form, namely complete the registration by clicking on
the confirmation link in the e-mail that is subsequently
sent (Strzyzewski & Karpa-Tovar, 2019).
All policy texts have been reworded in such a way
that the most important points can be found
summarized at the beginning of the text. In this way,
the text can be collapsed in parts and expanded if
additional information is needed. In doing so, it was
important to ensure that the texts continued to be
perceived as GDPR-compliant.
The user password field has been updated to
include the option of plain text view.
3.4.2 Technical Implementation
Especially for the implementation of the wizard, a
child theme of the Moodle theme used, which
determines the design, had to be created (John, 2023).
Since the Moodle instance of the Onlinecampus
Pflege already uses a child theme, a grand-child
theme had to be created accordingly. In this theme,
the available templates of the Moodle native policies
have been supplemented by the toggle buttons as an
HTML DOM and the theme css has been extended
according to the necessary functionality.
The additional DOM elements and the dynamics
of the wizard form were implemented via Javascript,
AMD modules and necessary css.
3.4.3 Evaluation
This intervention in the ongoing trial, like the entire
second testing phase, cannot yet be substantiated with
quantitative data. However, initial thinking-aloud
data from other courses with also about 40
participants in their first and second year of training
already show a very positive effect, as the following
statement sums up:
"I've never been so easily registered anywhere."
4 RESULTS & DISCUSSION
Kwon et al. (2023, p. 7) emphasize the usability
challenges for GDPR compliance for users: „The
process for users to exercise data rights is generally
considered to have poor usability. [...] Numerous
studies have concluded that […] policies are typically
too verbose and complex for the average person, as
evidenced by various readability metrics, including
word count and Flesch scores.“ The same is
confirmed by Tsohou et al. (2020).
Surprisingly, the registration procedure in the first
testing phase was not criticized at all. The length of
the policy texts was accepted without comment. The
double opt-in procedure was also not named as a
problem. The latter can possibly be explained by the
introductory event to the Onlinecampus Pflege, in
which the procedure was presented. However, new
registrations did not only take place at the beginning
of the trial phase, but throughout the entire trial
period. The high level of technical readiness of the
participants in the first test phase could promote an
understanding of the procedure. The average age of
the participants in the first test phase was 44.5 years.
It was only the results of the thinking-aloud data
collection in the teaching and learning events with
much younger participant in the second testing phase
that revealed problems in the GDPR-compliant
registration procedure.
A surprising finding is that younger participants
expressed problems understanding the double opt-in
process. Double opt-in is very widespread because it
is indirectly required by law. According to the
German Federal Statistical Office's statistics on
internet activities for private purposes by age, the
younger age groups up to 44 years old are more likely
to participate in social networks than the age groups
over 44 years old (Statistisches Bundesamt (Destatis),
2020). The double opt-in procedure is usually used to
register with social networks. It was therefore
expected that younger people would have more or the
same experience of it as the older ones. However,
single sign-on is now being used more and more.
Single sign-on is as procedure, where a double opt-in
process is used once for an authentication. This
authentication can then be used for multiple services,
including social networks. Therefore, the younger
participants may lack the experience equally.
The implementation of the registration form in the
wizard shows the different steps of the registration
and also visualizes the steps of the double opt-in
procedure that follows. According to the first
collected thinking-aloud data after the intervention, it
seems to provide an understanding of the procedure.
In Moodle’s native progressive form, the information
about the subsequent double opt-in process is
completely missing. In this respect, it can only be
derived from the experience with other registration
processes in web forms without explanation as in the
videos.
The perception of the policy texts as too long is to
be expected for the young participants. On the one
hand, the texts are quite long and therefore less user-
friendly. On the other hand, the young participants are
more influenced by modern digital media, which
require only short attention, compared to the older
ones. Tsohou et al. (2020) points out that policy texts