Dark and Bright Patterns in Cookie Consent Requests

Abstract

Dark patterns are (evil) design nudges that steer people’s behaviour through persuasive interface design. Increasingly found in cookie consent requests, they possibly undermine principles of EU privacy law. In two preregistered online experiments we investigated the effects of three common design nudges (default, aesthetic manipulation, obstruction) on users’ consent decisions and their perception of control over their personal data in these situations. In the first experiment (N = 228) we explored the effects of design nudges towards the privacy-unfriendly option (dark patterns). The experiment revealed that most participants agreed to all consent requests regardless of dark design nudges. Unexpectedly, despite generally low levels of perceived control, obstructing the privacy-friendly option led to more rather than less perceived control. In the second experiment (N = 255) we reversed the direction of the design nudges towards the privacy-friendly option, which we title “bright patterns”. This time the obstruction and default nudges swayed people effectively towards the privacy-friendly option, while the result regarding perceived control stayed the same compared to Experiment 1. Overall, our findings suggest that many current implementations of cookie consent requests do not enable meaningful choices by internet users, and are thus not in line with the intention of the EU policymakers. We also explore how policymakers could address the problem.

Dark commercial patterns

“…Furthermore, other studies have identified dark patterns in search engines and browsers (hard to cancel, preselection, nagging and false hierarchy) (ACCC, 2021 [88]) and in games, particularly in the design of loot boxes (Zagal, Björk and Lewis, 2013 [30]; Goodstein, 2021 [89]; Forbrukerrådet, 2022 [90]) (i.e. features containing randomised items that players access through gameplay or purchase with in-game items, virtual currency or real-world money (UK DCMS, 2020 [91])).…”

“…Other dark patterns may more concretely lock consumers into existing services and hamper switching, such as the forced registration, hidden subscription and hard to cancel dark patterns. The ACCC has for example recently identified dark patterns that hinder switching of browsers (ACCC, 2021 [88]).…”

“…But another possible explanation is that such practices may not be clearly unlawful under existing laws in some jurisdictions, such as general misconduct prohibitions, and/or present a high evidentiary burden under such laws. Various commentators have suggested that in particular dark patterns that are not clearly deceptive -in the sense that they do not necessarily cause a consumer to believe something that is not true -are unlikely to be captured by prohibitions on misleading or deceptive conduct as formulated in certain jurisdictions (CPRC, 2020 [148]; King and Stephan, 2021 [149]; ACCC, 2021 [88]; Chugh and Jain, 2021 [135]). Indeed, in their review of US case law, Luguri and Strahilevitz (2021 [25]) did not identify cases indicating whether practices that do not clearly constitute deceptive acts, such as nagging, price comparison prevention, intermediate currency, toying with emotion or confirmshaming, were unlawful.…”

Is Downloading This App Consistent with My Values?

“…In addition, "dark patterns" can coax users to consent to data collecting practices [7][8][9]. To combat this, privacy-preserving modifications -also called "bright patterns" -have been explored to encourage users to make better privacy choices [10,11]. These interventions, however, can be considered manipulative to the user, especially if they are unaware of a bright pattern's use [3].…”

Putting trust into antitrust? Competition policy and data-driven platforms

“…In some research, the manipulative influence are expressed as ‘dark patterns’ (Narayanan et al, 2020), which can be found in some e-commerce sites (Mathur et al, 2019), and where the incentive is to ‘get’ the clicked consent from visitors in order to serve profiling analytics that largely feeds into the ad market. Studies on consent requests for third-party tracking has shown that both the nudging methods as well as the consumers ‘consent fatigue’ is widespread (Grassl et al, 2021). A recent study that mapped third-party cookies on the Swedish web and interviewed consumers about it showed that they were largely unable to make an informed choice in the cookie consent questions, and that the most third-party cookies were found on retail and e-commerce sites (Larsson et al, 2021).…”