The rules in 0001.f set a floor, and ethics concerns what remains above it, since plenty of what's legal can still harm or mislead people. This section is organized around two questions. The first is what those who build systems owe the people whose data and attention they use, which covers consent, minimizing data, and interface design. The second is who answers for what a system does, which covers professional codes and accountability. Generative AI comes last because it raises both questions at once.

What is owed to people: their data#

Most ethical questions about data begin with whether people actually agreed to its use. Meaningful consent requires that people understand a collection and can refuse it. Those two conditions rule out some common justifications. Public availability of data doesn't establish informed agreement to every use, so a researcher who gathers public posts hasn't thereby obtained the posters' agreement. Acceptance of long terms of service doesn't establish it either, since few users read them and many can't really refuse. Agreeing to one purpose doesn't extend to very different ones. Data that already exists is no exception, so new uses of existing data call for new disclosure and a real choice, as when a school wants to use student records for a study and explains the study to families and allows them to opt out.

Consent governs whether to collect data, and a related principle governs how much and for how long. Data minimization means collecting and keeping only what is needed for a stated purpose, then deleting it, which reduces harm from a breach or misuse, because data that isn't retained can't be exposed. An app that only needs to know whether a user is at least 13 can ask just that, without requesting a birth date. Security camera footage can be deleted automatically after a short, stated period unless it's needed. Keep this distinct from security: encrypting unneeded data protects it, but doesn't minimize it.

What is owed to people: their attention and choices#

Consent also presumes that people are choosing freely, which an interface can undermine. Dark patterns are interfaces that steer users toward choices benefiting a company: hidden fees disclosed late, preselected options, emphasized "Accept All" buttons beside faint alternatives, or cancellation far harder than signing up. A useful test is to ask whether the design makes the company's preferred choice easier than the alternatives. The fixes are often straightforward, such as leaving an option unselected and showing fees from the start.

Dark patterns target a particular decision, whereas engagement design works on behavior over time. Infinite scroll, streaks, autoplay, and frequent notifications maximize attention by removing stopping points and using social pressure, as when a streak makes a teenager feel obliged to a friend. This raises concerns about manipulation, especially of children and teens, whose well-being is most at stake. It also complicates a common defense of these features, that people keep using them because they like them: continued use may reflect a default rather than a preference. Turning off notifications that a person doesn't actually want, or removing such features from a product for young users, addresses the concern directly.

Who answers: professionals and organizations#

Designs like these come from people who could have decided otherwise, which leads to the question of what computing professionals are responsible for. Professional codes such as the ACM Code of Ethics direct computing professionals to contribute to society, avoid harm, be honest, and respect privacy, placing the public good above an employer's convenience. They address responsibilities beyond what the law requires, so a developer may rightly question a data use that is legal but harmful. Honesty rules out reporting only favorable results to a district that's deciding whether to buy a product. And those responsibilities continue when a manager disagrees, so someone who raises a safety concern and is brushed aside keeps pursuing it through appropriate channels.

An individual's code can't settle everything, because harmful systems are usually made by many hands. When an automated system causes harm, responsibility stays with those who build and deploy it, not with "the algorithm." Opacity and shared development shouldn't erase it, even though both make it tempting for each party to point at another. If a district buys a vendor's flawed tool, the vendor answers for the product and the district for choosing and using it. Decision records and named reviewers support accountability in concrete ways, because records let a decision be reviewed, explained, and challenged, and a named person has to answer for the results.

A case that raises both questions#

Generative AI brings these concerns together. On what is owed to people, it raises the issue of training on creators' work without consent or compensation, and of misinformation and impersonation, since these tools can produce convincing false content about real people. On wider responsibility, it raises issues of labor, including displaced and devalued skilled work, and of the energy and water used for training and running models. In schools it adds academic integrity. For integrity, define permitted uses and require disclosure, which sets clear expectations without assuming misconduct, and don't rely on detectors alone, because they can be wrong. Much of this section has concerned the people who build systems. The ones who use them have responsibilities as well, and those are the subject of 0001.h.

• meaningful consent: agreement from people who understand a collection and can refuse it
• data minimization: collecting and keeping only what is needed for a stated purpose, then deleting it
• dark pattern: an interface that steers users toward choices benefiting a company
• engagement design: features such as infinite scroll, streaks, autoplay, and frequent notifications that maximize attention
• ACM Code of Ethics: a professional code directing computing professionals to contribute to society, avoid harm, be honest, and respect privacy
• accountability: responsibility that stays with those who build and deploy a system

Practice: practice questions for 0001.g