, or erased.
Communication
The customer hears the outcome.

The customer gets status updates along the way, and a confirmation when it's done.

Deletion had to work in parts. People asked to erase specific kinds of data, like face scan, marketing, package tracking and third-party profile data, and keep using their account. Regulation decides what PayPal must keep, so the flow says what will be deleted and what can't be.

Cases the flow had to handle

  1. Erasing only part

    Delete marketing data, keep transaction history and the account.

  2. A request left halfway

    Someone starts and doesn't finish, and gets a reminder to complete it.

  3. A second request

    A new request arrives while the first is still processing.

  4. What the law keeps

    Data PayPal must retain is named, not silently left behind.

Impact

60% fewer support calls about privacy, on settings now used by more than 80 million people.

After launch in early 2023

60%
Fewer support calls about privacy settings
76%
Faster data access time
4.7/5
Average rating of the new settings, from 150 users

What I'd do differently

The groups held up early. The words took longer. I'd test them together, and rougher.

  1. Test the words with the groups

    The card sorts settled where every setting goes. Rapid research then found the words failing: people couldn't tell deals from ads, and read "Correct your data" as something else. I'd test labels with the content strategist from the first round, not after the structure.

  2. Go rougher before high fidelity

    Three options became high-fidelity prototypes before the unmoderated test, and two missed the 70% bar. Clickable wireframes would have found that sooner, for less.

For the detailed case study, reach out to me (opens Gmail in a new tab).

Next