Personally Identifiable Information (PII)

About PII

Personally Identifiable Information (PII) is data that could be used to identify a specific person, either directly by itself or indirectly when combined with other data.

The collection and handling of participant PII when gathering insights through testing must comply with applicable data protection laws, including without limitation the General Data Protection Regulation ("GDPR").

For questions about how to collect and handle PII in compliance with applicable law, please consult with your legal counsel.

Prohibited PII

The following categories of PII cannot be collected on or submitted to the UserTesting platform, regardless of whether your test asks for consent or you use the Blur Tool:

• Financial account information (e.g., bank account number, information subject to the Payment Card Industry Data Security Standard (PCI DSS))
• Government-issued identification numbers or documents (e.g., Social Security number, driver’s license, passports)
• Online login credentials (e.g., authentication/authorization credentials, password, security question and answer)
• Biometric identifiers (e.g., genetic data, fingerprints, voice prints, facial modeling data)
• Health information subject to enhanced protection under applicable law (e.g., Protected Health Information (PHI) as defined in the Health Insurance Portability and Accountability Act (HIPAA)), unless the parties have executed an appropriate document such as a Business Associate Agreement

UserTesting may remove prohibited PII from the platform without prior notice.

Sensitive PII

You are responsible for obtaining any required consent from participants for the collection of PII defined as “sensitive” under applicable law or that otherwise requires enhanced consent under applicable law.

The definition of sensitive data varies by jurisdiction. Examples may include, without limitation, data related to:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Health
• Sex life or sexual orientation
• Criminal background

Tools and practices to support compliance

Screener questions

Depending on your internal policies and applicable law, you can use the screener functionality on the UserTesting platform as a method for obtaining informed consent from participants regarding your collection and use of PII.

You can also use screeners to set expectations. For example, if you think participants’ PII might accidentally pop up during the recording (such as notifications), create a screener question prompting the participant to disable notifications.

Blur tool

Depending on your internal policies and applicable law, you can use the Blur Tool on the UserTesting platform for certain tasks that expose PII you want to protect. If a participant’s PII must be visible on the screen during a certain task, you can enable the Blur Tool to make the screen unreadable during that task.

Ask for mock data instead of PII

Depending on your testing needs, consider instructing participants to enter mock data (e.g., a fake email address and fake password) instead of PII.

Consider alternative testing methods

Consider a Live Conversation rather than an unmoderated test. This allows you to manage the conversation and prevent the sharing of sensitive information.

Review pages as you plan your test

Be mindful that PII might appear on the dashboard or other pages within logged-in experiences. Review these pages as you plan a test and consider using the Task question and Blur Tool.

Contact support if you want to remove a video

If a participant accidentally shares PII, including prohibited PII, you can reach out to Support to remove the video.

Special considerations

Testing purchase transactions

UserTesting participants must never be required to purchase anything or otherwise participate in financial transactions using their own funds and/or accounts.

If your test requires participants to go through a complete checkout process, you can provide them with gift cards or gift codes to complete the checkout without using their own credit card information.

If you have questions about how to test processes that include a financial transaction, visit our course.

Messaging with Participants

If you need to communicate with a UserTesting participant outside the test, follow our guidelines for messaging.

Deletion requests from Participants

If a UserTesting participant submits a data subject request to UserTesting for deletion of their data in accordance with applicable law (such as GDPR), UserTesting will delete their account but not any test data, including videos. The participant is informed that the relevant customer must be contacted to request deletion of test data.

If you receive a deletion request related to test data, you can reach out to Support for assistance.

If you have questions, please contact the UserTesting Support team.

Related content