Begin with a question the museum actually needs to answer
A visitor asks for a shorter explanation of a portrait. The system needs that choice to deliver the next paragraph. It does not automatically need a name, a journey through the building or a history of previous visits.
Adaptive interpretation creates a temptation to collect first and decide later. Every interaction appears potentially useful: a pause, a repeated question, a language choice, an abandoned screen. Yet usefulness is not a purpose, and collection is not the same as understanding. A long pause may mean confusion, reflection, distraction or a conversation with a companion.
Write the intended learning question before choosing a metric. “Can visitors find the source for this claim?” suggests a focused usability study. “Which introductory route is selected?” may be answerable with limited aggregate counts. Neither question automatically justifies storing every conversation or identifying repeat visitors.
Separate serving an encounter from evaluating a service
The information needed to respond now is not necessarily information that should be kept afterwards. A language selection may remain in temporary session state. A typed question may be processed to provide an answer and then discarded. Evaluation data can be designed separately, with its own purpose, retention period and access controls.
Aggregation helps only when the underlying process is sound. Small groups, unusual questions and combinations of attributes can make people recognisable even without names. Replacing a direct identifier with a code is usually pseudonymisation, not proof of anonymity. Avoid broad claims about anonymous data unless re-identification risks have been properly assessed.
Treat a shared screen as a public place
People may type names, health information or details about family histories into an open question box. Do not assume a museum topic makes every message harmless. A gentle prompt can discourage personal disclosures without making visitors afraid to ask ordinary questions. Design logs and support tools so accidental disclosures do not spread to unnecessary staff or suppliers.
Clear visible text when a session ends. Prevent browser history, cached pages or an exposed conversation panel from revealing the previous visitor’s exchange. Where staff need diagnostic access, limit it and record who can use it. A public reset control should return the interface to a neutral state, not simply hide the conversation behind another tab.
Ask what the supplier receives
Map the entire path of a question. Does audio leave the building? Does a speech service retain recordings? Are prompts sent to a model provider? Can a subcontractor use them for product improvement or training? A promise made on the museum’s screen is only credible if the technical configuration and contractual arrangements support it.
Consider hosting location, international transfers, deletion procedures, security incidents and the practical ability to export or remove records. Verify settings rather than assuming an enterprise label settles the issue. If a feature cannot work without excessive collection, a smaller feature may be the better interpretation choice.
Make a refusal ordinary
Visitors should not need to accept unnecessary tracking to read the essential account of an object. Separate a voluntary research activity from access to interpretation. Where consent is the appropriate legal basis, it must be a real choice rather than a decorative button beside a predetermined outcome. Other activities may need a different lawful basis and a different explanation.
The UK Information Commissioner’s Office provides guidance on data protection, including the UK GDPR, privacy by design and impact assessments. The European Data Protection Board publishes guidance relevant to the EU GDPR. Jurisdiction, purpose and implementation matter; this essay is not legal advice. Involve the institution’s data protection lead before introducing systematic monitoring or sensitive inferences.
If an interpretation works without identifying someone, that is a design advantage.
Editorial principle — Wafflerocketznd reading room
Evaluate what the visitor gains
Combine restrained quantitative measures with voluntary interviews and observation conducted under a clear research protocol. Ask whether the answer helped someone notice a feature, understand uncertainty or choose a next question. Include people who declined the digital route; their experience may reveal an exclusion that usage figures cannot show.
Publish a concise account of what was learned and what changed, where appropriate. Keep deletion schedules realistic and enforceable. A museum earns trust not by collecting the most complete picture of a person, but by showing that it can improve an encounter while leaving much of that person’s life unknown.
Read how editorial accountability is maintained. For this website’s own practices, see Information in Our Care.