University of Maryland

SOUPS 2018 Workshop Report: Designing Privacy and Security Tools for Children and Teenagers

By Priya Kumar, Jessica Vitak, Elizabeth Bonsignore, Marshini Chetty, Tammy Clegg, and Pamela Wisniewski

A PDF version of the report is available here.

Smartphones, tablets, and apps are part of everyday life for today’s children and teenagers. But how are children and teens thinking about privacy and security online? To what extent are they developing skills to navigate situations that challenge their privacy and security?

Indeed, children under age 12 understand aspects of how going online implicates privacy (Kumar et al., 2017), and their insights are instrumental for developing engaging tools, technologies, and educational resources focused on privacy and security (Kumar et al., 2018). One way that we are bringing children’s voices into dialogue on digital privacy and security issues is through participatory design (PD) research.

Collaboration has been key in this effort: Tammy Clegg and Beth Bonsignore from the University of Maryland conduct participatory design work with children. Marshini Chetty from Princeton University and Jessica Vitak and Priya Kumar from the University of Maryland primarily study digital privacy and security, including how they relate to children. Pamela Wisniewski from the University of Central Florida examines adolescent online safety.

To help others incorporate PD techniques into research on children and digital privacy and security, we recently led a workshop on this topic at the Symposium on Usable Privacy and Security (SOUPS) conference. Researchers and practitioners from more than 10 academic, industry, and non-profit institutions gathered in Baltimore, Maryland to learn about PD methods and to practice mapping out a PD research project related to privacy/security and children’s digital technology use.

Below, we summarize the takeaways from the workshop. We hope this can be a resource for others interested in using PD methods with children to study topics related to digital privacy and security.

Table of Contents


What is participatory design (PD)?

PD is an approach to work with end-users to design social systems (including technologies) rather than designing such systems for users. It emerged out of Scandinavian democracy movements in which workers sought an active role in designing and making decisions about technology in the workplace (Bødker, Ehn, Sjögren, & Sundblad, 2000). Beyond the workplace context, PD is used in academic research as well as community-building. PD sees end-users as experts and incorporates them into the design team as equal partners. How this integration happens varies across different practices and settings; there is no one way to do PD.


Why conduct participatory design with children?

Like adults, children now interact with digital technologies every day. This means that processes to design technologies should involve children as active partners. Children are not simply little adults; they think, see and act differently than adults. And while all adults were once children, that experience gives them zero expertise on what it means to be a child today. Bringing children into the design process means welcoming unique perspectives that are grounded in the socio-technical contexts of the present moment.


What does participatory design with children look like?

Children can participate in the design process as 1) users, 2) testers, 3) informants, and 4) design partners (Druin, 2002). Each role builds on the previous and reflects a deeper level of engagement. We primarily use a PD method called Cooperative Inquiry that involves working with children as design partners (Guha, Druin, & Fails, 2013).

In this method, a team of children and adults meet regularly and work on a shared design activity. The session opens with snack time where adults and children eat and talk casually. The group then moves to circle time where everyone sits in a circle on the floor, introduces themselves, and answers a question related to the design activity. Adults and children then work on the design activity and present their work at the end of the session. Adults wear casual clothes, everyone uses first names, and adults and children complete the same activities. This helps reduce the power dynamic that often defines child-adult relationships and signals to everyone involved that the adults and children are equal partners.

We primarily work with the University of Maryland’s Kidsteam, the first intergenerational team to practice cooperative inquiry on a sustained basis. Since Kidsteam began 20 years ago, other universities and industry labs in North America and Europe have created similar teams. And while Kidsteam focuses on children ages 8-11, other PD projects have included tweens and teens.


What techniques work well for participatory design with children?

The activities at a Cooperative Inquiry design session involve various techniques, depending on the project’s goal and stage in the design process (Fails, Guha, & Druin, 2013). They include:

  • Bags of Stuff (Yip et al., 2013): Design partners use art supplies (construction paper, pipe cleaners, etc.) and found objects (cardboard, popsicle sticks, etc.) to create low-tech prototypes of new technologies. This is useful for brainstorming new ideas or solutions.
  • Big Paper (Walsh, Foss, Yip & Druin, 2013): Design partners use rolls of butcher-block paper or large, table-size sheets of paper to explore and iterate on design ideas. This is useful for brainstorming and combining ideas.
  • Mixing Ideas (Guha et al, 2004): Design partners come up with ideas on their own and work together to combine them to form one “big idea.” This technique works well with children ages 6 and under who might have difficulty ceding ownership over “their” ideas.
  • Layered Elaboration (Walsh et al., 2010): Design partners use sheets of transparency paper to annotate prototypes or designs. Each round of ideas is documented on a new sheet of paper; this helps preserve ideas through iterations.
  • Sticky Noting/Likes, Dislikes, Design Ideas (Kumar et al., 2017): Design partners record what they like, dislike, and would change about a technology or other object of focus on sticky notes. The notes are then clustered and analyzed. This technique is useful for evaluating or critiquing existing products.


How can researchers and practitioners incorporate PD into their work?

At the workshop, we asked participants to jot down ideas on sticky notes in response to the following prompt: Imagine you’re developing a new privacy and security app for kids. How would you go about it? What steps would you take to begin your process? Their answers generally fell into the following categories:

  • Frame the research project (e.g., define the population and the prevailing cultural context, review relevant literature and existing apps, identify the purpose of the project).
  • Consider ethical questions (e.g., obtain approval from university, imagine who would misuse the app, figure out how to discuss concepts with children in age-appropriate ways).
  • Engage with children and adult stakeholders, including parents and teachers, through traditional methods (e.g., observation, interviews, focus groups).
  • Design the technology (e.g., create and iterate on mock-ups, wireframes, and prototypes).

While the techniques described in the previous section may seem to fit most clearly into the “Design the technology” category, we challenged the workshop participants to imagine how they could use PD at all stages of a project. For example, researchers could invite children into the framing phase to help shape the project goals. Those children could then connect researchers with other children and adults who may want to participate in the engagement and design processes. A research project could partner with the same group of children at each phase, or bring in new children, and different phases of a project can involve different types of PD methods. The question is not whether a project is or is not PD, but rather, how does PD best fit into a project given resource constraints and project goals. As one participant summarized, PD is not an either/or but a spectrum.


How can PD be used in research related to children and digital privacy and security?

Several Kidsteam design sessions have focused on aspects of digital privacy and security. Below, we briefly review what those sessions covered and then describe three potential PD projects related to digital privacy and security that participants at the SOUPS workshop brainstormed.

  • Co-designing Mobile Online Safety Applications with Children (McNally et al., 2018): Researchers held two co-design sessions with Kidsteam in which children reviewed a commercially available mobile monitoring application and re-designed the features they thought parents should not control. They also designed a mobile interface to help children handle two common mobile risk scenarios: accidentally seeing inappropriate content and experiencing cyberbullying. A summary of the findings and implications of this study are available here.
  • Co-designing Resources to Help Kids Learn about Privacy Online (Kumar et al., 2017): Researchers held three co-design sessions with Kidsteam. Children first reviewed existing privacy-focused resources (an online game, a video series, and a mobile app) and shared design ideas. They then iterated on a prototype of a privacy-focused mobile game and developed interactive choose-your-own-adventure stories related to privacy online. The findings and implications of this study are available here.
  • Co-Designing with Children to Address “Stranger Danger” on (Badillo-Urquiola et al,. 2018): Researchers held one co-design session with Kidsteam in which children considered two scenarios on the video sharing app (now TikTok)—receiving a message from a stranger and experiencing cyberbullying. Children designed features to help child users cope with these situations. Their designs focused on ways to involve parents, alert others, detect risks, ban users, and educate children. More information about the study is available here.

At the SOUPS workshop, participants formed three teams based on their research interests and mapped out the following projects that could use participatory design to address a particular research question.

  • Creating Teachable Moments for Online Safety: This team wanted to work with teenagers to design technologies that help teens become more aware of their digital footprints. They envisioned holding a PD session in which teenagers storyboarded past experiences on social media and identified potential “teachable moments” related to privacy and security. In subsequent sessions, the teenagers would design new technologies and solutions based on the teachable moments they identified.
  • Examining Mental Models around Password-Sharing: This team wanted to work with teenagers to understand their reasons and thought processes related to sharing passwords. Their goal was to develop curricular materials related to online security for teachers. The envisioned holding PD sessions in which teens storyboarded scenarios that involved password-sharing and then iterated on additional stories created by privacy and security researchers.
  • Co-designing for Adolescent Romantic Resilience and Privacy: This team wanted to work with teenagers to understand how they manage privacy in romantic relationships, and to design ways to support the development of healthy relationships. They envisioned holding PD sessions with teens, parents, and health/school counselors to understand mental models around teen romantic relationships. Additional sessions would include surveys of teens’ social media use, technology immersion to try out different tools, and co-design work on new technologies to support healthy relationships.


What should researchers keep in mind when doing this type of PD research with children?

Two topics that came up often the workshop discussion related to ethics and developing partnerships between researchers and other stakeholders.

  • Ethics and PD: In the U.S., any research with minors requires parental consent and child assent. As a result, such projects may prioritize the voices of children who have healthy relationships with parents. In addition, university institutional review boards (IRBs) may be unfamiliar with evaluating projects that involve open-ended research goals and long-term relationships, such as kids who meet bi-weekly for nine months. Companies may have fewer hurdles to overcome in terms of ethics approval, since those in the U.S. do not typically maintain IRBs. But employees who want to use company resources to do this type of work may have to more clearly demonstrate how this type of research serves the company’s interest.
  • The Value of Partnerships in PD Projects: On a practical level, collaborating with community organizations, churches, or libraries can help researchers connect with willing participants and find space to hold design activities. More important, partnering with an existing community organization helps engender the trust among researchers, families, and others that is key for a successful PD project. And for researchers who lack the resources or time to create a CI team like the University of Maryland’s Kidsteam, partnering with community organizations may offer a more feasible way to do PD work.

Overall, PD offers a fruitful direction for research related to children and digital privacy and security. Children are the experts of their lived experiences with technology, and any efforts to protect their privacy and security should start with their perspectives.



Badillo-Urquiola, K., Smriti, D., McNally, B., Bonsignore, E., Golub, E., & Wisniewski, P. (2018) Co-Designing with Children to Address “Stranger Danger” on Poster Presented at the Fourteenth Symposium On Usable Privacy and Security (SOUPS 2018) Berkeley, CA: Usenix Association. Available at

Bødker, S., Ehn, P. Sjögren, D., & Sundblad, Y. (2000). Cooperative design — Perspectives on 20 years with ’the Scandinavian IT design model.’ In Proceedings of the first Nordic Conference on Human-Computer Interaction (NordiCHI’00) (pp. 1-9).

Druin, A. (2002). The role of children in the design of new technology. Behaviour & Information Technology, 21(1), 1–25. Available at

Fails, J. A., Guha, M. L., & Druin, A. (2013). Methods and techniques for involving children in the design of new technology for children. Foundations and Trends in Human–Computer Interaction, 6(2), 85–166.

Guha, M. L., Druin, A., Chipman, G., Fails, J. A., Simms, S., & Farber, A. (2004). Mixing ideas: A new technique for working with young children as design partners. In Proceedings of the 2004 conference on Interaction Design and Children (IDC ‘04) (pp. 35-42). New York: ACM Press.

Guha, M. L., Druin, A., & Fails, J. A. (2013). Cooperative inquiry revisited: Reflections of the past and guidelines for the future of intergenerational co-design. International Journal of Child-Computer Interaction, 1(1), 14–23.

Kumar, P., Naik, S. M., Devkar, U. R., Chetty, M., Clegg, T. L., & Vitak, J. (2017). “No telling passcodes out because they’re private”: Understanding children’s mental models of privacy and security online. Proceedings of the ACM on Human-Computer Interaction, 1(CSCW), (pp. 1–21). New York: ACM Press.

Kumar, P., Vitak, J., Chetty, M., Clegg, T. L., Yang, J., McNally, B., & Bonsignore, E. (2018). Co-designing online privacy-related games and stories with children (pp. 67–79). Proceedings of the 2018 conference on Interaction Design and Children (IDC ‘18) (pp. 67-79). New York: ACM Press.

McNally, B., Kumar, P., Hordatt, C., Mauriello, M. L., Naik, S., Norooz, L.,Shorter, A., Golub, E., & Druin, A. (2018). Co-designing Mobile Online Safety Applications with Children. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’18) (pp. 1–9). New York: ACM Press.

Walsh, G., Druin, A., Guha, M.L., Foss, E., Golub, E., Hatley, L., Bonsignore, E., & Franckel, S. (2010). Layered elaboration: A new technique for co-design with children. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’10) (pp. 1237-1240). New York: ACM Press.

Walsh, G., Foss, E., Yip, J., & Druin, A. (2013). FACIT PD: A framework for analysis and creation of intergenerational techniques for participatory design. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ‘13) (pp. 2893–2902). New York: ACM Press.

Yip, J., Clegg, T., Bonsignore, E., Gelderblom, H., Rhodes, E., & Druin, A. (2013). Brownies or bags-of-stuff?: Domain expertise in cooperative inquiry with children. In Proceedings of the 12th International Conference on Interaction Design and Children (pp. 201–210). New York: ACM Press.