A municipal library replaced its physical card with a digital account. On the first loan, the app displayed a friendly notice: “Personalize your reading experience.” It did not say that, if the reader did not answer before the annual renewal, loan profiling would be enabled by default. Marta closed the window because using her phone was difficult and she wanted to reach the catalogue. Months later, she learned that her loans, holds, and browsing times had fed recommendations through an outside platform. She had not clicked agree. The service had simply treated her silence as permission.
A digital card can make renewals and notices easier. The issue is not digitisation itself; it is making a non-response decide something that is unnecessary for lending a book. Searching, borrowing, and returning do not require a portrait of someone’s interests, health, family situation, or political views. If the library wants to offer history-based suggestions, it should request a positive, understandable, reversible choice. Silence can mean hurry, poor connectivity, fatigue, uncertainty, or a reading barrier. It does not reliably mean consent.
A missing answer is not one clear signal#
Services often treat their own actions as proof of the reader’s understanding. A delivered notice becomes information received; a displayed screen becomes an explanation understood; no reply becomes agreement. Real access is messier. Some people share a phone, change numbers, need help signing in, read in another language, or only use the internet when a trusted person is present. Others see the message but assume it concerns harmless suggestions rather than continuing analysis of their reading history.
Services often treat their own actions as proof of the reader’s understanding. A delivered notice becomes information received; a displayed screen becomes an explanation understood; no reply becomes agreement.
At least four situations must be kept apart: not receiving a notice, receiving it without understanding it, choosing to keep a protective setting, and postponing a decision. None authorises profiling. Where the consequence is data sharing, preference inference, or a material change to an account, the protective setting should remain in place until the person clearly confirms another option. That rule is not a technical inconvenience. It prevents a routine renewal from quietly acquiring a privacy consequence that the reader never had a fair opportunity to assess.
It also makes accountability possible. A recorded affirmative choice, tied to the date, the plain-language message, and the selected setting, allows staff to explain what happened and restore an earlier preference. A record saying only “notification sent” cannot distinguish a failed delivery from informed agreement. Traceability should help limit automatic decisions and repair mistakes, not become another reason to collect more information about readers.
Explain before asking#
The notice should separate core service from optional processing. It can begin with a direct assurance: “Your account will work the same way if you do not enable loan-based recommendations.” It should then state what is analysed, why, who can access it, and how long it remains available. “Reading profile” is not enough. It might describe a list shown within the library account, or it might describe a company combining titles, devices, and times to predict future interests. Those are materially different arrangements.
This does not require an endless legal document. Layered information can provide a short explanation and a detailed view. The short layer, however, must contain the decisive facts: whether loans are used for recommendations, whether processing is internal or external, and whether declining affects holds, renewals, or support. A label such as “improve your experience” cannot carry the weight of those facts.
Clarity can be tested rather than assumed. People who did not build the service should be able to say what each choice does, what remains available if they decline, and where they would change their mind. If they believe declining will prevent renewal, the design has failed even if a legal link appears on the page. Testing with different ages, languages, and access needs exposes barriers that a team fluent in its own technical terms can easily miss.
Renewal is not a licence to extract#
Renewal confirms that someone may continue using a library; it is not a hidden negotiation about their privacy. The service may need current contact details or may need to communicate changed rules. It should not bundle those necessities with new permissions for external providers, promotional messages, or behavioural analysis. The more choices are packed into a required step, the less real capacity a reader has to separate them.
Profiling should therefore stay off by default. When it is offered, the service can describe a concrete result: “We will use your recent loans to suggest titles inside your account for six months.” The reader can then judge a visible consequence. There should also be discovery without tracking: staff-curated lists, subject searches, reading groups, and recommendations chosen manually. A useful service does not require every helpful interaction to become an observation channel.
The design must include people who do not use the app. Saying that a relative can help is not enough; it may force someone to share a password or a private reading history. A desk visit, telephone call, plain-language letter, or assisted terminal should allow renewal and preference choices with the same practical result and reasonable deadlines. These routes are part of universal service, not a special favour for people who do not fit an app-first assumption.
Restore choice without a penalty#
An account should show its setting plainly: whether profiling is active, what information it uses, when it started, and how to switch it off. Deactivation should not require a call to a vendor or a chain of forms. The confirmation should explain what stops, what data will be deleted or no longer used, and which basic functions continue unchanged.
Restoring a choice does not mean deleting every record needed to manage a current loan. It means separating a pending hold or disputed fee from information used to infer tastes. Keeping a profile “just in case” is different from retaining what is strictly necessary. Retention periods, exceptions, and correction routes should be written so that a reader can understand them without becoming a privacy specialist.
There must also be a responsible person with the authority to correct an error. Someone who notices unwanted profiling needs a response that does not begin by blaming them for failing to read. Staff should be able to check the setting history, return the account to its protective state, and explain what happened while the feature was active. When the cause is a design flaw, repair should reach everyone affected, including readers who did not realise the problem existed.
Measure access and dignity, not merely activation#
The library can evaluate the change without turning readers into a score. It can review renewals by channel, time to correct a problem, repeated support questions, and abandonment rates, then listen to voluntary accounts of why those patterns occur. A high activation rate is not necessarily success. It may show that the accept button was more prominent or that declining looked risky.
A responsible review rehearses failure: an old email address, a lost phone, a shared account, or a supplier changing terms. Any platform contract should provide access to relevant records, ban secondary uses, establish deletion periods, and allow profiling to be suspended without closing the catalogue. Designing that exit before a problem occurs is fairer than improvising after a reader has been excluded.
Before the next renewal, the library could present three equally visible options: keep recommendations off, enable local recommendations for six months, or receive human help without use of reading history. Each must preserve the right to search, borrow, renew, and obtain support. That small change stops treating silence as a fictional signature and recognises that a genuine decision needs time, comprehension, and an open route back.
